5.x Release Notes

The host and tunnel interface are successfully retrieved with OpenShift CLI v4.15.

The IP range 169.254.x.x is excluded from the host interface IPs.

Reexam host interface after 1 minute of enforcer startup.

Fixed an issue where the OpenID issuer URL regex was failing.

Remediates following CVEs:

Allow users to block the usage of specific storage classes from the Admission Controls page.

The LDAP Authentication has separated fields for baseDN and groupDN configuration.

The Egress and Ingress chart has a new vulnerability column which contains the High and Medium vulnerability count for each service.

Fixed bug related to regex when using a comma (,) in a multi-entry Admission Control user criteria.

Fixed bug where the CVE scan of jar packages would not show all packages affected by a same CVE. Now all occurences are reported.

Remediates following CVEs:

Allow users to set resources for updater-cron-job when installing SUSE® Security with the Helm chart.

Prometheus exporter container versioning reviewed and dissociated to the controller versioning.

(Scanner) Detect the R package/module in Ubuntu and Red Hat Enterprise Linux.

(Scanner) Added support for PHP Composer scan.

After upgrading to v5.3.1 from a previous SUSE® Security release, pre-existing NvClusterSecurityRule custom resources may be deleted inadvertently. NOTE: The 5.3.1 version has been removed from docker hub in order to prevent the upgrade issue.

Allow users to define ‘accepted’ vulnerabilities when using Github actions so they don’t affect workflows.

Add Severity, Score level and Feed Rating filters to Assets > Registry > Image Vulnerabilities view.

Allow when configuring a registry if it should use the defined proxy for the registry image scans.

Security Risks > Vulnerabilities > Advanced Filter doesn’t filter 'CVE without Fix'

Unexpected violation from container to hostmode container

Accept OCI image format when switching to docker api 1.24

Registry Scan should not scan non-image artifacts / not log an error

Allow for rootless key pair image signature verification without internet or sigstore dependence.

Security Events not getting permitted by network rules in a specific node (related to "Container Task chan full" error messages)

Container is unable to add to workload successfully (frequent occurences). Resulting from deadlock from channel messages.

Update the scanner plugins for Jenkins, GitHub action, and Bamboo.

(Scanner) Accept OCI image format when switching to docker api 1.24.

(Scanner) Registry Scan should not scan non-image artifacts / not log an error.

(Scanner) Add support for php composer scan.

After installation of SUSE® Security, enabling/installing the SUSE® Security UI Extension from Rancher will display a Dashboard for the cluster, including links to SSO to the full SUSE® Security cluster. NOTE: The extension may display as Third Party, which will be fixed in a future release. Also, after installation, Rancher 2.7.x users may see two SUSE® Security UI Ext icons in the list (bug). One icon will say Uninstall (meaning it is installed), and the other should say Install. This can be left as is, ie, don’t Install again if the extension is already installed.

Show external destination URLs (FQDN) in Dashboard (egress), PDF and CSV reports, as we well as in Network Activity screen and Security Events (violations) lists

In Discover mode, learn egresses to external FQDN address groups automatically. A new external FQDN custom group will be created unless the external connection matches an existing rule.

Enable ICMP learning (Discover mode) and blocking (Protect mode) through new Controller environment variable CTRL_EN_ICMP_POLICY = 1

Export CRDs into Github to support gitops to a default repo using console or REST API.

Support SAML SSO single logout with ADFS iDP

Add support for ARM64 platform. Pulling from ARM based platforms will automatically pull the appropriate ARM64 SUSE® Security images.

Support webhooks through a proxy

Improve admission control auditing function to include results of all rules. List the result of every rule, and adds another entry for the final action the would occur when evaluated in a live admission control deployment.

Apply disabled Admission Control rules via CRD or yaml (kubectl)

Vulnerability Profile export / import through console, CRD, or REST API. Importing will replace the existing profile. Deleting the CRD will result in an empty profile.

Compliance Profile template export / import through console, CRD, or REST API. Importing will replace the existing template.

