Configuration

Enabling NeuVector

To enable the module, use the web interface or the following command:

d8 platform module enable neuvector

Authentication

Authentication depends on the configuration:

• If the user-authn module is enabled, NeuVector uses the centralized authentication system of Deckhouse Kubernetes Platform and supports all configured OAuth providers.

• If the user-authn module is disabled, local NeuVector authentication is used. In this case, only the built-in admin user is valid, whose password can be obtained using the command:

  d8 k -n d8-neuvector get secret admin -o jsonpath='{.data.password}' | base64 -d
  

parameters

Schema version: 1

• settings

  object
  • settings.controller

    object

    Configuration for the NeuVector controller component.

    The controller manages policies, orchestrates scanning, and provides the REST API.

    • settings.controller.nodeSelector

      object

      The same as in the pods’ spec.nodeSelector parameter in Kubernetes.

      If the parameter is omitted, it will be determined automatically.

      Example:

      
      

      disktype: ssd
      

    • settings.controller.storageClass

      The name of StorageClass that will be used in the cluster by default.

      If the value is not specified, the StorageClass will be used according to the global storageClass parameter setting.

      The global storageClass parameter is only considered when the module is enabled. Changing the global storageClass parameter while the module is enabled will not trigger disk re-provisioning.

      Warning. Specifying a value different from the one currently used (in the existing PVC) will result in disk re-provisioning and all data will be deleted.

      If false is specified, emptyDir will be forced to be used.

      Examples:

      
      

      storageClass: false
      

      storageClass: nfs-storage-class
      

    • settings.controller.tolerations

      array of objects

      The same as in the Pods’ spec.tolerations parameter in Kubernetes.

      If the parameter is omitted or false, it will be determined automatically.

      • settings.controller.tolerations.effect

        string
      • settings.controller.tolerations.key

        string
      • settings.controller.tolerations.operator

        string
      • settings.controller.tolerations.tolerationSeconds

        integer
      • settings.controller.tolerations.value

        string
  • settings.highAvailability

    boolean

    Manually enable the high availability mode.

    By default, Deckhouse automatically decides whether to enable the HA mode. Click here to learn more about the HA mode for modules.

    Example:

    
    

    highAvailability: true
    

  • settings.https

    object

    What certificate type to use with the neuvector.

    This parameter completely overrides the global.modules.https settings.

    Examples:

    
    

    customCertificate:
      secretName: foobar
    mode: CustomCertificate
    

    certManager:
      clusterIssuerName: letsencrypt
    mode: CertManager
    

    • settings.https.certManager

      object
      • settings.https.certManager.clusterIssuerName

        string

        What ClusterIssuer to use for the neuvector. Currently, letsencrypt, letsencrypt-staging, selfsigned are available; also, you can define your own.

        Default: letsencrypt

    • settings.https.customCertificate

      object
      • settings.https.customCertificate.secretName

        string

        The name of the Secret in the d8-system namespace to use with the neuvector (this Secret must have the kubernetes.io/tls format).

        Default: false

    • settings.https.mode

      string

      The HTTPS usage mode:

      • CertManager — the neuvector will use HTTPS and get a certificate from the ClusterIssuer defined in the certManager.clusterIssuerName parameter;
      • CustomCertificate — the neuvector will use the certificate from the d8-system namespace for HTTPS;
      • Disabled — neuvector will not work in this mode;
      • OnlyInURI — the neuvector will work over HTTP (thinking that there is an external HTTPS load balancer in front of it that terminates HTTPS traffic). All the links in the user-authn will be generated using the HTTPS scheme. Load balancer should provide a redirect from HTTP to HTTPS.

      Allowed values: Disabled, CertManager, CustomCertificate, OnlyInURI

  • settings.manager

    object

    Configuration for the NeuVector manager (web UI) component.

    The manager provides the web-based user interface for NeuVector.

    • settings.manager.nodeSelector

      object

      The same as in the pods’ spec.nodeSelector parameter in Kubernetes.

      If the parameter is omitted, it will be determined automatically.

      Example:

      
      

      disktype: ssd
      

    • settings.manager.tolerations

      array of objects

      The same as in the Pods’ spec.tolerations parameter in Kubernetes.

      If the parameter is omitted or false, it will be determined automatically.

      • settings.manager.tolerations.effect

        string
      • settings.manager.tolerations.key

        string
      • settings.manager.tolerations.operator

        string
      • settings.manager.tolerations.tolerationSeconds

        integer
      • settings.manager.tolerations.value

        string
  • settings.scanner

    object

    Configuration for the NeuVector scanner component.

    The scanner performs vulnerability scanning of container images and registries.

    • settings.scanner.nodeSelector

      object

      Node selector for scanner pods.

      Example:

      
      

      disktype: ssd
      

    • settings.scanner.tolerations

      array of objects

      The same as in the Pods’ spec.tolerations parameter in Kubernetes.

      If the parameter is omitted or false, it will be determined automatically.

      • settings.scanner.tolerations.effect

        string
      • settings.scanner.tolerations.key

        string
      • settings.scanner.tolerations.operator

        string
      • settings.scanner.tolerations.tolerationSeconds

        integer
      • settings.scanner.tolerations.value

        string