Configuration

Available with limitations in: CSE Lite (1.73), CSE Pro (1.73)

Available without limitations in: EE

The module lifecycle stage: Experimental

The module has requirements for installation

Enabling NeuVector

To enable the module, use the web interface or the following command:

d8 platform module enable neuvector

Authentication

NeuVector module is integrated with the Deckhouse Kubernetes Platform user-authn module via Dex. The user-authn module must be enabled — without it, the controller does not start.

The default built-in NeuVector admin user is disabled at the controller level (the controller is started with -no_def_admin), so the upstream-default admin/admin credentials cannot be used. All sign-in flows go through Dex:

Cluster groups configured in the user-authn DexProvider are forwarded to NeuVector via the OIDC groups claim.
Use auth.allowedUserEmails / auth.allowedUserGroups to gate who can complete Dex login.
Use auth.defaultRole and auth.groupRoleMapping to assign NeuVector roles to authenticated users.

If a local NeuVector user is needed for break-glass scenarios, create it through the NeuVector UI or REST API after the first OIDC sign-in.

Deckhouse console manages NeuVector WAF and DLP policies from its own interface. To do that, its backend signs the user in to NeuVector with the token the user already holds, over the controller endpoint POST /v1/token-exchange, instead of sending the browser through another redirect.

Roles on this path are assigned from the groups claim of that token, and Dex filters the claim by allowedGroups of the client that ran the login — for this path, that is the console. As a result a group that the console does not allow never reaches auth.groupRoleMapping, and the same user may receive a different role depending on the sign-in path. Keep every group used in auth.groupRoleMapping present in console.auth.allowedUserGroups of the console module as well.

Controller REST API access

To expose the NeuVector controller REST API on port 10443 outside the cluster, enable controller.apiIngress.enable. The Ingress is published on https://neuvector-api.<publicDomainTemplate>/ and proxies to the controller. Authentication is handled by NeuVector itself: obtain a token via POST /v1/auth and pass it as X-Auth-Token on subsequent requests. Optionally restrict access by client IP through controller.apiIngress.whitelistSourceRanges.

Forwarding Deckhouse security events

NeuVector can display platform security events — Falco detections, Dex login attempts, KubeVirt audit records, and containerd integrity failures — in its own UI next to enforcer events. Events flow through the standard NeuVector pipeline (UI, syslog, webhook).

A sidecar, se-bridge, always runs in each controller pod to accept events from LogShipper and write them to NeuVector’s internal KV store. Forwarding itself is controlled by the seBridgeEnabled setting in the loki module. While the setting is off, the sidecar idles and consumes no traffic.

Supported sources: falco, dex, virtualization-audit, containerd-integrity. Each lands in the semantically correct tab of NeuVector UI (Events / Security Events / Admission).

The integration is safe for response rules: a controller patch disables the Quarantine action for events with AgentID=se-bridge, so wildcard rules do not fire on external events.

Syslog and webhook forwarding

Events from se-bridge flow through NeuVector’s standard forwarders.

Syslog. The default configuration includes categories Event, Runtime (which expands to Violation, Threat, Incident), and Audit, so all three channels used by the bridge are forwarded out of the box. If categories have been trimmed manually in the NeuVector UI, make sure the ones carrying external events are still enabled.
Webhook. The default webhook category list is empty, so external events are not pushed to webhooks until categories are explicitly enabled in the NeuVector configuration (System Configuration → Webhooks). This is stock NeuVector behaviour, unrelated to the bridge.

Delivery reliability

Delivery to NeuVector does not carry a formal at-least-once guarantee. If the NeuVector controller or the se-bridge sidecar is unreachable, LogShipper holds unprocessed events in its per-node disk buffer. The default buffer is on the order of 256 MB; during a sustained hundreds-of-events-per-second stream a multi-tens-of-minutes controller outage can fill the buffer and some events may be lost for NeuVector.

Loki ingestion is not affected — each destination has its own independent buffer.

To reduce the risk of loss, watch the vector_buffer_byte_size metric from the log-shipper module and alert on sustained approach to the buffer limit. If you need to increase the buffer, configure the buffer field on the corresponding ClusterLogDestination — see the LogShipper documentation.

