Review Kubernetes posture
Use a workload's Posture tab to see pass and fail counts by policy category and which report results back them, and use Settings → Workloads to choose which Kyverno policies count. For how AIControls reads policy reports, see Kubernetes posture.
Workload Trust is available only in private, self-managed AIControls installations, on premises or in a cloud cluster that you run. It needs a dedicated cluster that you run, with Kyverno, Kyverno Runtime, and cluster OIDC and RBAC access in place. Nirmata-hosted (SaaS) workspaces don't include it. See Feature availability.
Before you begin
- Your AIControls control plane runs on self-hosted Kubernetes with Runtime Controls on.
- Any signed-in user can read the Posture tab. Only an administrator can save changes to the policy selection.
Understand what is evaluated
AIControls evaluates Pod Security Standards built in, using the upstream pod-security-admission library against each workload's pod template. You don't need Kyverno for that.
Posture from policy reports needs Kyverno. If Kyverno isn't installed, or no policy has reported on a workload, the workload's posture shows Unknown, and so does its Kyverno policies readiness rule. Unknown never means passing. To evaluate policy-report posture, install Kyverno, then install policies that apply to your workloads.
Review one workload
Open Inventory → Workloads and select a workload, then select Open full details.
Open the Posture tab. The Kubernetes posture card lists each policy category with its state and pass, fail, warn, error, and skip counts.
Select the expand arrow on a category to see the report results behind its counts: the policy and rule, result, severity, message, the evaluated resource, and when Kyverno observed it.
If the card lists policies under Not scanned yet, those selected policies apply to the workload but haven't reported on it yet. The workload stays Unknown until they do.
Choose which policies count
The Kyverno policies card controls which Kyverno policies count toward a workload's posture and its registration readiness. It has two modes:
- All policies (the default): every policy that reports on a workload must pass.
- Selected policies: only the policies you select count. Results from other policies are ignored.
Open Settings → Workloads and find the Kyverno policies card. Sign in as an administrator to change it. Other roles see it read-only.
Choose Selected policies, and then select policies from the list. The list shows the installed Kyverno policies, grouped by category. You must select at least one.
Select Save.
Under Selected policies, each selected policy that applies to a workload's kind must have reported on the workload before it can pass. Until then, for example before the first background scan finishes, the workload is Unknown, never passing.
To count every policy again, choose All policies and select Save. If the server rejects a save, the card shows the reason and keeps your edits so you can fix them and try again. A change applies on the next read, so existing results are recounted immediately.
Earlier versions had a Kyverno policy mapping card that mapped policies to standards and controls. It's removed, and AIControls deleted any mapping overrides you saved when you upgraded.