Razorpay | CNCF

Enroll your company as a CNCF End User and save more than $10K in training and conference costs
Razorpay was founded in 2014 and over the past decade, the company has grown exponentially, setting new benchmarks in the fintech industry. Today, it supports millions of businesses and has reached more than 300 million end consumers across India. With an annualized Total Payment Volume (TPV) of $180 billion, Razorpay has firmly established itself as the market leader in digital payment processing and launched more than 40 products every year, driving innovation and scaling new heights. Today, the fintech major powers payments for 80 of India’s 100 unicorns.
Operating at this immense magnitude within India’s highly regulated financial ecosystem requires compliance standards of the highest caliber. To satisfy the Reserve Bank of India’s (RBI) strict Payment Aggregator (PA) Master Directions while maintaining developer velocity and 99.99% system availability, Razorpay partnered with Nirmata to adopt an enterprise version of Kyverno—a CNCF graduated policy engine. By implementing a unified “Policy as Code” framework, Razorpay automated complex regulatory guardrails across its vast infrastructure, moving from reactive, point-in-time auditing to real-time, continuous compliance enforcement.
Kubernetes Nodes Secured
Real-Time Compliance Enforcement
Products Launched Annually
As an authorized Payment Aggregator, Razorpay operates under the strict oversight of the Reserve Bank of India (RBI). The RBI PA Master Directions mandate absolute operating resilience, which introduces several highly specific, non-negotiable security requirements:
Historically, validating these requirements fell on manual architectural reviews, complex deployment checklists, and manual engineering approvals. However, as Razorpay scaled to support an average of 7,000+ Kubernetes nodes processing millions of transactions, this manual approach ran into the Manual Impossibility Paradox:
To overcome these obstacles, Razorpay partnered with Nirmata to integrate Kyverno natively into its Kubernetes architecture. Selecting Kyverno was a strategic decision driven by its design: as a Kubernetes-native policy engine, it manages policies as declarative custom resources (YAML) exactly like application manifests, avoiding the steep learning curve of non-native policy languages.
The core of Razorpay’s solution is a Dual-Front Defense architecture, securing the infrastructure from code commit to container runtime:
Proactive controls are executed in the IaC and GitOps pipelines. Infrastructure as Code (IaC) templates, and Kubernetes manifests, are vetted pre-deployment with Kyverno policies. Dynamic cloud policies ensure that AWS/cloud boundaries, S3 buckets, and ledger access mechanisms are strictly locked down and compliant with data residency rules before clusters are provisioned.
Preventive controls block deployment and prevent misconfigurations by securing the internal workloads where transaction computations occur. Kyverno serves as the ultimate gatekeeper at the Kubernetes API Server layer, implementing three key pillars:
Detective controls periodically scan Kubernetes clusters and cloud configurations to detect drift or policy bypass. These continuous checks also ensure that if IaC policies are updated, for example to comply with the latest standards, prior configurations are audited and flagged for updates.
Transitioning to Policy as Code using Kyverno revolutionized how Razorpay maintains secure, resilient systems without hindering innovation:
Looking forward, Razorpay plans to deepen its partnership with Nirmata and expand usage of CNCF projects to scale Policy as Code across next-generation cloud-native architectures:
Accelerate cloud native technology adoption and collaborate with peers, project maintainers and CNCF.
EXPLORE THE COMMUNITY
Subscribe for updates, event info, webinars, and the latest community news
By submitting this form, I consent to receive marketing emails from the LF and its projects regarding their events, training, research, developments, and related announcements. I understand that I can unsubscribe at any time using the links in the footers of the emails I receive. Privacy Policy.
Copyright © 2026 The Linux Foundation®. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page. Linux is a registered trademark of Linus Torvalds. Privacy Policy and Terms of Use.
Cookie Settings Accessibility Statement Submit an issue with this page