How to explicitly enable the module…

You may explicitly enable or disable the module in one of the following ways:

Via Deckhouse web UI. In the “System” → “System Management” → “Deckhouse” → “Modules” section, open the neuvector module and enable (or disable) the “Module enabled” toggle. Save changes.

Example:
Via Deckhouse CLI (d8).

Use the d8 system module enable command for enabling, or d8 system module disable command for disabling the module (you need Deckhouse CLI (d8), configured to work with the cluster).

Example of enabling the module:
```
d8 system module enable neuvector
```
Using ModuleConfig neuvector.

Set spec.enabled to true or false in ModuleConfig neuvector (create it if necessary);

Example of a manifest to enable module neuvector:
```
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: neuvector
spec:
  enabled: true
```

How to configure the module…

You can configure the module in one of the following ways:

Via Deckhouse web UI.

In the “System” → “System Management” → “Deckhouse” → “Modules” section, open the neuvector module and enable the “Advanced Settings” switch. Fill in the required fields in the “Configuration” tab or specify the module settings in YAML format on the “YAML” tab, excluding the settings section. Save the changes.

Example:

You can also edit the ModuleConfig object neuvector on the “YAML” tab in the module settings window (“System” → “System Management” → “Deckhouse” → “Modules”, open the module neuvector) by specifying the schema version in the spec.version parameter and the necessary module parameters in the spec.settings section.
Via Deckhouse CLI (d8) (requires Deckhouse CLI (d8) configured to work with the cluster).

Edit the existing ModuleConfig neuvector (for more details on configuring Deckhouse, see the documentation) by executing the following command:
```
d8 k edit mc neuvector
```
Make the necessary changes in the spec.settings section. If necessary, specify the schema version in the spec.version parameter. Save the changes.

You can also create a file with manifest for ModuleConfig neuvector using the example below. Fill in the spec.settings section with the required module parameters. If necessary, specify the schema version in the spec.version parameter.

Apply the manifest using the following command (indicate the manifest file name):
```
d8 k apply -f <FILENAME>
```
Example of a manifest for ModuleConfig neuvector:
```
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: neuvector
spec:
  version: 1
  enabled: true
  settings: # Module parameters from the "Parameters" section below.
```

How to change the module release channel…

To change the module release channel, follow the instruction.

Requirements

To the Deckhouse version: 1.74 and above.

Parameters

Schema version: 1

settings
object
- settings.auth
  
  object
  Options related to authentication or authorization in the application.
  
  Default: {}
  - settings.auth.allowedUserEmails
    
    array of strings
    An array of emails of users that are allowed to authenticate via Dex.
    
    Used only if the user-authn module is enabled. Forwarded to the spec.allowedEmails field of the DexClient resource.
  - settings.auth.allowedUserGroups
    
    array of strings
    An array of user groups that are allowed to authenticate via Dex.
    
    Used only if the user-authn module is enabled. Forwarded to the spec.allowedGroups field of the DexClient resource.
    
    Caution! Note that you must add those groups to the appropriate field in the DexProvider config.
  - settings.auth.defaultRole
    
    string
    NeuVector role assigned to OIDC-authenticated users when no groupRoleMapping entry matches.
    
    Built-in roles: admin, reader, ciops, none, fedAdmin, fedReader. A custom role name is also accepted if the role is defined in NeuVector via a roleinitcfg.yaml ConfigMap.
    
    Notes:
    
    none means no role is granted; unmapped users will not be able to log in.
    
    fedAdmin / fedReader are only meaningful on a federation master cluster.
    
    ciops is intended for CI/CD bots that push scan results, not for human admins.
    Default: admin
    
    Examples:
    defaultRole: admin
    defaultRole: reader
    defaultRole: ciops
    defaultRole: none
    defaultRole: fedAdmin
    defaultRole: fedReader
  - settings.auth.groupRoleMapping
    
    array of objects
    Maps IdP groups (taken from the OIDC groups claim) to NeuVector roles. Order matters: the first matching entry wins (NeuVector semantics). Independent from auth.allowedUserGroups — that one gates Dex login, this one assigns the in-product role afterwards.
    