Add a 'Manual' status in the compliance reports for CIS benchmarks that must be run manually by users (not run by SUSE® Security).

Improve UI loading/performance of Vulnerabilities page

Unify browser session login. With this, all tabs in the browser share the same login session, opening a new tab from an existing session does not ask for credentials, and when one tab logs out, all tabs are logged out.

Enhancements to security of console (UI): 1) add mandatory security headers (X-Content-Type-Options nosniff; X-XSS-Protection 1; mode=block; X-Frame-Options SAMEORIGIN; Cache-Control private, no-cache, no-store, must-revalidate HTTP Strict Transport Security max-age=15724800, 2) add CSP header (e.g. set a ‘default-src’ directive), 3) remove server name disclosure

Support newer versions of CIS benchmarks. Kubernetes (1.8.0), Kubernetes V1.24 (1.0.0), Kubernetes V1.23 (1.0.1), RedHat OpenShift Container Platform (1.4.0)

Show in Assets → Containers → Container details containers which were scanned in registries versus runtime

Add link to Group in Security Risks → Vulnerabilities → Impact popup to easily edit group mode

Support deep linking in URL’s to image and/or container vulnerability page

Add password reset option for admin to reset user password in console Settings → Users

Allow sending event logs to controller pod logs in Settings → Configuration → Notification. The events sent will begin with 'notification=' and be saved only to the leader controller pod. Note that there is a bug in this version where, in order to change the event level SYSLOG must be enabled (and can be disabled if desired after changing the level).

Remove requirement for controller/enforcer to mount "/host/cgroup".

Add Get Support menu with links to slack, documentation, and other resources

Fill message field to /v1/log/activity logs

Internal Server Error in Security Risks → Vulnerabilities with a high number of CVEs

SIGSEGV: segmentation violation on controller

Deleting vulnerable files (e.g. jar) doesn’t remove from vulnerability list

Invalid Syslog certificate using the signature algorithm SHA256withECDSA

SUSE® Security shows security events that should be allowed by a Network Rule

Un-managed node with "zombie" enforcer running

Advanced Filter shows Remediation and Impact fields blank

Fix string handling to prevent unexpected Enforcer restart

Unexpected violations relating to built-in groups

Support-bundle enforcer debug RPC call for data returns error

Group is not matching in Security Events

Send events to slack is not working - with proxy

Showing security events for allowed network rules

Add run-time container engine (socket) automatic detection to Helm chart

Remove setting for running controller in privileged mode in Helm chart, and requirement for controller/enforcer to mount "/host/cgroup".

The sample kubernetes deployment files have been removed from the SUSE® Security docs. Please refer to the link for examples.

Auto detection of container run-time (socket) removes the need to specify the container run-time and socket path.

Removal of requirement to run the controller in privileged mode removes the need for mounting runtime socket and mounted /host/cgroup/

Added role/role binding for neuvector-binding-secret as well as neuvector-secret in yaml.

New service accounts and role bindings required for 5.3

All referenced deployment yaml files now have /5.3.0/ in their paths

Remediates CVE-2023-6129 in openssl, and CVE-2023-46219, CVE-2023-46218 in curl.

Azure AKS ValidatingWebhookConfiguration changes and error logging.

Add support for NVD API 2.0 in Scanner.

Scan the container host in scanner standalone mode.

Scan on a node fails due to deadlocked docker cp / grpc issue.

Update packages to remediate CVEs including High CVE-2023-38545 and CVE-2023-43804.

Remediate CVE-2023-32188 “JWT token compromise can allow malicious actions including Remote Code Execution (RCE)” by auto-generating certificate used for signing JWT token upon deployment and upgrade, and auto-generating Manager/RESTful API certificate during Helm based deployments.

Add additional controls on custom compliance scripts. By default, custom script are now not allowed to be added, unless the environment variable CUSTOM_CHECK_CONTROL is added to Controller and Enforcer. Values are "disable" (default, not allowed), "strict" (admin role only), or "loose" (admin, compliance, and runtime-policy roles).

