Ready for KubeCon + CloudNativeCon 2022? Attending the show? Make sure to visit with Nirmata.
KubeCon + CloudNativeCon takes place October 24 – 28, 2022 in Detroit, Michigan.
Read this exclusive interview between VMblog and Jim Bugwadia, CEO and Co-Founder of Nirmata. Nirmata, the creator of Kyverno, provides open source and commercial enterprise solutions for governance, compliance, security, and automation of production Kubernetes workloads. Nirmata enables self-service cluster provisioning, provides DevOps teams visibility, health, metrics, and alerts, ensures compliance via workload policies, and streamlines application deployments across Kubernetes clusters deployed on any cloud, data center, or edge. 
+++
VMblog: Can you give VMblog readers a quick overview of your company?
Jim Bugwadia: Nirmata is the creator of Kyverno, an open source project with the Cloud Native Computing Foundation (CNCF) that was donated in 2020, and recently moved from sandbox to incubating status. Kyverno allows enterprises to securely scale Kubernetes by enabling multi-cluster policy automation, management, and governance.
Through this comprehensive policy-based automation for deploying, operating, and optimizing Kubernetes applications across clouds, via easy-to-use, intuitive interfaces, Nirmata empowers enterprise DevSecOps teams by fully automating the complex operations and management of application containers.
As the creators and maintainers of Kyverno, we are excited to announce the release of version 1.8 which is another huge leap forward not just in terms of features and functionality but of optimizations, performance, and other improvements required in strict or high-scale environments. And in addition to those, a tremendous amount of work went into refactoring and other housekeeping items that make Kyverno cleaner and more efficient making future development (and contributions) easier, quicker, and ultimately more maintainable. See the blog for full details.
VMblog: While thinking about your company’s solutions, can you give readers a few examples of how your offerings are unique? What are your differentiators? What sets you apart from the competition?
Jim Bugwadia: The open source project Kyverno sits in a critical position within the cloud native ecosystem by automating and governing policies in the Kubernetes cluster. With the elimination of Pod Security Policies (PSPs) in Kubernetes v1.25, a gap was created which Pod Security Standards (PSS) attempted to fill. However, the Pod Security Admission exists as a deficient successor with many drawbacks, such as the limitation to work only on pods, unconfigurable messages, complex access to audit logs, and the lack of a DevOps pipeline.
Adding a policy manager such as Kyverno to your Kubernetes environment protects organizations against security threats and misconfigurations of cluster access. Nirmata (and Kyverno) take a proactive approach by providing workload security and best-practices, policy-based vulnerability management, and running scans before the code is pushed into production.
We are seeing more and more information and survey results being released outlining the importance of security and the alarmingly large percentage of organizations that do not have policies in place to protect their Kubernetes clusters. Further, look at the number of presentations on security at KubeCon alone! This is a market that is ripe for education and should lead to organizations taking proactive steps to secure their environments.
Currently, there are two primary choices to replace PSPs: Kyverno and Open Policy Agent (OPA) via Gatekeeper. Kyverno is a CNCF Incubating project maturity level, while OPA is a CNCF graduate maturity level project. As full-fledged policy engines, both are equally strong contenders, but each comes with different strengths. Kyverno is strong by not requiring knowledge of a specialized programming language, well-developed mutation abilities, Kubernetes-style framework for policy expression, greater flexibility and simplicity with a minimum generation of technical debt, supports numerous replicas for availability and scale and has unmatched generation and synchronizing ability. The advantages of Gatekeeper is that it is older than Kyverno, has multiple replicas for scaling and availability are supported and holds the ability to express sophisticated and intricate policies
VMblog: What kind of message will an attendee hear from you this year? What will they take back to help sell their management team and decision makers?
Jim Bugwadia: With the prominence of Kubernetes in cloud-native environments, new research has revealed additional security challenges are becoming all too common for organizations, with 93% of respondents experiencing at least one security incident in their environment in the previous year. And despite this, when it comes to securing their container strategy, the majority of respondents say it’s still progressing too slowly.
The challenge for many DevOps and cloud platforms teams is that when containers are spun up quickly, they struggle to manage authorization, policy and configuration in each of their orchestration clusters and between the microservices that comprise modem apps. This added security demand being placed upon developers to manage often leaves a gap that exposes potential threats and risks in the configuration settings.
To help organizations close this gap, Nirmata created solutions to help manage policies and governance that are required to succeed with Kubernetes. Created and donated by Nirmata, Kyverno has quickly become a leading policy engine that was accepted by CNCF in 2020 and is used today by hundreds of enterprises like Deutsche Telekom, Vodafone, Blinkit, and William Sonoma. Through the Kyverno and Nirmata solutions, organizations can rely on enterprise-proven policy and governance management which reflects the combined 50 plus years in cloud-native policy, governance and security experience the Nirmata team brings. Kyverno and Nirmata solutions also enable operations teams to easily enforce security requirements and establish guardrails, which eliminate misconfigurations and save developer time. Kyverno community members have seen 10X savings by reducing the time developers spend to address misconfigurations and other security issues as well as performing repetitive tasks which can be automated using Kyverno.
VMblog: How can attendees of the event find you? What do you have planned at your booth this year? What type of things will attendees be able to do at your booth?
Jim Bugwadia: You can find us at the Nirmata booth (S126), the Kyverno project booth, or any of the events we mentioned. We’ll be talking about Kubernetes policy, automation, and governance as well as bringing some other open source projects to talk about how we fit together in the ecosystem.
We have 13 sessions across CloudNative Rejekts, SecurityCon, GitOpsCon, SigStoreCon, ContribFest, and KubeCon. In addition, we are hosting a DevSecOps Meetup and Kyverno workshop on Tuesday, October 25 at 4:00pm PT. We invite you to join us and learn the latest best practices to embed security automation in the DevOps CI/CD pipeline and save developers time. Andrew Martin, author of “Hacking Kubernetes” will be there signing his latest book.
##