    Default: []
    
    Example:
    groupRoleMapping: - globalRole: admin group: neuvector-admins - globalRole: none group: developers roleDomains: admin: - dev-team-a - dev-team-b reader: - staging
    - settings.auth.groupRoleMapping.globalRole
      
      string
      Cluster-wide NeuVector role granted to members of the group.
      
      Built-in roles: admin, reader, ciops, none, fedAdmin, fedReader. Any custom role name defined via roleinitcfg.yaml is also accepted.
      
      Leave empty (or set to none) when only namespace-scoped roles are intended via roleDomains. fedAdmin / fedReader are valid only on a federation master cluster.
      
      Examples:
      globalRole: admin
      globalRole: reader
      globalRole: ciops
      globalRole: none
      globalRole: fedAdmin
      globalRole: fedReader
    - settings.auth.groupRoleMapping.group
      
      string
      IdP group name to match against the groups claim.
    - settings.auth.groupRoleMapping.roleDomains
      
      object
      Namespace-scoped role overrides as a map: NeuVector role name -> list of namespaces. Example: {admin: [staging], reader: [prod, default]}.
  - settings.auth.whitelistSourceRanges
    
    array of strings
    An array of CIDRs that are allowed to access the NeuVector web console.
    
    Example:
    whitelistSourceRanges: - 1.1.1.1/32
- settings.controller
  
  object
  Configuration for the NeuVector controller component.
  
  The controller manages policies, orchestrates enforcement, and provides the REST API.
  
  Default: {}
  - settings.controller.apiIngress
    
    object
    Optional Ingress that exposes the NeuVector controller REST API (port 10443) outside the cluster.
    
    The Ingress is created on a separate hostname neuvector-api.<publicDomainTemplate> and forwards requests to the controller’s REST API. Authentication is handled by NeuVector itself (token via /v1/auth).
    
    Default: {}
    - settings.controller.apiIngress.enable
      
      boolean
      Enable the controller REST API Ingress.
      
      Default: false
    - settings.controller.apiIngress.whitelistSourceRanges
      
      array of strings
      An array of CIDRs that are allowed to access the controller REST API.
      
      Example:
      whitelistSourceRanges: - 1.1.1.1/32
  - settings.controller.nodeSelector
    
    object
    The same as in the pods’ spec.nodeSelector parameter in Kubernetes.
    
    If the parameter is omitted, it will be determined automatically.
    
    Example:
    disktype: ssd
  - settings.controller.resourcesManagement
    
    object
    CPU and memory requests and limits of the controller container.
    
    The values below apply as ordinary requests and limits when the vertical-pod-autoscaler module is disabled.
    
    Default: {}
    
    Examples:
    mode: VPA vpa: cpu: max: 1000m min: 200m memory: limitRatio: 4 max: 3Gi min: 1Gi mode: InPlaceOrRecreate
    mode: Static static: limits: memory: 3Gi requests: cpu: 200m memory: 1Gi
    - settings.controller.resourcesManagement.mode
      
      string
      Resource management mode:
      
      Static is a classic one. In it, you specify requests and limits. The parameters of this mode are defined in the static parameter section;
      
      VPA mode uses VPA. You can configure this mode by modifying parameters in the vpa parameter section.
      
      Default: VPA
      
      Allowed values: VPA, Static
    - settings.controller.resourcesManagement.static
      
      object
      Resource management options for the Static mode.
      - settings.controller.resourcesManagement.static.limits
        
        object
        Resource limits of the container.
        
        settings.controller.resourcesManagement.static.limits.cpu
        
        CPU limit.
        
        settings.controller.resourcesManagement.static.limits.memory
        
        Memory limit.
      - settings.controller.resourcesManagement.static.requests
        
        object
        Resource requests of the container.
        
        settings.controller.resourcesManagement.static.requests.cpu
        
        CPU requests.
        
        settings.controller.resourcesManagement.static.requests.memory
        
        Memory requests.
    - settings.controller.resourcesManagement.vpa
      
      object
      Resource management options for the VPA mode.
      
      Default: {}
      - settings.controller.resourcesManagement.vpa.cpu
        
        object
        CPU settings.
        