Prevent LDAP injection - username field is escaped.

Add additional scan data to CVE results sent by SYSLOG for layered scans

Support NVD API 2.0 for scan CVE database

Provide container image build date in Assets → Container details

Adjust sorting for Network rules: disable sorting in Network rules view but enable sorting of network rules in Group view.

Enable/disable TLS 1.0 and TLS 1.1 detection/alerting with environment variables to Enforcer THRT_SSL_TLS_1DOT0, THRT_SSL_TLS_1DOT1. Disabled by default.

Add environment variable AUTO_PROFILE_COLLECT for Controller and Enforcer to assist in capturing memory usage when investigating memory pressure events. Set value = 1 to enable.

Configuration assessments against Admission Control should show all violations with one scan.

Add more options for CVE report criteria in Response Rules. Example 1 - "cve-high-with-fix:X" means: When # of (high vulnerability that have been fixed) >= X, trigger the response rule. Example 2 - "cve-high-with-fix:X/Y" means: When # of (high vulnerability that were reported Y days ago & have been fixed) >= X, trigger the response rule.

Export of group policy does not return any actual YAML contents

Improve pruning of namespaces with dedicated function

SUSE® Security namespace user cannot see assets-→namespaces

Skip handling the CRD CREATE/UPDATE requests if the CR’s namespace is already deleted

Provide workaround for part of CRD groups which cannot be pruned successfully after namespaces are deleted.

Report layered scan results and additional CVE data in SYSLOG messages. This is enabled through a checkbox in Settings → Configuration → SYSLOG

Export NIST 800-53 mappings (to docker CIS benchmarks) in the exported csv compliance report

Support Proxy setting in image signature verification

Include image signature scan result in the downloaded CVE report

Support pod annotations for Admission Control Policies, available through the Custom criteria

Add Last Modified field to filter for vulnerabilities report printing, as well as Advanced Filter in Vulnerabilities view

Do not create default admin with default password in initial SUSE® Security deployment for AWS billing (CSP adapter) offering, requiring user to use a secret to create admin username and password

Fix .json file which increased size and crashed a kubernetes node

Improve SQL injection detection logic

When installing the helm crd chart first before installing the SUSE® Security core chart, service accounts are missing

Image scan I.4.1 compliance result is incorrect

Vulnerability advanced filter report showing images from all other namespace

Support tokens for SUSE® Security API access. See Settings → User, API Keys…​ to create a new API key. Keys can be set to default or custom roles.

Support AWS Marketplace PAYG billing for SUSE® Security monthly support subscriptions. Users can subscribe to SUSE® Security by SUSE support, billed monthly to their AWS account based on previous month’s average node count usage. Details here.

Support image signing for admission controls. Users can require SUSE® Security to verify that images are signed by specific parties before they can be deployed into the production environment, through an integration with Sigstore/Cosign. See Assets → Sigstore Verifiers for creating new signature assets. Rules can then be created with criteria Image Signing and/or Image Sigstore Verifiers.

Enable each admission control rule to have its own mode of Monitor or Protect. A Deny action in Monitor mode will alert, and a Deny action in Protect mode will block. Allow actions are unaffected.

Add a new regex operator in Policy > Admission Control > Add Rule for Users and User Groups to support regex. Support operators "matches ANY regex in" and "matches NONE regex in".

Add support for admission control criteria such as resource limits. A new criteria is added for Resource Limits, and additional criteria are supported through the Custom Criteria settings.

Support invoking SUSE® Security scanner from Harbor registries through the pluggable scanner interface. This requires configuration of the connection to the controller (exposed API). The Harbor adapter calls controller endpoint to trigger a scan, which can scan automatically on push. Interrogation services can be used for periodic scans. Scan results from Federation Primary controllers ARE propagated to remote clusters. NOTE: There is an issue with the HTTPS based adapter endpoint error: please ignore Test Connection error, it does work even though an error is shown (skip certificate validation).

