The module lifecycle stage: Experimental
The module has requirements for installation

Why does the error Error: group criteria mismatch occur when importing a policy?

This means that the group criteria do not match between the source and the destination. Make sure the group configurations are identical on both sides.

What should I do if I see the error Error: cross-namespace policy creation denied?

This error indicates an attempt to create a policy across different namespaces. In such cases, use an object of type NvClusterSecurityRule.

How can I verify connectivity between NeuVector components?

Information about the state of components is displayed in the console, in the Assets → System components section.

Make sure that TLS certificates are correctly configured, valid and trusted. Command to request a certificate:

d8 k get -n d8-neuvector secret internal-tls -oyaml

What happens if a Persistent Volume (PV) is not configured?

Data will not be saved. In this case, you must manually export the configuration via the UI: Settings → Configuration.

What types of volumes are supported by NeuVector?

Any volume with the RWO (ReadWriteOnce) access mode is supported — the Controller runs as a single replica, so the volume is never mounted by more than one pod at a time.

How to change the user session timeout in NeuVector?

Go to the upper right corner of the NeuVector interface, open My Profile → Session timeout and specify the desired time in seconds. By default, the session ends after 5 minutes (300 seconds), the maximum value is 3600 seconds (1 hour).

How to check CVE database versions

To check the CVE database version, open the console and go to Assets → System components -> Scanner — the version information is displayed in this section.

How to run a one-off vulnerability scan with the NeuVector Scanner

The Deckhouse-built scanner image is republished under the tag extra/scanner:3 (see .gitlab-ci.yml job .cvedb_update). The tag is moving — it is overwritten by each scheduled CVE DB rebuild and by every release tag, so it always carries a fresh CVE database. The image content matches what the in-cluster neuvector-scanner-pod runs at the same module version.

Image path and registry credentials

The image is published only for the fe, ee, se-plus editions (the matrix in .gitlab-ci.yml); none of them are anonymous. Use the same credentials you use to install Deckhouse:

d8 k -n d8-system get secret deckhouse-registry \
  -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d > /tmp/d8-dockercfg.json
DOCKER_CONFIG=$(mktemp -d)
cp /tmp/d8-dockercfg.json "$DOCKER_CONFIG/config.json"
export DOCKER_CONFIG

(All docker/crane/skopeo commands below will reuse $DOCKER_CONFIG.)

The image path follows the standard layout <registry>/deckhouse/<edition>/modules/neuvector/extra/scanner:3, e.g.:

  • registry.deckhouse.io/deckhouse/fe/modules/neuvector/extra/scanner:3
  • registry.deckhouse.io/deckhouse/ee/modules/neuvector/extra/scanner:3
  • registry.deckhouse.io/deckhouse/se-plus/modules/neuvector/extra/scanner:3

If you need a reproducible reference (the floating tag will move on the next CVE DB rebuild), pin by digest:

crane digest registry.deckhouse.io/deckhouse/fe/modules/neuvector/extra/scanner:3
# -> sha256:...

…and then use …/extra/scanner@sha256:… in the examples below.

Scan an image already loaded in the local Docker daemon

IMAGE=registry.deckhouse.io/deckhouse/fe/modules/neuvector/extra/scanner:3
docker run --rm \
  -e SCANNER_REPOSITORY=ubuntu \
  -e SCANNER_TAG=22.04 \
  -e SCANNER_ON_DEMAND=true \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v "$HOME/neuvector-out:/var/neuvector" \
  "$IMAGE"

Scan an image directly from a remote registry (no local pull)

IMAGE=registry.deckhouse.io/deckhouse/fe/modules/neuvector/extra/scanner:3
docker run --rm \
  -e SCANNER_ON_DEMAND=true \
  -e SCANNER_REGISTRY=registry.example.com \
  -e SCANNER_REPOSITORY=myproject/service \
  -e SCANNER_TAG=1.2.3 \
  -e SCANNER_REGISTRY_USERNAME=myuser \
  -e SCANNER_REGISTRY_PASSWORD=mytoken \
  -v "$HOME/neuvector-out:/var/neuvector" \
  "$IMAGE"

Push the scan result into a running controller

Use the Ingress from controller.apiIngress or d8 k port-forward. The credentials must be those of a local NeuVector user with the scanner permission — OIDC-only users cannot be used here, because the standalone scanner authenticates against the controller’s REST API with username/password, not via Dex.

IMAGE=registry.deckhouse.io/deckhouse/fe/modules/neuvector/extra/scanner:3
docker run --rm \
  -e SCANNER_ON_DEMAND=true \
  -e SCANNER_REGISTRY=registry.example.com \
  -e SCANNER_REPOSITORY=myproject/service \
  -e SCANNER_TAG=1.2.3 \
  -e CLUSTER_JOIN_ADDR=neuvector-api.<publicDomainTemplate> \
  -e CLUSTER_JOIN_PORT=443 \
  -e SCANNER_CTRL_API_USERNAME=<api-user> \
  -e SCANNER_CTRL_API_PASSWORD=<api-password> \
  "$IMAGE"

What gets written

The scan report and the layer-by-layer breakdown are written under /var/neuvector inside the container — mount a host directory there to keep the artefacts after the run. Setting SCANNER_ON_DEMAND=true makes monitor start the scanner in standalone mode and exit after the scan completes (see monitor/monitor.c in neuvector/scanner). The full list of supported variables (SCANNER_REPOSITORY, SCANNER_TAG, SCANNER_REGISTRY, SCANNER_REGISTRY_USERNAME, SCANNER_REGISTRY_PASSWORD, SCANNER_ON_DEMAND, SCANNER_SCAN_LAYERS, SCANNER_DOCKER_URL, SCANNER_BASE_IMAGE, SCANNER_STANDALONE_TLS_VERIFICATION, CLUSTER_JOIN_ADDR, CLUSTER_JOIN_PORT, SCANNER_CTRL_API_USERNAME, SCANNER_CTRL_API_PASSWORD, PROXY_URL) matches upstream NeuVector — see the Parallel & Standalone Scanners docs for the full reference.