Release notes

v1.1.3

Release date: 2026-08-27

Security fixes for module images: OpenVEX attestations mark golang.org/x/crypto GO-2026-5932 as not affected for the controller and module bundle hooks.

Highlights

Changes in this release:

• Module images publish OpenVEX attestations so CVE scans suppress GO-2026-5932 where openpgp is not on the execute path.

Security updates

Security updates in this release:

• Added OpenVEX statements for GO-2026-5932 (golang.org/x/crypto/openpgp) on the controller and module bundle (go-hooks), status not_affected / vulnerable_code_not_in_execute_path.
• Wired cosign OpenVEX attestation into the module build so CI CVE scans read the statements from the OCI registry.

v1.1.2

Release date: 2026-08-27

Alerting on security events: the new ClusterSecurityEventAlertRule resource counts matching events per key over a time window and raises an ordinary Prometheus alert once the threshold is reached. Adds an Http destination type for webhooks and HTTP collectors, and a new event for containerd integrity violations.

Highlights

Changes in this release:

• New ClusterSecurityEventAlertRule resource: describe which events to watch, how to count them, and what the alert should say.
• A firing rule raises the Prometheus alert D8SecurityEventAlertFiring, so it becomes a ClusterAlert object, shows up in the console next to every other alert, keeps its history and travels through the cluster’s existing alert delivery. There is nothing to configure for delivery.
• New Http destination type sends security events to any HTTP endpoint — a webhook or an HTTP collector — with authentication, TLS, custom headers and a choice of body framing.
• New security event D8_CONTAINERD_INTEGRITY_VIOLATION reports a containerd integrity check failure — most often an image refused at pull because its signature did not verify.

New features

This release adds:

• ClusterSecurityEventAlertRule (cluster-scoped, short name csear). spec.match selects events by event code, minimum severity, category, source component, actor and actor type; spec.aggregation groups them by groupBy and fires as soon as a group reaches threshold within window; spec.alert carries the summary, description, extra labels and the DKP severityLevel. A rule without aggregation alerts on every matched event.
• match.excludeSystemActors (enabled by default) keeps platform identities out of a rule, using the same list as the “Exclude system” filter of the console. Routine cluster work dominates the event stream — on an idle cluster the DKP ServiceAccount alone produced 2617 of 2812 secret reads in an hour — so without it the first rule anyone writes is an alert about the platform. match.excludeActors and match.actors take globs against actor.id for anything the built-in list does not cover.
• The alert resolves on its own about five minutes after the rule last fired. There is no field to set: the aggregator publishes security_events_alert_last_firing_timestamp_seconds, the moment a rule last fired, and D8SecurityEventAlertFiring tests the age of it. The metric is exported on the aggregator’s /alert-metrics/metrics endpoint and can be used in dashboards.
• New destination type Http: spec.http.endpoint with optional auth, tls and headers, and framing — JSONArray (default) for receivers that expect one document per request, NewlineDelimited for collectors that read NDJSON. The number of delivery attempts for one batch is bounded, so a receiver that keeps rejecting a request it will never accept cannot hold up everything queued behind it: once the attempts run out the batch is dropped into the sink’s error metrics, which the module already alerts on.
• New security event D8_CONTAINERD_INTEGRITY_VIOLATION (category Runtime, severity High, source containerd-integrity). It fires when containerd refuses an image whose signature does not verify, and when a file checksum on the node does not match the expected one. object.name carries the image reference, object.namespace the namespace it was being pulled into, and metadata.extra the message, the file path and the expected and actual hashes where the event provides them. Collected only on nodes running cri ContainerdV2 in the CSE edition; probe traffic from d8-upmeter is filtered out.
• kube-audit events now carry actor.sourceIP, the originating client address taken from the head of the request chain, next to the full actor.sourceIPs chain. Alert rules can group by it (ActorSourceIP), which is how a rule about unauthorized requests identifies the client when there is no identity to group on.
• The module runs a new single-replica alert-aggregator component that holds the counters, with its own alert D8SecurityEventsManagerAggregatorNotAvailable. While it is down, event collection and delivery continue — events wait in the gateway buffer — but counting windows restart, so a partially reached threshold begins from zero.

Improvements

This release improves:

• Transform source paths can address array elements, for example sourceIPs[0]. Previously every path segment was treated as a map key, so any array field in a log was unmappable.
• Module documentation, CRDs and OpenAPI schemas are now included in the bundle and release images.

Upgrade notes

Before upgrading, note the following:

• No configuration change is required. The alerting components are created on upgrade and stay idle until the first ClusterSecurityEventAlertRule exists. The alert-aggregator runs a single replica with a Recreate rollout by design — counters live in one process — so its updates and node drains produce a short gap in counting.