Searchable SaaS service for CVE lookups. Search the latest SUSE® Security CVE database to see if a specific CVE exists in the database. This service is available for SUSE® Security Prime (paid support subscription) customers. Contact support through your SCC portal for access.

Allow user to disable network protection but keep WAF/DLP functioning. Configure Network Policy Enablement in Settings → Configuration.

Use less privileged services accounts as required for each SUSE® Security component. A variable “leastPrivilege” is introduced. The default is false. NOTE: Using the current helm chart with this variable on a release prior to 5.2.0 will not function properly.

Bind to non-default service account to meet CIS 1.5 5.1.5 recommendation.

Enable administrator to configure user default Session Time out in Settings → Users, API Keys & Roles.

Customizable login banner and customizable UI header text for regulated and government deployments. Requirements for configuration can be found here.

SYSLOG support for TLS encrypted transport. Select TCP/TLS in Settings → Configuration for SYSLOG.

Enable deployment of the SUSE® Security monitor helm chart from Rancher Manager.

Remove upper limit for top level domain in URL validator for registry scanning.

Scan golang dependencies, including run-time scans.

Support Debian 12 (Bookworm) vulnerability scan.

Add CSV export for Registry / Details to export CVEs for all images in configured registry in Assets → Registries for a selected registry.

Allow SUSE® Security to set several ADFS certificates in parallel in x.509 certificate field.

Add and display the comment field for Response Rules.

Specify what SUSE® Security considers to be system containers through environment variable. For example, for Rancher and default namespaces: NV_SYSTEM_GROUPS=*cattle-system;default

Add support for Kubernetes 1.27 and OpenShift 4.12

Reduce repeating logs in enforcer/controller logs.

Multiple clusters page does not render.

Empty group auto-removal takes 2 hours to delete instead of 1 hour according to schedule.

Manually allowed network rule not getting applied and resulting in violation for pause image.

Blocking SSL connections even if a network rule permits the traffic under certain initial conditions.

Security events warning even with allowed network rules due to policy update issue in synchronization.

Network Activities wrongly associating custom group traffic to external.

Default service account token of the namespace mounted in each pod is too highly privileged.

Despite defining the network rules, violations getting logged under security events (false positives) when the container has stopped due to out of memory (OOM) error.

Allow user to disable/enable detection and protection against unmanaged container in cluster. This can be set through the Manager CLI:

Add "leastPrivilege" setting in Helm chart. Add helm option for New_Service_Profile_Baseline. A new Helm chart (core) version is published for 5.2.

Enable AWS Marketplace (billing adapter) integration settings in Helm chart.

Update configmap to support new features (multiple ADFS certificates, zero drift, New_Service_Profile_Baseline, SYSLOG TLS, user timeout)

Update supported Kubernetes versions to 1.19+, and OpenShift 4.6+ (1.19+ with CRI-O)

Add new vulnerability feed for scanning Microsoft .NET framework.

Enforcer stats are disabled by default in Prometheus exporter to improve scalability.

Usability improvement: Using scanner to scan single image and print the result (see example below).

Add imagePullPolicy check in admission control rules criteria.

Show warning message when CRD schema is out of date.

Network Activity screen does not render or incorrectly renders.

Empty group auto-removal takes 2 hours to delete instead of 1 hour according to schedule.

Compliance profile doesn’t show in UI console.

Advanced Filter in Security Events Missing "Error" Level.

Saved password with special character fails on future authentication attempt.

Multiple clusters page does not render properly when requests are high.

Registry detail (bottom) pane not updating.

Support virtual host based address group and policy matching network protections. This enables a use case where two different FQDN addresses are resolved to the same IP address, but different rules for each FQDN should be enforced. A new custom group with ‘address=vh:xxx.yyy’ can be created using the ‘vh:’ indicator to enable this protection. A network rule can then use the custom group as the ‘From’ source based on the virtual hostname (instead of resolved IP address) to enforce different rules for virtual hosts.

