The module lifecycle stage: Experimental

The module has requirements for installation

v0.2.4

Release date: 2026-09-10

Component resource requests become configurable, the image scanner starts in clusters with an authenticated registry, and ModuleConfig accepts the web console access list, the HTTPS mode and the high availability switch.

Highlights

  • Resource requests and limits of every component can be tuned or fixed to static values.
  • Vulnerability scanning of images works in clusters with a private registry.
  • Access to the web console can be restricted to a list of CIDRs, and the HTTPS mode and the high availability mode can be set for the module.

New features

  • Resource requests and limits are set through controller.resourcesManagement, manager.resourcesManagement, scanner.resourcesManagement and enforcer.resourcesManagement. The VPA mode sets the bounds VPA picks requests within, the limit-to-request ratio and the way a recommendation is applied: Initial, InPlaceOrRecreate or Auto. The Static mode fixes requests and limits and turns the picking off, which suits a component whose restart is unwanted.
  • The defaults match the values the module used before, so requests and limits of the components do not change after the update.

Fixes

  • The image scanner pod stayed in ImagePullBackOff when the image registry requires authentication, and images were left unscanned. The scanner now pulls its image with the same registry secret as the other components of the module.
  • A ModuleConfig that set auth.whitelistSourceRanges, https or highAvailability was rejected on apply, so none of the three could be used. All three are now accepted and documented.

Docs

  • The configuration documentation describes signing in to the web console from Deckhouse console. Dex passes NeuVector only those user groups that the client which performed the login allows, so a group missing from console.auth.allowedUserGroups never reaches the auth.groupRoleMapping mapping, and the role of the same user may differ depending on the sign-in path.

v0.2.3

Release date: 2026-08-27

Security fixes for component images: containerd and websocket upgrades, pip upgrade on the manager image, and OpenVEX attestations for remaining not-fixable findings.

Highlights

  • Component images remediate fixable CVEs in-tree and publish OpenVEX attestations for findings that cannot be fixed by a dependency bump.

Security updates

  • Bumped github.com/containerd/containerd/v2 to v2.2.6 in the common NeuVector tree (CVE-2026-46680), keeping the cri-api replace.
  • Bumped gorilla/websocket to v1.5.3.
  • Upgraded system pip to 26.1.2 on the manager final image (CVE-2026-3219, CVE-2026-6357, CVE-2026-8643, CVE-2026-1703).
  • Added OpenVEX statements for GO-2026-5932 on controller, enforcer, scanner and bundle hooks, and for docker daemon CVEs on the scanner where only the client library is linked.

v0.2.2

Release date: 2026-08-24

Security fixes for component images (CVE remediation).

Highlights

  • Component images include dependency and base-image updates that address known CVEs.

Security updates

  • CVE-oriented security fixes included in the component images.

v0.2.1

Release date: 2026-08-14

Raised the minimum required Deckhouse version for the module.

Highlights

  • The module now requires Deckhouse 1.74 or later.

Upgrade notes

  • Verify your Deckhouse cluster is on version 1.74 or later before upgrading the module.

v0.2.0

Release date: 2026-08-10

The NeuVector controller’s persistent volume now only requires ReadWriteOnce (RWO) storage instead of ReadWriteMany (RWX), matching how the controller has actually run since HA support was disabled.

Highlights

  • The controller’s persistent volume (data PVC) now only needs ReadWriteOnce (RWO) storage support, not ReadWriteMany (RWX).

Breaking changes

  • PersistentVolumeClaim access modes are immutable in Kubernetes. If the module already provisioned a data PVC with ReadWriteMany (i.e. controller.storageClass or a cluster default storage class is configured), it will not be updated automatically on upgrade. Delete the existing data PVC in d8-neuvector before or during the upgrade so it can be recreated with ReadWriteOnce; back up the controller’s configuration via the UI (Settings → Configuration) first, since its contents will be lost when the PVC is deleted.

v0.1.14

Release date: 2026-08-05

Gateway API support for the manager UI, WAF/DLP rule hits forwarded to the Deckhouse security-events-manager, module availability for SE+ and EE editions, and CVE fixes in component images.

Highlights

  • The NeuVector manager UI can now be exposed through the Gateway API.
  • WAF/DLP rule hits are forwarded into the Deckhouse security-events-manager.
  • A custom CA certificate can be configured for the Dex integration.
  • CVE-oriented security fixes are included in the component images.