Known issues

Known limitations of this release:

• A rule can only match what the cluster’s audit policy records. The default DKP policy logs list of secrets but not a get of one secret by name, and drops most requests from system:authenticated, so a rule on K8S_SECRET_ACCESSED will not see d8 k get secret <name>. Check the audit policy before concluding that a rule does not work.
• Counters live in the aggregator’s memory. Restarting it starts every window from zero.
• Grouping by a value with unbounded cardinality is capped: past 500 distinct values for a label the tag is dropped and the alert still fires, one dimension poorer.
• On clusters with update.blockOnAlerts enabled in the deckhouse module, an alert at or below the configured level (4 by default) blocks DKP releases from being applied while it is firing. The severityLevel default of 6 stays out of the way; lower it deliberately.

Docs

Documentation changes:

• The examples page gained an alerting section with a rule per detection story: repeated exec into pods by one actor, a burst of RBAC edits grouped per actor and namespace, unauthorized requests grouped by client address, and a containerd integrity violation as the case where a single occurrence is enough. It also gained an HTTP destination example.

v1.0.5

Release date: 2026-08-24

Security fixes for module images: updated Go dependencies in batch hooks and related components to remediate known CVEs.

Highlights

Changes in this release:

• Module images include dependency updates that address known CVEs in Go components.

Security updates

Security updates in this release:

• Bumped golang.org/x/net and golang.org/x/text in hooks/batch and related Go images for CVE remediation.
• CVE-oriented security fixes included in the component images.

v1.0.4

Release date: 2026-08-18

Fixes an upgrade deadlock: the controller could not publish gateway configs and the gateway Deployment could not roll out.

Highlights

Changes in this release:

• The controller can publish the gateway Vector config again — its own validation step could never complete on real clusters.
• The gateway Deployment now rolls out on clusters with as many system nodes as replicas, instead of stalling on a Pending pod.
• A destination whose credential cannot be resolved no longer takes the whole gateway config down with it.
• Gateway reloader metrics are renamed to stop colliding with log-shipper’s.

Improvements

This release improves:

• New controller.vectorValidateTimeout parameter (default 60s) for the vector validate run the controller performs before publishing a gateway config.
• New alerts: D8SecurityEventsManagerControllerConfigNotPublished, D8SecurityEventsManagerDestinationCredentialMissing and D8SecurityEventsManagerControllerValidateUnavailable. Previously the controller could stop publishing configs indefinitely without any alert firing.

Fixes

This release fixes:

• The controller no longer freezes the published gateway config. Its vector validate step ran with a 10s timeout in a 64Mi container and was either killed by the deadline or OOM-killed, and the failure was treated as a verdict that the config was invalid, so the Secret stayed at its last revision permanently. Validation now runs with --no-environment (~2s instead of ~5s on a 256 KB config, no topology build and no network healthchecks), the container floor is 192Mi, the timeout default is 60s, and a check that cannot be executed no longer blocks publishing — the gateway reloader validates the config regardless.
• The gateway Deployment now uses maxSurge: 0 / maxUnavailable: 1. With the default surge, updating a 2-replica gateway asked for a third pod, and the required host anti-affinity meant that pod stayed Pending forever on a cluster with two system nodes: the module reported itself Deployed while still running the previous image.
• A ClusterSecurityEventDestination that declares a credential the controller cannot resolve now blocks publishing and reports the exact destination and field, instead of emitting an auth block without its token. Vector rejects such a block outright, which made the whole gateway config fail to load and stopped delivery to every destination, not just the affected one. Covers Loki, Elasticsearch, Splunk HEC and Kafka SASL.
• auth.strategy: None, the CRD default, no longer reaches the generated config as {"strategy": "none"}, which Vector does not accept.
• The controller Deployment now has a system node selector; it previously had none and could be scheduled onto worker nodes.
• The CI Vector validation test now validates the defaults.json the gateway image actually ships instead of a hand-written stand-in.

Breaking changes

Changes that affect backward compatibility:

• Gateway reloader metrics are renamed with a security_events_manager_gateway_ prefix: vector_config_validation_error, vector_config_apply_failures_total, vector_config_periodic_retry_attempts_total, vector_config_reloads_success_total, vector_config_last_reload_success_timestamp_seconds, reloader_validate_duration_seconds, reloader_validate_timeout_seconds, reloader_apply_duration_seconds, reloader_vector_restarts_total, reloader_fsnotify_events_total. The old names collided with log-shipper’s vector-reloader, whose alerting rules do not filter by namespace, so this module’s config problems fired D8LogShipperConfigInvalid. Module rules, dashboards and docs are updated; custom recording rules, alerts and panels built on the old names need updating.
• The CONTROLLER_VECTOR_VALIDATE_SKIP_ABOVE_BYTES environment variable is removed. Its 256 KiB threshold sat just above the real config size, so it was liable to skip validation by accident rather than by intent; the new fail-open behaviour covers the case it was meant to.
• The default minimalSeverity changed from Medium to Low in v1.0.3 without a release note. Clusters upgrading from v1.0.0 or earlier ship substantially more events than before, which interacts with the disk buffer defaults also introduced in v1.0.3. Set it explicitly if the previous volume is wanted.