Compliance containers list to exclude exited containers.

Enhance DLP rules to support simple wildcard in the pattern.

Add support for cri-o 1.26+ and OpenShift 4.11+.

Make gravatar optional.

Display cluster namespace resource in console / UI.

Display source severity/classification (e.g. Red Hat, Ubuntu…​) along with NVD severity score in console.

Don’t allow SSO/RBAC disabling for Rancher and OpenShift if user is authenticated through SSO.

Add auto-scan enablement and deletion of unused groups aging to configMap.

Include IP address for external source/destination in csv/pdf for implicit deny violations

Various performance and scalability optimizations for controller and enforcer CPU and memory usage.

Fix application slowness on GKE Container Optimized OS (COS) nodes when in Protect mode.

SUSE Linux (SLES) 15.4 CVE not matching in scanner. With this fix, if the severity is provided in the feed, the vulnerability will be added to the database, even if the NVD record is missing. It is possible that the report includes vulnerabilities without CVE scores.

Enhance Admission Control CRD options in helm https://github.com/neuvector/neuvector-helm/pull/237.

Add new enforcer environment variables to helm chart.

Add “package” as information to the syslog-event for a detected vulnerability.

Add Enforcer environment variable ENF_NETPOLICY_PULL_INTERVAL - Value in seconds (recommended value 60) to reduce network traffic and resulting resource consumption by Enforcer due to policy updates/recalculations. (Note: this was an undocumented addition until August of 2023).

Empty group deletion errors "Object not found"

Traffic within the same container alerting/blocking

Unexpected implicit violations for istio egress traffic with allow rule in place

When upgrading from SUSE® Security 4.x release, incorrect pod group membership causes unexpected policy violation

OIDC authentication failed with ADFS when extra encoding characters appear in the request

High memory usage by dp creating and deleting pods

Update alpine to remediate several CVEs including Manager: CVE-2022-37454, CVE-2022-42919, CVE-2022-45061, CVE-2021-46848; Enforcer: CVE-2022-43551, CVE-2022-43552

Various UI bugs fixed

Helm chart updated to enable replacement of certificate for internal communications

Centralized, multi-cluster scanning (CVE) database. The primary (master) cluster can scan a registry/repo designated as a federated registry. The scan results from these registries will be synchronized to all managed (remote) clusters. This enables display of scan results in the managed cluster console as well as use of the results in admission control rules of the managed cluster. Registries only need to be scanned once instead of by each cluster, reducing CPU/memory and network bandwidth usage.

Enhance admission control rules:

Add new env variable NO_DEFAULT_ADMIN which when enabled does not create an 'admin' user. This is used for Rancher SSO integration as the default. If not enabled, persistently warn the user and record events to change the default admin password if it is not changed from default.

Blocking login after failed login attemps now becomes the default. The default value is 5 attempts, and configurable in Settings → Users & Roles→ Password Profile.

Add new env variable for performance tuning ENF_NO_SYSTEM_PROFILES, value: "1". When enabled, it will disable the process and file monitors. No learning processes, no profile modes, no process/file (package) incidents, and no file activity monitor will be performed. This will reduce CPU/memory resource usage and file operations.

Add a custom auto-scaling setting for scanner pods, with value Delayed, Immediate, and Disabled. Important: Scanner auto-scaling is not supported when scanner is deployed with an OpenShift operator, as the operator will always change the number of pods to its configured value.

Custom groups are now able to use namespace labels, including Rancher’s namespace labels. Generally, pod and namespace labels can now be added to Custom Groups.

Add ability to hide selected namespaces, groups in Network Activity view.

Full support for Cilium cni.

Full support of OpenShift 4.9 and 4.10.

Build tools are now available for the SUSE® Security/Open Zero Trust (OZT) project at https://github.com/openzerotrust/openzerotrust.io.

SUSE® Security now lists the version ID and SHA256 digest for each version of the controller, manager, enforcer at https://github.com/neuvector/manifests/tree/main/versions.

