Release notes

v0.3.0

Release date: 2026-09-23

Admission control starts working: the controller could not issue the certificates of its webhooks, so no rule ever took effect. NeuVector is updated to 5.6.2, the vulnerability scanner to 4.280, Open Policy Agent to 1.20.2 and Consul to 2.0.4.

Highlights

• Admission control rules take effect.
• Response rules are declared as the NvResponseRuleSecurityRule cluster resource.
• Publication of the web console and of the controller API can be turned off.
• Vulnerabilities are reported with a critical severity level of their own.

New features

• NvResponseRuleSecurityRule declares response rules in the cluster: which event to react to, under which conditions, and what to do — quarantine the workload, suppress the log or call a webhook. The same rules can be attached to the workloads of a policy through the response section of NvSecurityRule and NvClusterSecurityRule.
• ingress.enabled turns publication of the web console and of the controller API off, and gatewayAPI.enabled turns off publication of the web console through the Gateway API. Without these parameters the module follows the global settings of the same name.
• The vulnerability list can be filtered by the base operating system of the image.
• The SAML configuration accepts an Audience URI.

Improvements

• The image scanner detects images based on Wolfi and Chainguard. A registry entry whose operating system it does not support is marked OS Unsupported.
• Vulnerabilities carry a critical severity level of their own, counted and filtered apart from high. The console shows them in the color it has always used for the most severe findings.
• The admission rule editor names the criteria that count critical vulnerabilities, and the system settings name the group mode contention resolution.
• The Russian interface covers the strings the new NeuVector release introduces.

Fixes

• Admission control had no effect: rules could be edited in the web console, but nothing was ever rejected. The controller could not issue the certificates of its webhooks, so the webhook configurations were not created and the API server had nothing to call.
• Inspection by the DLP and WAF sensors could stop with nothing to show for it. A single failed read of the rule store left the enforcer on the rules it had applied last, and it stayed there until somebody edited a policy.

Security updates

• The module images no longer carry the known vulnerabilities that the signature verifier, Open Policy Agent and the module hooks brought in: eleven in total, four of them of high severity.

Upgrade notes

• Review the admission rules in the web console before the update. Admission control becomes functional for the first time, so a rule enabled there starts being evaluated, and a rule set to deny starts rejecting workloads that used to pass.
• Run the update in a maintenance window. It restarts the controller, the enforcer, the scanner and the web console, and NeuVector moves forward by two minor releases at once.
• Review the reports and the filters that select by severity: a part of what used to be counted as high is now counted as critical.

Known issues

• A group switched to the Protect policy mode stops being inspected by the DLP and WAF sensors instead of enforcing them: nothing is reported and the requests they are meant to block go through. Keep such groups in Monitor, which restores the inspection within half a minute. Admission control is a separate mechanism and is not affected.

Dependencies

• NeuVector: 5.4.10 → 5.6.2 (changelog)

  • Adds the response rule resource, the base operating system filter and the SAML Audience URI.

• NeuVector Scanner: 3.999 → 4.280 (changelog)

  • Adds detection of Wolfi and Chainguard images.

• Open Policy Agent: 1.18.2 → 1.20.2 (changelog)

  • No user-visible change: the module uses Open Policy Agent to evaluate admission control policies.

• Consul: 1.22.7 → 2.0.4 (changelog)

  • The breaking changes of Consul 2.0 cover the service mesh and the access control lists. The module runs Consul as the internal store of the controller and uses neither, so the major version change has no user-visible impact.

v0.2.4

Release date: 2026-09-10

Component resource requests become configurable, the image scanner starts in clusters with an authenticated registry, and ModuleConfig accepts the web console access list, the HTTPS mode and the high availability switch.

Highlights

• Resource requests and limits of every component can be tuned or fixed to static values.
• Vulnerability scanning of images works in clusters with a private registry.
• Access to the web console can be restricted to a list of CIDRs, and the HTTPS mode and the high availability mode can be set for the module.

New features

• Resource requests and limits are set through controller.resourcesManagement, manager.resourcesManagement, scanner.resourcesManagement and enforcer.resourcesManagement. The VPA mode sets the bounds VPA picks requests within, the limit-to-request ratio and the way a recommendation is applied: Initial, InPlaceOrRecreate or Auto. The Static mode fixes requests and limits and turns the picking off, which suits a component whose restart is unwanted.
• The defaults match the values the module used before, so requests and limits of the components do not change after the update.

Fixes

• The image scanner pod stayed in ImagePullBackOff when the image registry requires authentication, and images were left unscanned. The scanner now pulls its image with the same registry secret as the other components of the module.
• A ModuleConfig that set auth.whitelistSourceRanges, https or highAvailability was rejected on apply, so none of the three could be used. All three are now accepted and documented.

Docs

• The configuration documentation describes signing in to the web console from Deckhouse console. Dex passes NeuVector only those user groups that the client which performed the login allows, so a group missing from console.auth.allowedUserGroups never reaches the auth.groupRoleMapping mapping, and the role of the same user may differ depending on the sign-in path.

v0.2.3

Release date: 2026-08-27

Security fixes for component images: containerd and websocket upgrades, pip upgrade on the manager image, and OpenVEX attestations for remaining not-fixable findings.

Highlights

• Component images remediate fixable CVEs in-tree and publish OpenVEX attestations for findings that cannot be fixed by a dependency bump.

Security updates

• Bumped github.com/containerd/containerd/v2 to v2.2.6 in the common NeuVector tree (CVE-2026-46680), keeping the cri-api replace.
• Bumped gorilla/websocket to v1.5.3.
• Upgraded system pip to 26.1.2 on the manager final image (CVE-2026-3219, CVE-2026-6357, CVE-2026-8643, CVE-2026-1703).
• Added OpenVEX statements for GO-2026-5932 on controller, enforcer, scanner and bundle hooks, and for docker daemon CVEs on the scanner where only the client library is linked.

v0.2.2

Release date: 2026-08-24

Security fixes for component images (CVE remediation).

Highlights

• Component images include dependency and base-image updates that address known CVEs.

Security updates

• CVE-oriented security fixes included in the component images.

v0.2.1

Release date: 2026-08-14

Raised the minimum required Deckhouse version for the module.

Highlights

• The module now requires Deckhouse 1.74 or later.

Upgrade notes

• Verify your Deckhouse cluster is on version 1.74 or later before upgrading the module.

v0.2.0

Release date: 2026-08-10

The NeuVector controller’s persistent volume now only requires ReadWriteOnce (RWO) storage instead of ReadWriteMany (RWX), matching how the controller has actually run since HA support was disabled.

Highlights

• The controller’s persistent volume (data PVC) now only needs ReadWriteOnce (RWO) storage support, not ReadWriteMany (RWX).

Breaking changes

• PersistentVolumeClaim access modes are immutable in Kubernetes. If the module already provisioned a data PVC with ReadWriteMany (i.e. controller.storageClass or a cluster default storage class is configured), it will not be updated automatically on upgrade. Delete the existing data PVC in d8-neuvector before or during the upgrade so it can be recreated with ReadWriteOnce; back up the controller’s configuration via the UI (Settings → Configuration) first, since its contents will be lost when the PVC is deleted.

v0.1.14

Release date: 2026-08-05

Gateway API support for the manager UI, WAF/DLP rule hits forwarded to the Deckhouse security-events-manager, module availability for SE+ and EE editions, and CVE fixes in component images.

Highlights

• The NeuVector manager UI can now be exposed through the Gateway API.
• WAF/DLP rule hits are forwarded into the Deckhouse security-events-manager.
• A custom CA certificate can be configured for the Dex integration.
• CVE-oriented security fixes are included in the component images.

New features

• Added Gateway API support for exposing the NeuVector manager UI (HTTPRoute and ListenerSet resources).
• WAF and DLP rule hits are now forwarded to the Deckhouse security-events-manager so they appear alongside other security events.
• Added a configuration value for a custom CA certificate used with the Dex authentication integration.

Improvements

• Custom certificate support extended to the gateway-based UI exposure.
• Raised the required Deckhouse version to 1.71 or later.

Security updates

• CVE-oriented security fixes included in the component images.

Upgrade notes

• This release requires Deckhouse 1.71 or later. Verify the cluster version before upgrading.
• If you expose the manager UI via the Gateway API, review the custom certificate configuration after upgrade.

v0.1.13

Release date: 2026-06-30

Platform-security integration release: CSE edition, Deckhouse security-event bridge, Russian compliance and WAF/DLP improvements, plus authentication and scanner fixes.

Highlights

• Added support for the CSE edition.
• Security events from Deckhouse (including Falco and Dex audit events) are now forwarded into NeuVector.
• Improved Russian compliance tagging (FSTEC-related tags) and WAF/DLP filters.
• Added a token-exchange API endpoint and refined OIDC authentication behavior.
• Hardened vulnerability database handling and fixed scanner coverage for RED OS and Astra Linux 1.8.

New features

• Support for the CSE edition.
• A security-event bridge routes Deckhouse security and Kubernetes audit events into NeuVector security-event views.
• POST /v1/token-exchange endpoint for token exchange flows with the Deckhouse authentication integration.
• Admission control coverage for Service resources.
• Russian compliance profile improvements so FSTEC-related tags are accepted in compliance filters.
• Automatic update and copy behavior for WAF/DLP groups and rules, with Russian filter improvements.

Improvements

• UI and internationalization: default language and translations, self-hosted Inter font, Moment locale, language links, and related UX fixes.
• Swagger and API documentation polish; unsuitable external links are now hidden in the UI.
• Richer Dex authentication and Falco Kubernetes audit event details in security events.
• Cleaner vulnerability database content and trimming of overly long descriptions.
• Improved reliability of vulnerability processing for large data sets.
• New module configuration values and documentation clarifications (including StorageClass description).

Fixes

• Fixed badge rendering and gray protection/compliance badge presentation in reports.
• Fixed the WAF/DLP upgrade path.
• Fixed BDU links and cache behavior in the vulnerability database path; added related module configuration flags.
• Fixed enforcer operation with iptables rules.
• Removed an overly broad network policy that could over-permit traffic.

Security updates

• OIDC role mapping is now handled through the module API. The built-in default admin account has been dropped in favor of the Deckhouse/OIDC authentication path — review your authentication configuration after upgrade (see upgrade notes).
• CVE-oriented security fixes included in the CSE support.

Breaking changes

• The built-in default admin account has been removed in favor of the Deckhouse/OIDC authentication path. If you relied on the built-in admin user, ensure operators can authenticate via the configured identity provider before upgrading.

Upgrade notes

• Before upgrading clusters that still use the built-in admin account, verify that OIDC/Dex (or another identity provider) login works for administrators.
• If you use WAF/DLP policies, confirm groups and rules after upgrade — the auto-update/copy logic may refresh local WAF/DLP content.
• For CSE deployments, use the CSE-capable release artifacts from this tag.

Docs

• Updated the module description and StorageClass-related configuration documentation.

v0.1.12

Release date: 2025-12-23

NeuVector is now available for the SE+ edition.

Highlights

• NeuVector is available for the SE+ (SE Plus) edition.

New features

• Enabled the module for the SE+ (SE Plus) edition, so SE+ clusters can receive NeuVector releases.

v0.1.11

Release date: 2025-11-14

Added support for scheduling NeuVector workloads on selected nodes using a node selector.

Highlights

• NeuVector components can now be placed on specific nodes via node selector configuration.

New features

• Added node-selector support for scheduling module workloads on chosen nodes.

v0.1.10

Release date: 2025-11-14

Fixed broken links in the module documentation and resolved a missing-file packaging issue in a container image.

Highlights

• Restored broken documentation links so operators can follow references reliably.
• Fixed a missing file in a container image that could affect packaging or runtime.

Fixes

• Restored broken documentation links.
• Added a missing file to a container image that could break packaging or runtime expectations.