The module lifecycle stage: Experimental
The module has requirements for installation

Why does the error Error: group criteria mismatch occur when importing a policy?

This means that the group criteria do not match between the source and the destination. Make sure the group configurations are identical on both sides.

What should I do if I see the error Error: cross-namespace policy creation denied?

This error indicates an attempt to create a policy across different namespaces. In such cases, use an object of type NvClusterSecurityRule.

How can I verify connectivity between NeuVector components?

Information about the state of components is displayed in the console, in the Assets → System components section.

Make sure that TLS certificates are correctly configured, valid and trusted. Command to request a certificate:

d8 k get -n d8-neuvector secret internal-tls -oyaml

What happens if a Persistent Volume (PV) is not configured?

Data will not be saved. In this case, you must manually export the configuration via the UI: Settings → Configuration.

What types of volumes are supported by NeuVector?

Only volumes with RWX (ReadWriteMany) access mode are supported. For example, in GKE, you can use volumes backed by NFS.

How to change the user session timeout in NeuVector?

Go to the upper right corner of the NeuVector interface, open My Profile → Session timeout and specify the desired time in seconds. By default, the session ends after 5 minutes (300 seconds), the maximum value is 3600 seconds (1 hour).

How to check CVE database versions

To check the CVE database version, open the console and go to Assets → System components -> Scanner — the version information is displayed in this section.

How to run a one-off vulnerability scan with the NeuVector Scanner

The Deckhouse-built scanner image is republished under the tag extra/scanner:3 (see .gitlab-ci.yml job .cvedb_update). The tag is moving — it is overwritten by each scheduled CVE DB rebuild and by every release tag, so it always carries a fresh CVE database. The image content matches what the in-cluster neuvector-scanner-pod runs at the same module version.

Image path and registry credentials

The image is published only for the fe, ee, se-plus editions (the matrix in .gitlab-ci.yml); none of them are anonymous. Use the same credentials you use to install Deckhouse:

d8 k -n d8-system get secret deckhouse-registry \
  -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d > /tmp/d8-dockercfg.json
DOCKER_CONFIG=$(mktemp -d)
cp /tmp/d8-dockercfg.json "$DOCKER_CONFIG/config.json"
export DOCKER_CONFIG

(All docker/crane/skopeo commands below will reuse $DOCKER_CONFIG.)

The image path follows the standard layout <registry>/deckhouse/<edition>/modules/neuvector/extra/scanner:3, e.g.:

  • registry.deckhouse.io/deckhouse/fe/modules/neuvector/extra/scanner:3
  • registry.deckhouse.io/deckhouse/ee/modules/neuvector/extra/scanner:3
  • registry.deckhouse.io/deckhouse/se-plus/modules/neuvector/extra/scanner:3

If you need a reproducible reference (the floating tag will move on the next CVE DB rebuild), pin by digest:

crane digest registry.deckhouse.io/deckhouse/fe/modules/neuvector/extra/scanner:3
# -> sha256:...

…and then use …/extra/scanner@sha256:… in the examples below.

Scan an image already loaded in the local Docker daemon

IMAGE=registry.deckhouse.io/deckhouse/fe/modules/neuvector/extra/scanner:3
docker run --rm \
  -e SCANNER_REPOSITORY=ubuntu \
  -e SCANNER_TAG=22.04 \
  -e SCANNER_ON_DEMAND=true \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v "$HOME/neuvector-out:/var/neuvector" \
  "$IMAGE"

Scan an image directly from a remote registry (no local pull)

IMAGE=registry.deckhouse.io/deckhouse/fe/modules/neuvector/extra/scanner:3
docker run --rm \
  -e SCANNER_ON_DEMAND=true \
  -e SCANNER_REGISTRY=registry.example.com \
  -e SCANNER_REPOSITORY=myproject/service \
  -e SCANNER_TAG=1.2.3 \
  -e SCANNER_REGISTRY_USERNAME=myuser \
  -e SCANNER_REGISTRY_PASSWORD=mytoken \
  -v "$HOME/neuvector-out:/var/neuvector" \
  "$IMAGE"

Push the scan result into a running controller

Use the Ingress from controller.apiIngress or d8 k port-forward. The credentials must be those of a local NeuVector user with the scanner permission — OIDC-only users cannot be used here, because the standalone scanner authenticates against the controller’s REST API with username/password, not via Dex.

IMAGE=registry.deckhouse.io/deckhouse/fe/modules/neuvector/extra/scanner:3
docker run --rm \
  -e SCANNER_ON_DEMAND=true \
  -e SCANNER_REGISTRY=registry.example.com \
  -e SCANNER_REPOSITORY=myproject/service \
  -e SCANNER_TAG=1.2.3 \
  -e CLUSTER_JOIN_ADDR=neuvector-api.<publicDomainTemplate> \
  -e CLUSTER_JOIN_PORT=443 \
  -e SCANNER_CTRL_API_USERNAME=<api-user> \
  -e SCANNER_CTRL_API_PASSWORD=<api-password> \
  "$IMAGE"

What gets written

The scan report and the layer-by-layer breakdown are written under /var/neuvector inside the container — mount a host directory there to keep the artefacts after the run. Setting SCANNER_ON_DEMAND=true makes monitor start the scanner in standalone mode and exit after the scan completes (see monitor/monitor.c in neuvector/scanner). The full list of supported variables (SCANNER_REPOSITORY, SCANNER_TAG, SCANNER_REGISTRY, SCANNER_REGISTRY_USERNAME, SCANNER_REGISTRY_PASSWORD, SCANNER_ON_DEMAND, SCANNER_SCAN_LAYERS, SCANNER_DOCKER_URL, SCANNER_BASE_IMAGE, SCANNER_STANDALONE_TLS_VERIFICATION, CLUSTER_JOIN_ADDR, CLUSTER_JOIN_PORT, SCANNER_CTRL_API_USERNAME, SCANNER_CTRL_API_PASSWORD, PROXY_URL) matches upstream NeuVector — see the Parallel & Standalone Scanners docs for the full reference.