New features

  • Added Gateway API support for exposing the NeuVector manager UI (HTTPRoute and ListenerSet resources).
  • WAF and DLP rule hits are now forwarded to the Deckhouse security-events-manager so they appear alongside other security events.
  • Added a configuration value for a custom CA certificate used with the Dex authentication integration.

Improvements

  • Custom certificate support extended to the gateway-based UI exposure.
  • Raised the required Deckhouse version to 1.71 or later.

Security updates

  • CVE-oriented security fixes included in the component images.

Upgrade notes

  • This release requires Deckhouse 1.71 or later. Verify the cluster version before upgrading.
  • If you expose the manager UI via the Gateway API, review the custom certificate configuration after upgrade.

v0.1.13

Release date: 2026-06-30

Platform-security integration release: CSE edition, Deckhouse security-event bridge, Russian compliance and WAF/DLP improvements, plus authentication and scanner fixes.

Highlights

  • Added support for the CSE edition.
  • Security events from Deckhouse (including Falco and Dex audit events) are now forwarded into NeuVector.
  • Improved Russian compliance tagging (FSTEC-related tags) and WAF/DLP filters.
  • Added a token-exchange API endpoint and refined OIDC authentication behavior.
  • Hardened vulnerability database handling and fixed scanner coverage for RED OS and Astra Linux 1.8.

New features

  • Support for the CSE edition.
  • A security-event bridge routes Deckhouse security and Kubernetes audit events into NeuVector security-event views.
  • POST /v1/token-exchange endpoint for token exchange flows with the Deckhouse authentication integration.
  • Admission control coverage for Service resources.
  • Russian compliance profile improvements so FSTEC-related tags are accepted in compliance filters.
  • Automatic update and copy behavior for WAF/DLP groups and rules, with Russian filter improvements.

Improvements

  • UI and internationalization: default language and translations, self-hosted Inter font, Moment locale, language links, and related UX fixes.
  • Swagger and API documentation polish; unsuitable external links are now hidden in the UI.
  • Richer Dex authentication and Falco Kubernetes audit event details in security events.
  • Cleaner vulnerability database content and trimming of overly long descriptions.
  • Improved reliability of vulnerability processing for large data sets.
  • New module configuration values and documentation clarifications (including StorageClass description).

Fixes

  • Fixed badge rendering and gray protection/compliance badge presentation in reports.
  • Fixed the WAF/DLP upgrade path.
  • Fixed BDU links and cache behavior in the vulnerability database path; added related module configuration flags.
  • Fixed enforcer operation with iptables rules.
  • Removed an overly broad network policy that could over-permit traffic.

Security updates

  • OIDC role mapping is now handled through the module API. The built-in default admin account has been dropped in favor of the Deckhouse/OIDC authentication path — review your authentication configuration after upgrade (see upgrade notes).
  • CVE-oriented security fixes included in the CSE support.

Breaking changes

  • The built-in default admin account has been removed in favor of the Deckhouse/OIDC authentication path. If you relied on the built-in admin user, ensure operators can authenticate via the configured identity provider before upgrading.

Upgrade notes

  • Before upgrading clusters that still use the built-in admin account, verify that OIDC/Dex (or another identity provider) login works for administrators.
  • If you use WAF/DLP policies, confirm groups and rules after upgrade — the auto-update/copy logic may refresh local WAF/DLP content.
  • For CSE deployments, use the CSE-capable release artifacts from this tag.

Docs

  • Updated the module description and StorageClass-related configuration documentation.

v0.1.12

Release date: 2025-12-23

NeuVector is now available for the SE+ edition.

Highlights

  • NeuVector is available for the SE+ (SE Plus) edition.

New features

  • Enabled the module for the SE+ (SE Plus) edition, so SE+ clusters can receive NeuVector releases.

v0.1.11

Release date: 2025-11-14

Added support for scheduling NeuVector workloads on selected nodes using a node selector.

Highlights

  • NeuVector components can now be placed on specific nodes via node selector configuration.

New features

  • Added node-selector support for scheduling module workloads on chosen nodes.

v0.1.10

Release date: 2025-11-14

Fixed broken links in the module documentation and resolved a missing-file packaging issue in a container image.

Highlights

  • Restored broken documentation links so operators can follow references reliably.
  • Fixed a missing file in a container image that could affect packaging or runtime.

Fixes

  • Restored broken documentation links.
  • Added a missing file to a container image that could break packaging or runtime expectations.