Release notes

v0.1.14

Release date: 2026-08-05

Gateway API support for the manager UI, WAF/DLP rule hits forwarded to the Deckhouse security-events-manager, module availability for SE+ and EE editions, and CVE fixes in component images.

Highlights

• The NeuVector manager UI can now be exposed through the Gateway API.
• WAF/DLP rule hits are forwarded into the Deckhouse security-events-manager.
• A custom CA certificate can be configured for the Dex integration.
• CVE-oriented security fixes are included in the component images.

New features

• Added Gateway API support for exposing the NeuVector manager UI (HTTPRoute and ListenerSet resources).
• WAF and DLP rule hits are now forwarded to the Deckhouse security-events-manager so they appear alongside other security events.
• Added a configuration value for a custom CA certificate used with the Dex authentication integration.

Improvements

• Custom certificate support extended to the gateway-based UI exposure.
• Raised the required Deckhouse version to 1.71 or later.

Security updates

• CVE-oriented security fixes included in the component images.

Upgrade notes

• This release requires Deckhouse 1.71 or later. Verify the cluster version before upgrading.
• If you expose the manager UI via the Gateway API, review the custom certificate configuration after upgrade.

v0.1.13

Release date: 2026-06-30

Platform-security integration release: CSE edition, Deckhouse security-event bridge, Russian compliance and WAF/DLP improvements, plus authentication and scanner fixes.

Highlights

• Added support for the CSE edition.
• Security events from Deckhouse (including Falco and Dex audit events) are now forwarded into NeuVector.
• Improved Russian compliance tagging (FSTEC-related tags) and WAF/DLP filters.
• Added a token-exchange API endpoint and refined OIDC authentication behavior.
• Hardened vulnerability database handling and fixed scanner coverage for RED OS and Astra Linux 1.8.

New features

• Support for the CSE edition.
• A security-event bridge routes Deckhouse security and Kubernetes audit events into NeuVector security-event views.
• POST /v1/token-exchange endpoint for token exchange flows with the Deckhouse authentication integration.
• Admission control coverage for Service resources.
• Russian compliance profile improvements so FSTEC-related tags are accepted in compliance filters.
• Automatic update and copy behavior for WAF/DLP groups and rules, with Russian filter improvements.

Improvements

• UI and internationalization: default language and translations, self-hosted Inter font, Moment locale, language links, and related UX fixes.
• Swagger and API documentation polish; unsuitable external links are now hidden in the UI.
• Richer Dex authentication and Falco Kubernetes audit event details in security events.
• Cleaner vulnerability database content and trimming of overly long descriptions.
• Improved reliability of vulnerability processing for large data sets.
• New module configuration values and documentation clarifications (including StorageClass description).

Fixes

• Fixed badge rendering and gray protection/compliance badge presentation in reports.
• Fixed the WAF/DLP upgrade path.
• Fixed BDU links and cache behavior in the vulnerability database path; added related module configuration flags.
• Fixed enforcer operation with iptables rules.
• Removed an overly broad network policy that could over-permit traffic.

Security updates

• OIDC role mapping is now handled through the module API. The built-in default admin account has been dropped in favor of the Deckhouse/OIDC authentication path — review your authentication configuration after upgrade (see upgrade notes).
• CVE-oriented security fixes included in the CSE support.

Breaking changes

• The built-in default admin account has been removed in favor of the Deckhouse/OIDC authentication path. If you relied on the built-in admin user, ensure operators can authenticate via the configured identity provider before upgrading.

Upgrade notes

• Before upgrading clusters that still use the built-in admin account, verify that OIDC/Dex (or another identity provider) login works for administrators.
• If you use WAF/DLP policies, confirm groups and rules after upgrade — the auto-update/copy logic may refresh local WAF/DLP content.
• For CSE deployments, use the CSE-capable release artifacts from this tag.

Docs

• Updated the module description and StorageClass-related configuration documentation.

v0.1.12

Release date: 2025-12-23

NeuVector is now available for the SE+ edition.

Highlights

• NeuVector is available for the SE+ (SE Plus) edition.

New features

• Enabled the module for the SE+ (SE Plus) edition, so SE+ clusters can receive NeuVector releases.

v0.1.11

Release date: 2025-11-14

Added support for scheduling NeuVector workloads on selected nodes using a node selector.

Highlights

• NeuVector components can now be placed on specific nodes via node selector configuration.

New features

• Added node-selector support for scheduling module workloads on chosen nodes.

v0.1.10

Release date: 2025-11-14

Fixed broken links in the module documentation and resolved a missing-file packaging issue in a container image.

Highlights

• Restored broken documentation links so operators can follow references reliably.
• Fixed a missing file in a container image that could affect packaging or runtime.

Fixes

• Restored broken documentation links.
• Added a missing file to a container image that could break packaging or runtime expectations.