        Default: {}
        
        settings.controller.resourcesManagement.vpa.cpu.limitRatio
        
        number
        Ratio between the CPU limit and the CPU requests.
        
        When set, the limit is computed from min. When omitted, the container gets no CPU limit, which is how the module behaved before this parameter existed.
        
        settings.controller.resourcesManagement.vpa.cpu.max
        
        Maximum CPU requests VPA may set.
        
        Default: 1000m
        
        settings.controller.resourcesManagement.vpa.cpu.min
        
        Minimum CPU requests VPA may set. Also used as the requests of the container.
        
        Default: 200m
      - settings.controller.resourcesManagement.vpa.memory
        
        object
        Memory settings.
        
        Default: {}
        
        settings.controller.resourcesManagement.vpa.memory.limitRatio
        
        number
        Ratio between the memory limit and the memory requests.
        
        The default reproduces the limit the module set before this parameter existed.
        
        Default: 4
        
        settings.controller.resourcesManagement.vpa.memory.max
        
        Maximum memory requests VPA may set.
        
        Default: 3Gi
        
        settings.controller.resourcesManagement.vpa.memory.min
        
        Minimum memory requests VPA may set. Also used as the requests of the container.
        
        Default: 1Gi
      - settings.controller.resourcesManagement.vpa.mode
        
        string
        VPA operating mode.
        
        Initial — VPA sets the values at pod creation time and does not change them afterwards.
        
        InPlaceOrRecreate — VPA updates a running pod when the cluster supports it and recreates the pod otherwise.
        
        Auto — VPA recreates pods to apply updated values. Considered legacy since Deckhouse 1.75.
        
        Every mode except Initial may restart a component of the security tool.
        
        Default: InPlaceOrRecreate
        
        Allowed values: Initial, InPlaceOrRecreate, Auto
  - settings.controller.storageClass
    
    The name of StorageClass that will be used to store the module’s data.
    
    If the value is not specified, the StorageClass will be used according to the global storageClass parameter setting.
    
    The global storageClass parameter is only considered when the module is enabled. Changing the global storageClass parameter while the module is enabled will not trigger disk re-provisioning.
    
    Warning. Specifying a value different from the one currently used (in the existing PVC) will result in disk re-provisioning and all data will be deleted.
    
    If false is specified, emptyDir will be forced to be used.
    
    Examples:
    storageClass: false
    storageClass: nfs-storage-class
  - settings.controller.tolerations
    
    array of objects
    The same as in the Pods’ spec.tolerations parameter in Kubernetes.
    
    If the parameter is omitted or false, it will be determined automatically.
    - settings.controller.tolerations.effect
      
      string
    - settings.controller.tolerations.key
      
      string
    - settings.controller.tolerations.operator
      
      string
    - settings.controller.tolerations.tolerationSeconds
      
      integer
    - settings.controller.tolerations.value
      
      string
- settings.enforcer
  
  object
  Configuration for the NeuVector enforcer component.
  
  The enforcer runs on every node and inspects workload traffic inline.
  
  Default: {}
  - settings.enforcer.resourcesManagement
    
    object
    CPU and memory requests and limits of the enforcer container.
    
    The values below apply as ordinary requests and limits when the vertical-pod-autoscaler module is disabled.
    
    Default: {}
    
    Examples:
    mode: VPA vpa: cpu: max: 1000m min: 300m memory: limitRatio: 4 max: 3Gi min: 1Gi mode: InPlaceOrRecreate
    mode: Static static: limits: memory: 3Gi requests: cpu: 300m memory: 1Gi
    - settings.enforcer.resourcesManagement.mode
      
      string
      Resource management mode:
      
      Static is a classic one. In it, you specify requests and limits. The parameters of this mode are defined in the static parameter section;
      
      VPA mode uses VPA. You can configure this mode by modifying parameters in the vpa parameter section.
      