Anonymous telemetry data (number of nodes, groups, rules) is now reported to a Rancher cloud service upon deployment to assist the project team in understanding usage behavior. This can be disabled (opt-out) in UI or with configMap (No_Telemetry_Report) or REST API.

(Addendum January 2023). Support for ServiceEntry based network policy with Istio. Egress network policy enforcement functionality was added in version 5.1.0 for pods to ServiceEntry destinations declared with Istio. Typically, a ServiceEntry defines how an external service referred by DNS name is resolved to a destination IP. Prior to v5.1, SUSE® Security could not detect and enforce rules for connections to a ServiceEntry, so all connections were classified as External. With 5.1, rules can be enforced for specific ServiceEntry destinations. IMPORTANT: If you are upgrading to v5.1 with an Istio based deployment, new rules must be created to allow these connections and avoid violation alerts. After upgrading, Implicit violations will get reported for newly visible traffic if allow rules don’t exist. New traffic rules can be learned and auto-created under Discover mode. To allow this traffic, you can put the group into discover mode or create a custom group with addresses (or DNS name) and new network rule to this destination to allow the traffic. NOTE: There is a bug in 5.1.0 in the destination reported by the deny violations that do not represent the correct destination. The bug reports both server_name and client_name are the same. This issue will get addressed in an upcoming patch release.

Reduce controller memory consumption from unnecessary cis benchmark data created during rolling updates. This issue does not occur on new deployments.

Remove license from configuration screen (no longer required).

Update alpine packages to remediate CVEs in curl including CVE-2023-23914, CVE-2023-23915, and CVE-2023-23916

High memory usage in dpMsgConnection

High memory usage on dp process in enforcer if there are many learned policy rules with unmanaged workload (memory leak)

tcpdump is unable to start successfully when sniffering a traffic on container

Update alpine to remediate several CVEs including Manager: CVE-2022-37454, CVE-2022-42919, CVE-2022-45061, CVE-2021-46848; Enforcer: CVE-2022-43551, CVE-2022-43552

Upgrading to 5.0.x results in an error message about Manager, Controller, Enforcer running different versions.

Enforcers experiencing go routine panic resulting in dp kill. WebUI does not reflect enforcer as online.

Unexpected Process.Profile.Violation incident in NV.Protect group on which command on coreos.

Update alpine to remove critical CVE-2022-40674 in the manager expat library, as well as other minor CVEs.

Add support for Antrea CNI

Fix unexpected process.profile.violation incident in the NV.Protect group.

When SSL is disabled on manager UI access, user password is printed to the manager log.

Do not display the EULA after successful restart from persistent volume.

Use the image filter in vulnerability profile setting to skip container scan results.

Support scanner in GitHub actions at https://github.com/neuvector/neuvector-image-scan-action.

Add Enforcer environment variables for disabling secrets scanning and running CIS benchmarks

Enforcer unable to start occasionally.

Connection leak on multi-cluster federation environments.

Compliance page not loading some times in Security Risks → Compliance

Rancher hardened and SELinux clusters are supported.

Agent process high cpu usage on k3s systems.

AD LDAP groups not working properly after upgrade to 5.0.

Enforcer keeps restating due to error=too many open files (rke2/cilium).

Support log is unable to download successfully.

Support vulnerability scan of openSUSE Leap OS (in scanner image).

Scanner: implement wipe-out attributes during reconstructing image repo.

Verify SUSE® Security deployment and support for SELinux enabled hosts. See below for details on interim patching until helm chart is updated.

Distinguish between Feature Chart and Partner Charts in Rancher UI more prominently.+ Improve ingress annotation for nginx in Rancher helm chart. Add / update ingress.kubernetes.io/protocol: https to nginx.ingress.kubernetes.io/backend-protocol: "HTTPS".

Current OpenShift Operator supports passthrough routes for api and federation services. Additional Helm Value parameters are added to support edge and re-encrypt route termination types.

AKS cluster could add unexpected key in admission control webhook.

