The module lifecycle stage: Experimental
The module has requirements for installation

v0.2.1

Release date: 2026-08-14

Raised the minimum required Deckhouse version for the module.

Highlights

  • The module now requires Deckhouse 1.74 or later.

Upgrade notes

  • Verify your Deckhouse cluster is on version 1.74 or later before upgrading the module.

v0.2.0

Release date: 2026-08-10

The NeuVector controller’s persistent volume now only requires ReadWriteOnce (RWO) storage instead of ReadWriteMany (RWX), matching how the controller has actually run since HA support was disabled.

Highlights

  • The controller’s persistent volume (data PVC) now only needs ReadWriteOnce (RWO) storage support, not ReadWriteMany (RWX).

Breaking changes

  • PersistentVolumeClaim access modes are immutable in Kubernetes. If the module already provisioned a data PVC with ReadWriteMany (i.e. controller.storageClass or a cluster default storage class is configured), it will not be updated automatically on upgrade. Delete the existing data PVC in d8-neuvector before or during the upgrade so it can be recreated with ReadWriteOnce; back up the controller’s configuration via the UI (Settings → Configuration) first, since its contents will be lost when the PVC is deleted.

v0.1.14

Release date: 2026-08-05

Gateway API support for the manager UI, WAF/DLP rule hits forwarded to the Deckhouse security-events-manager, module availability for SE+ and EE editions, and CVE fixes in component images.

Highlights

  • The NeuVector manager UI can now be exposed through the Gateway API.
  • WAF/DLP rule hits are forwarded into the Deckhouse security-events-manager.
  • A custom CA certificate can be configured for the Dex integration.
  • CVE-oriented security fixes are included in the component images.

New features

  • Added Gateway API support for exposing the NeuVector manager UI (HTTPRoute and ListenerSet resources).
  • WAF and DLP rule hits are now forwarded to the Deckhouse security-events-manager so they appear alongside other security events.
  • Added a configuration value for a custom CA certificate used with the Dex authentication integration.

Improvements

  • Custom certificate support extended to the gateway-based UI exposure.
  • Raised the required Deckhouse version to 1.71 or later.

Security updates

  • CVE-oriented security fixes included in the component images.

Upgrade notes

  • This release requires Deckhouse 1.71 or later. Verify the cluster version before upgrading.
  • If you expose the manager UI via the Gateway API, review the custom certificate configuration after upgrade.

v0.1.13

Release date: 2026-06-30

Platform-security integration release: CSE edition, Deckhouse security-event bridge, Russian compliance and WAF/DLP improvements, plus authentication and scanner fixes.

Highlights

  • Added support for the CSE edition.
  • Security events from Deckhouse (including Falco and Dex audit events) are now forwarded into NeuVector.
  • Improved Russian compliance tagging (FSTEC-related tags) and WAF/DLP filters.
  • Added a token-exchange API endpoint and refined OIDC authentication behavior.
  • Hardened vulnerability database handling and fixed scanner coverage for RED OS and Astra Linux 1.8.

New features

  • Support for the CSE edition.
  • A security-event bridge routes Deckhouse security and Kubernetes audit events into NeuVector security-event views.
  • POST /v1/token-exchange endpoint for token exchange flows with the Deckhouse authentication integration.
  • Admission control coverage for Service resources.
  • Russian compliance profile improvements so FSTEC-related tags are accepted in compliance filters.
  • Automatic update and copy behavior for WAF/DLP groups and rules, with Russian filter improvements.

Improvements

  • UI and internationalization: default language and translations, self-hosted Inter font, Moment locale, language links, and related UX fixes.
  • Swagger and API documentation polish; unsuitable external links are now hidden in the UI.
  • Richer Dex authentication and Falco Kubernetes audit event details in security events.
  • Cleaner vulnerability database content and trimming of overly long descriptions.
  • Improved reliability of vulnerability processing for large data sets.
  • New module configuration values and documentation clarifications (including StorageClass description).

Fixes

  • Fixed badge rendering and gray protection/compliance badge presentation in reports.
  • Fixed the WAF/DLP upgrade path.
  • Fixed BDU links and cache behavior in the vulnerability database path; added related module configuration flags.
  • Fixed enforcer operation with iptables rules.
  • Removed an overly broad network policy that could over-permit traffic.

Security updates

  • OIDC role mapping is now handled through the module API. The built-in default admin account has been dropped in favor of the Deckhouse/OIDC authentication path — review your authentication configuration after upgrade (see upgrade notes).
  • CVE-oriented security fixes included in the CSE support.

Breaking changes

  • The built-in default admin account has been removed in favor of the Deckhouse/OIDC authentication path. If you relied on the built-in admin user, ensure operators can authenticate via the configured identity provider before upgrading.

Upgrade notes

  • Before upgrading clusters that still use the built-in admin account, verify that OIDC/Dex (or another identity provider) login works for administrators.
  • If you use WAF/DLP policies, confirm groups and rules after upgrade — the auto-update/copy logic may refresh local WAF/DLP content.
  • For CSE deployments, use the CSE-capable release artifacts from this tag.

Docs

  • Updated the module description and StorageClass-related configuration documentation.

v0.1.12

Release date: 2025-12-23

NeuVector is now available for the SE+ edition.

Highlights

  • NeuVector is available for the SE+ (SE Plus) edition.

New features

  • Enabled the module for the SE+ (SE Plus) edition, so SE+ clusters can receive NeuVector releases.

v0.1.11

Release date: 2025-11-14

Added support for scheduling NeuVector workloads on selected nodes using a node selector.

Highlights

  • NeuVector components can now be placed on specific nodes via node selector configuration.

New features

  • Added node-selector support for scheduling module workloads on chosen nodes.

v0.1.10

Release date: 2025-11-14

Fixed broken links in the module documentation and resolved a missing-file packaging issue in a container image.

Highlights

  • Restored broken documentation links so operators can follow references reliably.
  • Fixed a missing file in a container image that could affect packaging or runtime.

Fixes

  • Restored broken documentation links.
  • Added a missing file to a container image that could break packaging or runtime expectations.