Freedom251 › Infrastructure Policy as Code Tools
Nirmata Enterprise for Kyverno
What Nirmata Enterprise for Kyverno is
Nirmata Enterprise for Kyverno is a paid, self-hosted Linux distribution of Kyverno for organizations needing a hardened and supported Kubernetes policy engine. It is OSS-compatible and uses no fork: existing Kyverno policies, CRDs, APIs and tooling work unchanged. Policies use Kubernetes-native YAML and CEL, with policy testing, admission control, CI/CD integration and policy reporting. Supported inputs include Kubernetes manifests, Terraform and OpenTofu plans, Dockerfiles, AWS CDK, CloudFormation templates and Ansible playbooks. Nirmata says its nctl tool scans Terraform configurations, Dockerfiles and Kubernetes manifests in CI pipelines. Each supported release receives 18 months of patch support, including backported engine fixes and dependency CVEs. The product includes 24/7 enterprise support with CVE and critical-fix SLAs, compatibility testing and upgrade planning. Nirmata documents deployment on Amazon EKS and Amazon EKS Anywhere. The paid plan costs $14,800 a year, billed per year; pricing scales with cluster footprint and requires a quote. AWS Marketplace offers a pay-as-you-go option.
Who it suits
This distribution suits businesses that want a supported Kyverno build while retaining existing policies and tooling. It is aimed at Kubernetes teams using policy controls in clusters and CI pipelines.
What it does well
- Existing Kyverno assets work unchanged
- 18 months of patch support
- 24/7 enterprise support with SLAs
- CI scanning through nctl
- Policy testing and admission control
What to know first
- No free plan
- $14,800 a year
- Pricing requires a cluster-footprint quote
- Older Kubernetes support can be dropped
Limits
The paid plan costs $14,800 a year and requires a quote, with pricing based on cluster footprint. Support for older Kubernetes versions ends when the relevant cloud provider ends support.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Nirmata Enterprise for Kyverno | Per year; pricing scales with cluster footprint and requires a quote. · Backported CVE fixes for supported releases · 18 months of patch support per release · 24/7 enterprise support with CVE SLAs · Kubernetes compatibility testing · upgrade planning | $14,800 a year |
As nirmata.com lists them, read 7 Oct 2026. The maker's own page has the final word.
Getting started
- Open Nirmata's website
- Review Kubernetes compatibility for your release
- Choose the annual Enterprise plan or AWS Marketplace pay-as-you-go
- Deploy on Amazon EKS or Amazon EKS Anywhere
- Apply existing Kyverno policies using YAML or CEL
- Integrate nctl scans into CI pipelines
Verdict
Nirmata Enterprise for Kyverno adds lifecycle support, security fixes and enterprise assistance around a compatible Kyverno distribution. Its annual quoted cost and Kubernetes-version support policy are central considerations.
Questions
Is Nirmata Enterprise for Kyverno free?
No. It is a paid product with a listed plan of $14,800 a year.
How is the plan billed?
The plan is billed per year, and pricing scales with cluster footprint and requires a quote.
Which Kubernetes environments are documented?
Nirmata documents deployment on Amazon EKS and Amazon EKS Anywhere.
Does it remain compatible with Kyverno?
Existing Kyverno policies, CRDs, APIs, and tooling work unchanged with the distribution.
What policy and infrastructure formats are supported?
Policies use Kubernetes-native YAML and CEL. Supported formats include Kubernetes manifests, Terraform and OpenTofu plans, Dockerfiles, AWS CDK, CloudFormation templates, and Ansible playbooks.
Is there enterprise support?
Yes. The plan includes 24/7 enterprise support with SLAs for CVEs and critical fixes.
Facts from Nirmata Enterprise for Kyverno's own pages
- CI integration
- Nirmata says its nctl tool can scan Terraform configurations, Dockerfiles, and Kubernetes manifests in CI pipelines. · nirmata.com, 7 Oct 2026
- Company headquarters
- Nirmata lists its address as 5201 Great America Pkwy, Suite 320, Santa Clara, California 95054. · nirmata.com, 7 Oct 2026
- Company security
- Nirmata’s security policy says its SaaS infrastructure has SOC 2 Type 2 compliance and AWS data centers with ISO 27001 and PCI DSS Level 1 compliance. · nirmata.com, 7 Oct 2026
- Compatibility
- The compatibility table lists supported Kubernetes versions by Kyverno release, including versions 1.28 through 1.37+ across the listed branches. · learn.nirmata.com, 7 Oct 2026
- Deployment
- Nirmata documents deploying Enterprise Kyverno on Amazon EKS and Amazon EKS Anywhere clusters. · learn.nirmata.com, 7 Oct 2026
- Headquarters
- Santa Clara, California, United States · nirmata.com, 28 Sept 2026
- Marketplace
- Nirmata Enterprise for Kyverno is available through AWS Marketplace, including a pay-as-you-go option. · nirmata.com, 7 Oct 2026
- Notable limit
- Nirmata says support for older Kubernetes versions is dropped along with the end of support for the relevant cloud provider. · learn.nirmata.com, 7 Oct 2026
- Patch support
- Each supported release receives 18 months of patch support, with Kyverno engine fixes and dependency CVEs backported to supported branches. · nirmata.com, 7 Oct 2026
- Policy compatibility
- Existing Kyverno policies, CRDs, APIs, and tooling work unchanged with the distribution. · nirmata.com, 7 Oct 2026
- Purpose
- Nirmata Enterprise for Kyverno is an OSS-compatible, no-fork distribution of Kyverno for organizations that need a hardened and supported Kubernetes policy engine. · nirmata.com, 7 Oct 2026
- Support
- The product includes 24/7 enterprise support with SLAs for CVEs and critical fixes. · nirmata.com, 7 Oct 2026
- Target users
- Nirmata describes the product as intended for businesses that need a trusted distribution and tested, secure build of Kyverno. · nirmata.com, 7 Oct 2026
Where Nirmata Enterprise for Kyverno stands on Freedom251
- Infrastructure Policy as Code Tools#21 of 25