      Default: VPA
      
      Allowed values: VPA, Static
    - settings.enforcer.resourcesManagement.static
      
      object
      Resource management options for the Static mode.
      - settings.enforcer.resourcesManagement.static.limits
        
        object
        Resource limits of the container.
        
        settings.enforcer.resourcesManagement.static.limits.cpu
        
        CPU limit.
        
        settings.enforcer.resourcesManagement.static.limits.memory
        
        Memory limit.
      - settings.enforcer.resourcesManagement.static.requests
        
        object
        Resource requests of the container.
        
        settings.enforcer.resourcesManagement.static.requests.cpu
        
        CPU requests.
        
        settings.enforcer.resourcesManagement.static.requests.memory
        
        Memory requests.
    - settings.enforcer.resourcesManagement.vpa
      
      object
      Resource management options for the VPA mode.
      
      Default: {}
      - settings.enforcer.resourcesManagement.vpa.cpu
        
        object
        CPU settings.
        
        Default: {}
        
        settings.enforcer.resourcesManagement.vpa.cpu.limitRatio
        
        number
        Ratio between the CPU limit and the CPU requests.
        
        When set, the limit is computed from min. When omitted, the container gets no CPU limit, which is how the module behaved before this parameter existed.
        
        settings.enforcer.resourcesManagement.vpa.cpu.max
        
        Maximum CPU requests VPA may set.
        
        Default: 1000m
        
        settings.enforcer.resourcesManagement.vpa.cpu.min
        
        Minimum CPU requests VPA may set. Also used as the requests of the container.
        
        Default: 300m
      - settings.enforcer.resourcesManagement.vpa.memory
        
        object
        Memory settings.
        
        Default: {}
        
        settings.enforcer.resourcesManagement.vpa.memory.limitRatio
        
        number
        Ratio between the memory limit and the memory requests.
        
        The default reproduces the limit the module set before this parameter existed.
        
        Default: 4
        
        settings.enforcer.resourcesManagement.vpa.memory.max
        
        Maximum memory requests VPA may set.
        
        Default: 3Gi
        
        settings.enforcer.resourcesManagement.vpa.memory.min
        
        Minimum memory requests VPA may set. Also used as the requests of the container.
        
        Default: 1Gi
      - settings.enforcer.resourcesManagement.vpa.mode
        
        string
        VPA operating mode.
        
        Initial — VPA sets the values at pod creation time and does not change them afterwards.
        
        InPlaceOrRecreate — VPA updates a running pod when the cluster supports it and recreates the pod otherwise.
        
        Auto — VPA recreates pods to apply updated values. Considered legacy since Deckhouse 1.75.
        
        Every mode except Initial may restart a component of the security tool.
        
        Default: InPlaceOrRecreate
        
        Allowed values: Initial, InPlaceOrRecreate, Auto
- settings.highAvailability
  
  boolean
  Manually enable the high availability mode.
  
  By default, Deckhouse automatically decides whether to enable the HA mode. Click here to learn more about the HA mode for modules.
  
  Example:
  highAvailability: true
- settings.https
  
  object
  What certificate type to use with the neuvector.
  
  This parameter completely overrides the global.modules.https settings.
  
  Examples:
  customCertificate: secretName: foobar mode: CustomCertificate
  certManager: clusterIssuerName: letsencrypt mode: CertManager
  - settings.https.certManager
    
    object
    - settings.https.certManager.clusterIssuerName
      
      string
      What ClusterIssuer to use for the neuvector. Currently, letsencrypt, letsencrypt-staging, selfsigned are available; also, you can define your own.
      
      Default: letsencrypt
  - settings.https.customCertificate
    
    object
    - settings.https.customCertificate.secretName
      
      string
      The name of the Secret in the d8-system namespace to use with the neuvector (this Secret must have the kubernetes.io/tls format).
      
      Default: false
  - settings.https.mode
    
    string
    The HTTPS usage mode:
    
    CertManager — the neuvector will use HTTPS and get a certificate from the ClusterIssuer defined in the certManager.clusterIssuerName parameter;
    
    CustomCertificate — the neuvector will use the certificate from the d8-system namespace for HTTPS;
    
    Disabled — neuvector will not work in this mode;
    
    OnlyInURI — the neuvector will work over HTTP (thinking that there is an external HTTPS load balancer in front of it that terminates HTTPS traffic). All the links in the user-authn will be generated using the HTTPS scheme. Load balancer should provide a redirect from HTTP to HTTPS.
    Allowed values: Disabled, CertManager, CustomCertificate, OnlyInURI
- settings.manager
  
  object
  Configuration for the NeuVector manager component.
  