Upgrade notes

Before upgrading, note the following:

• The controller container memory floor rises from 64Mi to 192Mi (VPA ceiling from 256Mi to 512Mi). This is what vector validate needs to run at all; below it the container is OOM-killed mid-validation.

v1.0.3

Release date: 2026-08-17

Gateway buffer configuration, enrichment plugins, SecretRefs for destinations, CEF/Socket sinks, and security hardening for the Vector gateway and controller RBAC.

Highlights

Changes in this release:

• Configurable Disk buffers for gateway and log-shipper layers, with per-destination overrides.
• Enrichment plugins (k8s-pod-info, k8s-container-info, k8s-nodeuser-info) via ClusterSecurityEventEnrichmentPlugin.
• Credentials for destinations can use SecretRefs instead of plaintext in the CR.
• CEF encoding and Socket destinations for SIEM integration.
• Gateway API bound to loopback; tighter Secret RBAC and SSRF checks on enrichment endpoints.

New features

This release adds:

• Configurable buffer settings: gateway.buffer and gateway.logShipperBuffer in module values; per-destination override via spec.buffer in ClusterSecurityEventDestination; default Disk + Block; maxSize requires a Kubernetes quantity with a unit suffix (for example 512Mi).
• Event K8S_ADMISSION_POLICY_DENIED for admission-policy-engine denials in the Kubernetes audit log.
• CRD ClusterSecurityEventEnrichmentPlugin for built-in Internal enrichment plugins served by the enrichment-cache sidecar (External plugins are in the schema but not wired yet).
• Enrichment plugins k8s-pod-info, k8s-container-info, and k8s-nodeuser-info.
• tokenSecretRef and passwordSecretRef on ClusterSecurityEventDestination for Loki, Elasticsearch, Kafka SASL, and Splunk HEC; built-in cluster-loki stores its token in a Secret.
• CEF encoding for Kafka, Vector, File, and Console destinations (encoding.codec: CEF), optional syslog wrapping, and default CEF metadata via spec.cef / module values.
• Socket destination type (TCP/UDP/Unix) for CEF-over-syslog to SIEM systems.

Fixes

This release fixes:

• Fixed the D8SecurityEventsManagerControllerReconcileErrorsHigh alert.
• gateway.reloaderValidateTimeout configures the Vector validate timeout (default 120s) so large gateway configs do not fail with a silent timeout.
• TLS Secrets in d8-log-shipper are cleaned up when the related SecurityEventDefinition is deleted.
• Credential Secret resolution failures are logged at warning with field path context.
• Credential Secret watcher uses label security-events-manager.deckhouse.io/credential-secret: true instead of watching all Secrets.
• Reloader SaveTo() writes the Vector config with mode 0600.
• resolveDestinationSecretRefs() returns a deep copy so credentials stay fresh after Secret rotation.
• Lua extractJSON returns nil and logs when cjson is unavailable (no fragile regex fallback).
• Corrected the enrichment-cache port comment (9260 → 9261).
• E2E triggers for K8S_CLUSTERROLEBINDING_DELETED and K8S_CONFIGMAP_MODIFIED create the test namespace and guard CRB delete against 404 races.
• Controller-created Secrets and log-shipper CRs include the heritage: deckhouse label.

Security updates

Security updates in this release:

• Fixed CVEs in module images.
• Vector gateway API listens on 127.0.0.1:8686 only; port 8686 removed from the Service.
• mTLS client private key is stored in a Secret in d8-log-shipper, not embedded in ClusterLogDestination.
• Controller Secret RBAC limited to d8-security-events-manager and d8-log-shipper.
• CEL blocks SSRF on ClusterSecurityEventEnrichmentPlugin spec.endpoint.url.
• gateway-vector-config Secret annotated with security.deckhouse.io/contains-credentials: true.

Breaking changes

Changes that affect backward compatibility:

• Shipper enrich shape: plugin is a free-form string; args is an ordered {key,value} array; plugin names use hyphens (k8s-pod-info). Old CRs with the previous shape fail to parse; Plugin enrichment was not functional before.
• spec.splunkHEC.token is optional when tokenSecretRef is set.
• CEL enforces mutual exclusivity of inline token/password and their *SecretRef counterparts on ClusterSecurityEventDestination.

v1.0.0

Release date: 2026-06-26

Initial release of the security-events-manager module.

Highlights

Changes in this release:

• First public release of the module.