Configuration

The module lifecycle stage: Experimental

Available with limitations in: CSE Pro (1.67)

Available without limitations in: EE

Enabling NeuVector

To enable the module, use the web interface or the following command:

d8 platform module enable neuvector

Authentication

Authentication depends on the configuration:

If the user-authn module is enabled, NeuVector uses the centralized authentication system of Deckhouse Kubernetes Platform and supports all configured OAuth providers.
If the user-authn module is disabled, local NeuVector authentication is used. In this case, only the built-in admin user is valid, whose password can be obtained using the command:
```
d8 k -n d8-neuvector get secret admin -o jsonpath='{.data.password}' | base64 -d
```

How to explicitly enable the module…

You may explicitly enable or disable the module in one of the following ways:

Via Deckhouse web UI. In the “System” → “System Management” → “Deckhouse” → “Modules” section, open the neuvector module and enable (or disable) the “Module enabled” toggle. Save changes.

Example:
Via Deckhouse CLI (d8).

Use the d8 system module enable command for enabling, or d8 system module disable command for disabling the module (you need Deckhouse CLI (d8), configured to work with the cluster).

Example of enabling the module:
```
d8 system module enable neuvector
```
Using ModuleConfig neuvector.

Set spec.enabled to true or false in ModuleConfig neuvector (create it if necessary);

Example of a manifest to enable module neuvector:
```
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: neuvector
spec:
  enabled: true
```

How to configure the module…

You can configure the module in one of the following ways:

Via Deckhouse web UI.

In the “System” → “System Management” → “Deckhouse” → “Modules” section, open the neuvector module and enable the “Advanced Settings” switch. Fill in the required fields in the “Configuration” tab or specify the module settings in YAML format on the “YAML” tab, excluding the settings section. Save the changes.

Example:

You can also edit the ModuleConfig object neuvector on the “YAML” tab in the module settings window (“System” → “System Management” → “Deckhouse” → “Modules”, open the module neuvector) by specifying the schema version in the spec.version parameter and the necessary module parameters in the spec.settings section.
Via Deckhouse CLI (d8) (requires Deckhouse CLI (d8) configured to work with the cluster).

Edit the existing ModuleConfig neuvector (for more details on configuring Deckhouse, see the documentation) by executing the following command:
```
d8 k edit mc neuvector
```
Make the necessary changes in the spec.settings section. If necessary, specify the schema version in the spec.version parameter. Save the changes.

You can also create a file with manifest for ModuleConfig neuvector using the example below. Fill in the spec.settings section with the required module parameters. If necessary, specify the schema version in the spec.version parameter.

Apply the manifest using the following command (indicate the manifest file name):
```
d8 k apply -f <FILENAME>
```
Example of a manifest for ModuleConfig neuvector:
```
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: neuvector
spec:
  version: 1
  enabled: true
  settings: # Module parameters from the "Parameters" section below.
```

Requirements

To the Deckhouse version: 1.68 and above.

Parameters

Schema version: 1

settings
object
- settings.controller
  
  object
  Configuration for the NeuVector controller component.
  
  The controller manages policies, orchestrates scanning, and provides the REST API.
  - settings.controller.nodeSelector
    
    object
    The same as in the pods’ spec.nodeSelector parameter in Kubernetes.
    
    If the parameter is omitted, it will be determined automatically.
    
    Example:
    disktype: ssd
  - settings.controller.storageClass
    
    The name of StorageClass that will be used in the cluster by default.
    
    If the value is not specified, the StorageClass will be used according to the global storageClass parameter setting.
    
    The global storageClass parameter is only considered when the module is enabled. Changing the global storageClass parameter while the module is enabled will not trigger disk re-provisioning.
    
    Warning. Specifying a value different from the one currently used (in the existing PVC) will result in disk re-provisioning and all data will be deleted.
    
    If false is specified, emptyDir will be forced to be used.
    
    Examples:
    storageClass: false
    storageClass: nfs-storage-class
  - settings.controller.tolerations
    
    array of objects
    The same as in the Pods’ spec.tolerations parameter in Kubernetes.
    