  The web console proxies every console operation to the controller REST API.
  
  Default: {}
  - settings.manager.resourcesManagement
    
    object
    CPU and memory requests and limits of the web console container.
    
    The values below apply as ordinary requests and limits when the vertical-pod-autoscaler module is disabled.
    
    Default: {}
    
    Examples:
    mode: VPA vpa: cpu: max: 1000m min: 100m memory: limitRatio: 4 max: 2Gi min: 1024Mi mode: InPlaceOrRecreate
    mode: Static static: limits: memory: 2Gi requests: cpu: 100m memory: 1024Mi
    - settings.manager.resourcesManagement.mode
      
      string
      Resource management mode:
      
      Static is a classic one. In it, you specify requests and limits. The parameters of this mode are defined in the static parameter section;
      
      VPA mode uses VPA. You can configure this mode by modifying parameters in the vpa parameter section.
      
      Default: VPA
      
      Allowed values: VPA, Static
    - settings.manager.resourcesManagement.static
      
      object
      Resource management options for the Static mode.
      - settings.manager.resourcesManagement.static.limits
        
        object
        Resource limits of the container.
        
        settings.manager.resourcesManagement.static.limits.cpu
        
        CPU limit.
        
        settings.manager.resourcesManagement.static.limits.memory
        
        Memory limit.
      - settings.manager.resourcesManagement.static.requests
        
        object
        Resource requests of the container.
        
        settings.manager.resourcesManagement.static.requests.cpu
        
        CPU requests.
        
        settings.manager.resourcesManagement.static.requests.memory
        
        Memory requests.
    - settings.manager.resourcesManagement.vpa
      
      object
      Resource management options for the VPA mode.
      
      Default: {}
      - settings.manager.resourcesManagement.vpa.cpu
        
        object
        CPU settings.
        
        Default: {}
        
        settings.manager.resourcesManagement.vpa.cpu.limitRatio
        
        number
        Ratio between the CPU limit and the CPU requests.
        
        When set, the limit is computed from min. When omitted, the container gets no CPU limit, which is how the module behaved before this parameter existed.
        
        settings.manager.resourcesManagement.vpa.cpu.max
        
        Maximum CPU requests VPA may set.
        
        Default: 1000m
        
        settings.manager.resourcesManagement.vpa.cpu.min
        
        Minimum CPU requests VPA may set. Also used as the requests of the container.
        
        Default: 100m
      - settings.manager.resourcesManagement.vpa.memory
        
        object
        Memory settings.
        
        Default: {}
        
        settings.manager.resourcesManagement.vpa.memory.limitRatio
        
        number
        Ratio between the memory limit and the memory requests.
        
        The default reproduces the limit the module set before this parameter existed.
        
        Default: 4
        
        settings.manager.resourcesManagement.vpa.memory.max
        
        Maximum memory requests VPA may set.
        
        Default: 2Gi
        
        settings.manager.resourcesManagement.vpa.memory.min
        
        Minimum memory requests VPA may set. Also used as the requests of the container.
        
        Default: 1024Mi
      - settings.manager.resourcesManagement.vpa.mode
        
        string
        VPA operating mode.
        
        Initial — VPA sets the values at pod creation time and does not change them afterwards.
        
        InPlaceOrRecreate — VPA updates a running pod when the cluster supports it and recreates the pod otherwise.
        
        Auto — VPA recreates pods to apply updated values. Considered legacy since Deckhouse 1.75.
        
        Every mode except Initial may restart a component of the security tool.
        
        Default: InPlaceOrRecreate
        
        Allowed values: Initial, InPlaceOrRecreate, Auto
- settings.scanner
  
  object
  Configuration for the NeuVector scanner component.
  
  The scanner analyses images and running containers against the local CVE database.
  
  Default: {}
  - settings.scanner.resourcesManagement
    
    object
    CPU and memory requests and limits of the scanner container.
    