Enforcer is not becoming operational on k8s 1.24 cluster with 1.64 containerd runtime. Separately, enforcer sometimes fails to start.

Any admin-role user(local user or SSO) who promotes a cluster to fed master should be automatically promoted to fedAdmin role.

When sso using Rancher default admin into SUSE® Security on master cluster, the SUSE® Security login role is admin, not fedAdmin.

Fix several goroutine crashes.

Implicit violation from host IP not associated with node.

ComplianceProfile does not show PCI tag.

LDAP group mapping sometimes is not shown.

Risk Review and Improvement tool will result in error message "Failed to update system config: Request in wrong format".

OKD 3.11 - Clusterrole error shows even if it exists.

High CVE-2022-29458 cve found on ncurses package in all images.

High CVE-2022-27778 and CVE-2022-27782 found on curl package in Updater image.

Automated Promotion of Group Modes. Promotes a Group’s protection Mode based on elapsed time and criteria. Does not apply to CRD created Groups. This features allows a new application to run in Discover for some time period, learning the behavior and SUSE® Security creating allow-list rules for Network and Process, then automatically moving to Monitor, then Protect mode. Discover to Monitor criterion: Elapsed time for learning all network and process activity of at least one live pod in the Group. Monitor to Protect criterion: There are no security events (network, process etc) for the timeframe set for the Group.

Support for Rancher 2.6.5 Apps and Marketplace chart. Deploys into cattle-neuvector-system namespace and enables SSO from Rancher to SUSE® Security. Note: Previous deployments from Rancher (e.g. Partner catalog charts, version 1.9.x and earlier), must be completely removed in order to update to the new chart.

Support scanning of SUSE Linux (SLE, SLES), and Microsoft Mariner

Zero-drift process and file protection. This is the new default mode for process and file protections. Zero-drift automatically allows only processes which originate from the parent process that is in the original container image, and does not allow file updates or new files to be installed. When in Discover or Monitor mode, zero-drift will alert on any suspicious process or file activity. In Protect mode, it will block such activity. Zero-drift does not require processes to be learned or added to an allow-list. Disabling zero-drift for a group will cause the process and file rules listed for the group to take effect instead.

Split policy mode protection for network, process/file. There is now a global setting available in Settings → Configuration to separately set the network protection mode for enforcement of network rules. Enabling this (default is disabled), causes all network rules to be in the protection mode selected (Discover, Monitor, Protect), while process/file rules remain in the protection mode for that Group, as displayed in the Policy → Groups screen. In this way, network rules can be set to Protect (blocking), while process/file policy can be set to Monitor, or vice versa.

WAF rule detection, enhanced DLP rules (header, URL, full packet). Used for ingress connections to web application pods as well as outbound connections to api-services to enforce api security.

CRD for WAF, DLP and admission controls. NOTE: required additional cluster role bindings/permissions. See Kubernetes and OpenShift deployment sections. CRD import/export and versioning for admission controls supported through CRD.

Rancher SSO integration to launch SUSE® Security console through Rancher Manager. This feature is only available if the SUSE® Security containers are deployed through Rancher. This deployment pulls from the mirrored Rancher repository (e.g. rancher/mirrored-neuvector-controller:5.0.0) and deploys into the cattle-neuvector-system namespace. NOTE: Requires updated Rancher release 2.6.5 May 2022 or later, and only admin and cluster owner roles are supported at this time.

Supports deployment on RKE2.

Support for Federation of clusters (multi-cluster manager) through a proxy. Configure proxy in Settings → Configuration, and enable proxy when configuring federation connections.

Monitor required rbac’s clusterrole/bindings and alert in events and UI if any are missing.

Support criteria of resource limitations in admission control rules.

Support Microsoft Teams format for webhooks.

Support AD/LDAP nested groups under mapped role group.

Support clusterrolebindings or rolebindings with group info in IDP for Openshift.

Allow network rules and admission control rules to be promoted to a Federated rule.

