Integrations & Other Components

Github actions for vulnerability scanning now published at https://github.com/neuvector/neuvector-image-scan-action.

Helm chart v1.8.9 is published for 5.0.0 deployments. If using this with the preview version of 5.0.0 the following changes should be made to values.yml:

New Splunk app for SUSE® Security is published at https://splunkbase.splunk.com/app/6205/

Support affinity and toleration customization for controller, scanner and manager.

Add nodeSelector support for Controller, Manager, Scanner, updater pods.

Support user-defined environment variables for controller container.

Allow users to specify SUSE® Security release version

Deploys latest scanner CVE db version

Container operator image location moved to registry.neuvector.com/public

SUSE® Security instance name defaults to neuvector (before it was example-neuvector)

Updated readme document on install page and added link to release notes

Add controller ingress and route host options.

Supports helm chart version 1.8.2

Deploys SUSE® Security version 4.3.1

Deploys scanner db version 2.360

other changes from previous 1.2.7 version

Known issues

Helm Chart v1.8.0 is updated to default to registry.neuvector.com as the default registry. NOTE: Must specify the version tag manually.

Add configurable parameters such as Controller API annotations in Helm chart. Available from version 1.7.6+.

Community Operator 1.2.6, Certified Operator 1.2.7 updated to reflect Helm chart updates including adding OpenShift route when controller.apisvc.type is enabled.

Add HTML output format for scan results in Jenkins pipeline scanning results.

Add namespace of impacted workload in Prometheus exporter alerts. Now supported in neuvector/prometheus-exporter:4.2.2 and later.

Support changes required for new image registry registry.neuvector.com. Change to this will result in image paths (ie remove neuvector from path from neuvector/controller to controller).

Add support for separate component resources requests and limits, e.g. Controller, Enforcer cpu, memory requests.

Fix the scan error that exists when multiple scanners are running at the same time.

Show the Red Hat vulnerability rating in the scan result for Red Hat based images.

OpenShift operator/helm to be able to replace self-signed certificates. Helm Chart is 1.7.1. Community Operator is 1.2.4, and Certified Operator is 1.2.3.

Overwrite vulnerability severity by score. Be able to edit what vulnerability (CVE) score range is used for High and Medium classifications. This enables customizing what score can be used to fail builds in the pipeline.

Add error messages to the JAVA exceptions hudson.AbortException. Enable better error message reporting from SUSE® Security when an error occurs.

Add manager service loadbalancer ip and annotations.

Add setting to set pvc capacity.

Add runtime socket settings for k3s and AWS bottlerocket.

Add settings to replace controller and manager certificates.

Fix CVE-2020-1938 not discovered during scan in scanner versions 1.191 and earlier. Update to latest scanner version after 1.191.

Update SUSE® Security in Rancher catalog to support 4.x

Create required SUSE® Security CRDs upon deployment

Fix error when setting controller ingress to true

Update Operators (community, certified) to support 4.x

Allow user to customize PriorityClass of the manager/controller/enforcer/scanner deployment. We suggest to give SUSE® Security containers higher priority to make sure the security policies get enforced when the node resource is under pressure or during a cluster upgrade process.

The directory for the SUSE® Security chart has changed from ./neuvector-helm/ to ./neuvector-helm/charts/core/