    The values below apply as ordinary requests and limits when the vertical-pod-autoscaler module is disabled.
    
    Default: {}
    
    Examples:
    mode: VPA vpa: cpu: max: 1000m min: 200m memory: limitRatio: 4 max: 3Gi min: 1Gi mode: InPlaceOrRecreate
    mode: Static static: limits: memory: 3Gi requests: cpu: 200m memory: 1Gi
    - settings.scanner.resourcesManagement.mode
      
      string
      Resource management mode:
      
      Static is a classic one. In it, you specify requests and limits. The parameters of this mode are defined in the static parameter section;
      
      VPA mode uses VPA. You can configure this mode by modifying parameters in the vpa parameter section.
      
      Default: VPA
      
      Allowed values: VPA, Static
    - settings.scanner.resourcesManagement.static
      
      object
      Resource management options for the Static mode.
      - settings.scanner.resourcesManagement.static.limits
        
        object
        Resource limits of the container.
        
        settings.scanner.resourcesManagement.static.limits.cpu
        
        CPU limit.
        
        settings.scanner.resourcesManagement.static.limits.memory
        
        Memory limit.
      - settings.scanner.resourcesManagement.static.requests
        
        object
        Resource requests of the container.
        
        settings.scanner.resourcesManagement.static.requests.cpu
        
        CPU requests.
        
        settings.scanner.resourcesManagement.static.requests.memory
        
        Memory requests.
    - settings.scanner.resourcesManagement.vpa
      
      object
      Resource management options for the VPA mode.
      
      Default: {}
      - settings.scanner.resourcesManagement.vpa.cpu
        
        object
        CPU settings.
        
        Default: {}
        
        settings.scanner.resourcesManagement.vpa.cpu.limitRatio
        
        number
        Ratio between the CPU limit and the CPU requests.
        
        When set, the limit is computed from min. When omitted, the container gets no CPU limit, which is how the module behaved before this parameter existed.
        
        settings.scanner.resourcesManagement.vpa.cpu.max
        
        Maximum CPU requests VPA may set.
        
        Default: 1000m
        
        settings.scanner.resourcesManagement.vpa.cpu.min
        
        Minimum CPU requests VPA may set. Also used as the requests of the container.
        
        Default: 200m
      - settings.scanner.resourcesManagement.vpa.memory
        
        object
        Memory settings.
        
        Default: {}
        
        settings.scanner.resourcesManagement.vpa.memory.limitRatio
        
        number
        Ratio between the memory limit and the memory requests.
        
        The default reproduces the limit the module set before this parameter existed.
        
        Default: 4
        
        settings.scanner.resourcesManagement.vpa.memory.max
        
        Maximum memory requests VPA may set.
        
        Default: 3Gi
        
        settings.scanner.resourcesManagement.vpa.memory.min
        
        Minimum memory requests VPA may set. Also used as the requests of the container.
        
        Default: 1Gi
      - settings.scanner.resourcesManagement.vpa.mode
        
        string
        VPA operating mode.
        
        Initial — VPA sets the values at pod creation time and does not change them afterwards.
        
        InPlaceOrRecreate — VPA updates a running pod when the cluster supports it and recreates the pod otherwise.
        
        Auto — VPA recreates pods to apply updated values. Considered legacy since Deckhouse 1.75.
        
        Every mode except Initial may restart a component of the security tool.
        
        Default: InPlaceOrRecreate
        
        Allowed values: Initial, InPlaceOrRecreate, Auto

Enabling NeuVector

Authentication

Controller REST API access

Forwarding Deckhouse security events

Syslog and webhook forwarding

Delivery reliability

Requirements

Parameters

An error has occurred

Tell us what you didn’t like.

Configuration

Enabling NeuVector

Authentication

Sign-in from Deckhouse console

Controller REST API access

Forwarding Deckhouse security events

Syslog and webhook forwarding

Delivery reliability

Requirements

Parameters

An error has occurred

Tell us what you didn’t like.

Request trial access

Thank you

Error

Request callback

Thank you

Something went wrong

Book your sessions

Thank you

Error

Request demo

Thank you

Error

Get the PCI SSC Compliance Report

Thank you

Error