Fix issue of worker federation role backup should restore into non-federated clusters.

Improve page loading times for large number of CVEs in Security Risks → Vulnerabilities

Allow user to switch mode when they select all groups in Policy → Groups menu. Warn if the Nodes group is also selected.

Collapse compliance check items of the same name and make expandable.

Enhance security of gRPC communications.

Fixed: unable to get correct workload privileged info in rke2 setup.

Fix issue with support of openSUSE Leap 15.3 (k8s/crio).

Helm chart update appVersion to 5.0.0 and chart version to 2.2.0

Removed serverless scanning feature/menu.

Removed support for Jfrog Xray scan result integration (Artifactory registry scan is still supported).

Support for deployment on ECS is no longer provided. The allinone should still be able to be deployed on ECS, however, the documentation of the steps and settings is no longer supported.

Feature complete, including Automated Promotion of Group Modes. Promotes a Group’s protection Mode based on elapsed time and criteria. Does not apply to CRD created Groups. This features allows a new application to run in Discover for some time period, learning the behavior and SUSE® Security creating allow-list rules for Network and Process, then automatically moving to Monitor, then Protect mode. Discover to Monitor criterion: Elapsed time for learning all network and process activity of at least one live pod in the Group. Monitor to Protect criterion: There are no security events (network, process etc) for the timeframe set for the Group.

Support for Rancher 2.6.5 Apps and Marketplace chart. Deploys into cattle-neuvector-system namespace and enables SSO from Rancher to SUSE® Security. Note: Previous deployments from Rancher (e.g. Partner catalog charts, version 1.9.x and earlier), must be completely removed in order to update to the new chart.

Tags for Enforcer, Manager, Controller: 5.0.0-b1 (e.g. neuvector/controller:5.0.0-b1)

Support scanning of SUSE Linux (SLE, SLES), and Microsoft Mariner

Zero-drift process and file protection. This is the new default mode for process and file protections. Zero-drift automatically allows only processes which originate from the parent process that is in the original container image, and does not allow file updates or new files to be installed. When in Discover or Monitor mode, zero-drift will alert on any suspicious process or file activity. In Protect mode, it will block such activity. Zero-drift does not require processes to be learned or added to an allow-list. Disabling zero-drift for a group will cause the process and file rules listed for the group to take effect instead.

Split policy mode protection for network, process/file. There is now a global setting available in Settings → Configuration to separately set the network protection mode for enforcement of network rules. Enabling this (default is disabled), causes all network rules to be in the protection mode selected (Discover, Monitor, Protect), while process/file rules remain in the protection mode for that Group, as displayed in the Policy → Groups screen. In this way, network rules can be set to Protect (blocking), while process/file policy can be set to Monitor, or vice versa.

WAF rule detection, enhanced DLP rules (header, URL, full packet)

CRD for WAF, DLP and admission controls. NOTE: required additional cluster role bindings/permissions. See Kubernetes and OpenShift deployment sections. CRD import/export and versioning for admission controls supported through CRD.

Rancher SSO integration to launch SUSE® Security console through Rancher Manager. This feature is only available if the SUSE® Security containers are deployed through Rancher. NOTE: Requires updated Rancher release (date/version TBD).

Supports deployment on RKE2.

Support for Federation of clusters (multi-cluster manager) through a proxy.

Monitor required rbac’s clusterrole/bindings and alert in events and UI if any are missing.

Support criteria of resource limitations in admission control rules.

Fix issue of worker federation role backup should restore into non-federated clusters.

Minor file and license changes in source, no features added.

First release of an unsupported, 'tech-preview' version of SUSE® Security 5.0 open source version.

Add support for OWASP Top-10, WAF-like rules for detecting network attacks in headers or body. Includes support for CRD definitions of signatures and application to appropriate Groups.

Removes Serverless scanning features.

TBD

Helm chart v1.8.9 is published for 5.0.0 deployments. If using this with the preview version of 5.0.0 the following changes should be made to values.yml: