The module lifecycle stage: Experimental
The module has requirements for installation

Examples of using security policies

  1. The example of a network security policy for a web application allowing incoming HTTP and HTTPS requests and outgoing requests in postgresSQL:

    apiVersion: neuvector.com/v1
kind: NvSecurityRule
metadata:
  name: web-app-security
  namespace: production
spec:
  target:
    policymode: Protect
    selector:
      name: nv.web-app.production
      criteria:
        - key: service
          value: web-app.production
          op: "="
        - key: domain
          value: production
          op: "="
  ingress:
    - action: allow
      name: allow-http
      selector:
        name: ingress-controller
        criteria:
          - key: service
            value: nginx-ingress
            op: "="
      ports: tcp/80,tcp/443
      applications:
        - HTTP
        - SSL
  egress:
    - action: allow
      name: allow-database
      selector:
        name: nv.database.production
        criteria:
          - key: service
            value: database.production
            op: "="
      ports: tcp/5432
      applications:
        - PostgreSQL

  2. The example of a global policy that denies SSH access to all containers in a cluster:

    apiVersion: neuvector.com/v1
kind: NvClusterSecurityRule
metadata:
  name: global-ssh-restriction
  namespace: neuvector
spec:
  target:
    selector:
      name: containers
      criteria:
        - key: container
          value: "*"
          op: "="
  ingress:
    - action: deny
      name: deny-external-ssh
      selector:
        name: external
        criteria: []
      ports: tcp/22
      applications:
        - SSH
  process:
    - action: deny
      name: ssh
      path: /bin/ssh

  3. The example policy blocking deployment to system namespaces:

    apiVersion: neuvector.com/v1
kind: NvAdmissionControlSecurityRule
metadata:
  name: local
  namespace: neuvector
spec:
  config:
    enable: true
    mode: protect
    client_mode: service
  rules:
    - action: deny
      criteria:
        - name: namespace
          op: containsAny
          path: namespace
          value: "kube-system,kube-public"
      comment: "Blocking deployments to system namespaces"

  4. The example of a reusable group, this group can be referenced in policies via target:

    apiVersion: neuvector.com/v1
kind: NvGroupDefinition
metadata:
  name: production-web-services
  namespace: neuvector
spec:
  selector:
    name: nv.web-services.production
    comment: "Production web services group"
    criteria:
      - key: service
        value: web-services.production
        op: "="
      - key: domain
        value: production
        op: "="

Mapping Dex groups to NeuVector roles

The following ModuleConfig snippet shows how to assign cluster-wide and namespace-scoped NeuVector roles based on the user’s Dex groups:

apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: neuvector
spec:
  enabled: true
  version: 1
  settings:
    auth:
      allowedUserGroups:
        - neuvector-admins
        - developers
      defaultRole: reader
      groupRoleMapping:
        - group: neuvector-admins
          globalRole: admin
        - group: developers
          globalRole: none
          roleDomains:
            admin:
              - dev-team-a
              - dev-team-b
            reader:
              - staging

How NeuVector evaluates this:

  • Members of the neuvector-admins group receive the global admin role and can manage the entire cluster.
  • Members of the developers group receive no global role but become admin in namespaces dev-team-a and dev-team-b, and reader in staging.
  • Anyone in allowedUserGroups who matches none of the entries above falls back to auth.defaultRole (reader here).
  • auth.allowedUserGroups is enforced by Dex before a user reaches NeuVector — make sure the same groups are declared in the corresponding DexProvider.

Running the NeuVector Scanner standalone

See the FAQ entry How to run a one-off vulnerability scan with NeuVector Scanner.

Additional Resources