Security Posture

​

Overview

The Posture page (/secure) brings together three security signals into one view:

1. Built-in standards — Niro’s own Kubernetes best-practice checks (missing probes, privileged containers, mutable image tags, and more). See Policies & Standards for the full rule list.
2. External policy violations — if your cluster runs OPA Gatekeeper or Kyverno, Niro reads their constraint violations and surfaces them alongside Niro’s own findings.
3. Image vulnerability scanning — CVE findings for the container images running across your fleet, with severity scoring and fix availability.

All three signals are updated continuously from live cluster data.

​

Standards and posture checks

Niro evaluates every workload against its built-in rule set, covering:

• Missing resource requests or limits
• Missing health probes (readiness and liveness)
• Containers running with elevated host access (host namespaces, host path mounts)
• Privileged container flags
• Mutable image tags
• Missing network policies
• Services with unnecessary external exposure

Severity escalates on production clusters — a single replica is informational on a dev cluster and high severity on production. See Policies & Standards for the complete rule list and how to read findings.

​

External policy engine violations

If your cluster runs OPA Gatekeeper or Kyverno, Niro automatically reads their active violations and surfaces them alongside Niro’s own findings. No Niro configuration is required — the agent detects these engines during each heartbeat by looking for their custom resources.

​

Prerequisites

• OPA Gatekeeper or Kyverno must be installed in the cluster
• The Niro agent must be enrolled (read-only capability is sufficient)

Once detected, violations appear within the next heartbeat cycle (~15 seconds). If you install Gatekeeper or Kyverno on an already-enrolled cluster, Niro picks them up automatically.

​

Navigating to violations

Go to Posture → External violations tab. Or for a cluster-specific view: open the cluster → Governance → Policy. This tab only appears when Niro has detected Gatekeeper or Kyverno in that cluster.

​

What you see

Each violation row shows: Violations are read-only — Niro surfaces them but never modifies Gatekeeper or Kyverno configuration.

​

Supported engines

​

Image vulnerability scanning

Enterprise Niro scans the container images running across your fleet for known CVEs. Scanning is automatic — no configuration needed beyond enrollment.

​

What you see

For each vulnerability found:

​

Filtering and triaging

Filter by:

• Severity — focus on Critical or High first
• Fixable — show only CVEs with an available fix
• Cluster or namespace — narrow to a specific environment
• Image — find all vulnerabilities in a specific image

Sorting by CVSS score (descending) prioritizes the most severe findings.

​

Scan frequency

Niro scans images on a rolling schedule. Each image is re-scanned periodically and whenever a new image version is detected. The last scan timestamp is shown per image.

​

Per-cluster view

Each cluster also has its own Posture tab showing only findings relevant to that cluster. Open the cluster detail page → Governance → Policy.

​

Related