> ## Documentation Index
> Fetch the complete documentation index at: https://docs.niro.cx/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Posture

> A unified security surface combining built-in standards checks, policy engine violations from OPA Gatekeeper or Kyverno, and image vulnerability scanning.

## Overview

The **Posture** page (`/secure`) brings together three security signals into one view:

1. **Built-in standards** — Niro's own Kubernetes best-practice checks (missing probes, privileged containers, mutable image tags, and more). See [Policies & Standards](/features/policies) for the full rule list.
2. **External policy violations** — if your cluster runs OPA Gatekeeper or Kyverno, Niro reads their constraint violations and surfaces them alongside Niro's own findings.
3. **Image vulnerability scanning** — CVE findings for the container images running across your fleet, with severity scoring and fix availability.

All three signals are updated continuously from live cluster data.

## Standards and posture checks

Niro evaluates every workload against its built-in rule set, covering:

* Missing resource requests or limits
* Missing health probes (readiness and liveness)
* Containers running with elevated host access (host namespaces, host path mounts)
* Privileged container flags
* Mutable image tags
* Missing network policies
* Services with unnecessary external exposure

Severity escalates on [production clusters](/concepts/environments) — a single replica is informational on a dev cluster and high severity on production.

See [Policies & Standards](/features/policies) for the complete rule list and how to read findings.

## External policy engine violations

If your cluster runs **OPA Gatekeeper** or **Kyverno**, Niro automatically reads their active violations and surfaces them alongside Niro's own findings. No Niro configuration is required — the agent detects these engines during each heartbeat by looking for their custom resources.

### Prerequisites

* OPA Gatekeeper or Kyverno must be installed in the cluster
* The Niro agent must be enrolled (read-only capability is sufficient)

Once detected, violations appear within the next heartbeat cycle (\~15 seconds). If you install Gatekeeper or Kyverno on an already-enrolled cluster, Niro picks them up automatically.

### Navigating to violations

Go to **Posture** → **External violations** tab.

Or for a cluster-specific view: open the cluster → **Governance** → **Policy**. This tab only appears when Niro has detected Gatekeeper or Kyverno in that cluster.

### What you see

Each violation row shows:

| Field               | Description                                         |
| ------------------- | --------------------------------------------------- |
| **Policy**          | The policy name as defined in Gatekeeper or Kyverno |
| **Constraint type** | The constraint template or policy kind              |
| **Resource**        | The affected resource: kind, name, and namespace    |
| **Message**         | The violation message from the policy engine        |
| **Cluster**         | Which cluster the violation came from               |

Violations are read-only — Niro surfaces them but never modifies Gatekeeper or Kyverno configuration.

### Supported engines

| Engine             | What Niro reads                                           |
| ------------------ | --------------------------------------------------------- |
| **OPA Gatekeeper** | Constraint violations from Gatekeeper ConstraintTemplates |
| **Kyverno**        | Policy violations from Kyverno PolicyReports              |

## Image vulnerability scanning

<Badge>Enterprise</Badge>

Niro scans the container images running across your fleet for known CVEs. Scanning is automatic — no configuration needed beyond enrollment.

### What you see

For each vulnerability found:

| Field          | Description                                                |
| -------------- | ---------------------------------------------------------- |
| **CVE ID**     | The CVE identifier (e.g. `CVE-2024-12345`)                 |
| **Severity**   | Critical / High / Medium / Low / Unknown                   |
| **CVSS score** | Numeric severity score                                     |
| **Package**    | The affected package and installed version                 |
| **Fixed in**   | The version that patches this CVE, if one is available     |
| **Workload**   | The pod, namespace, and cluster running the affected image |
| **Fixable**    | Whether a patched version exists                           |

### Filtering and triaging

Filter by:

* **Severity** — focus on Critical or High first
* **Fixable** — show only CVEs with an available fix
* **Cluster or namespace** — narrow to a specific environment
* **Image** — find all vulnerabilities in a specific image

Sorting by **CVSS score** (descending) prioritizes the most severe findings.

### Scan frequency

Niro scans images on a rolling schedule. Each image is re-scanned periodically and whenever a new image version is detected. The last scan timestamp is shown per image.

## Per-cluster view

Each cluster also has its own Posture tab showing only findings relevant to that cluster. Open the cluster detail page → **Governance** → **Policy**.

## Related

<CardGroup cols={2}>
  <Card title="Policies & Standards" icon="shield-check" href="/features/policies">
    Full list of built-in rules and how severity escalation works.
  </Card>

  <Card title="Alerts & Incidents" icon="bell" href="/features/alerts">
    Runtime incidents — separate from policy findings.
  </Card>

  <Card title="Environments" icon="layer-group" href="/concepts/environments">
    How environment tagging affects finding severity.
  </Card>

  <Card title="Plans" icon="credit-card" href="/reference/plans">
    Image vulnerability scanning is available on Enterprise.
  </Card>
</CardGroup>