    If the parameter is omitted or false, it will be determined automatically.
    - settings.controller.tolerations.effect
      
      string
    - settings.controller.tolerations.key
      
      string
    - settings.controller.tolerations.operator
      
      string
    - settings.controller.tolerations.tolerationSeconds
      
      integer
    - settings.controller.tolerations.value
      
      string
- settings.highAvailability
  
  boolean
  Manually enable the high availability mode.
  
  By default, Deckhouse automatically decides whether to enable the HA mode. Click here to learn more about the HA mode for modules.
  
  Example:
  highAvailability: true
- settings.https
  
  object
  What certificate type to use with the neuvector.
  
  This parameter completely overrides the global.modules.https settings.
  
  Examples:
  customCertificate: secretName: foobar mode: CustomCertificate
  certManager: clusterIssuerName: letsencrypt mode: CertManager
  - settings.https.certManager
    
    object
    - settings.https.certManager.clusterIssuerName
      
      string
      What ClusterIssuer to use for the neuvector. Currently, letsencrypt, letsencrypt-staging, selfsigned are available; also, you can define your own.
      
      Default: letsencrypt
  - settings.https.customCertificate
    
    object
    - settings.https.customCertificate.secretName
      
      string
      The name of the Secret in the d8-system namespace to use with the neuvector (this Secret must have the kubernetes.io/tls format).
      
      Default: false
  - settings.https.mode
    
    string
    The HTTPS usage mode:
    
    CertManager — the neuvector will use HTTPS and get a certificate from the ClusterIssuer defined in the certManager.clusterIssuerName parameter;
    
    CustomCertificate — the neuvector will use the certificate from the d8-system namespace for HTTPS;
    
    Disabled — neuvector will not work in this mode;
    
    OnlyInURI — the neuvector will work over HTTP (thinking that there is an external HTTPS load balancer in front of it that terminates HTTPS traffic). All the links in the user-authn will be generated using the HTTPS scheme. Load balancer should provide a redirect from HTTP to HTTPS.
    Allowed values: Disabled, CertManager, CustomCertificate, OnlyInURI
- settings.manager
  
  object
  Configuration for the NeuVector manager (web UI) component.
  
  The manager provides the web-based user interface for NeuVector.
  - settings.manager.nodeSelector
    
    object
    The same as in the pods’ spec.nodeSelector parameter in Kubernetes.
    
    If the parameter is omitted, it will be determined automatically.
    
    Example:
    disktype: ssd
  - settings.manager.tolerations
    
    array of objects
    The same as in the Pods’ spec.tolerations parameter in Kubernetes.
    
    If the parameter is omitted or false, it will be determined automatically.
    - settings.manager.tolerations.effect
      
      string
    - settings.manager.tolerations.key
      
      string
    - settings.manager.tolerations.operator
      
      string
    - settings.manager.tolerations.tolerationSeconds
      
      integer
    - settings.manager.tolerations.value
      
      string
- settings.scanner
  
  object
  Configuration for the NeuVector scanner component.
  
  The scanner performs vulnerability scanning of container images and registries.
  - settings.scanner.nodeSelector
    
    object
    Node selector for scanner pods.
    
    Example:
    disktype: ssd
  - settings.scanner.tolerations
    
    array of objects
    The same as in the Pods’ spec.tolerations parameter in Kubernetes.
    
    If the parameter is omitted or false, it will be determined automatically.
    - settings.scanner.tolerations.effect
      
      string
    - settings.scanner.tolerations.key
      
      string
    - settings.scanner.tolerations.operator
      
      string
    - settings.scanner.tolerations.tolerationSeconds
      
      integer
    - settings.scanner.tolerations.value
      
      string

Enabling NeuVector

Authentication

Requirements

Parameters

An error has occurred

Tell us what you didn’t like.

Configuration

Enabling NeuVector

Authentication

Requirements

Parameters

An error has occurred

Tell us what you didn’t like.

Request trial access

Thank you

Error

Request callback

Thank you

Something went wrong

Book your sessions

Thank you

Error

Request demo

Thank you

Error

Get the PCI SSC Compliance Report

Thank you

Error