Release notes

v1.0.4

Release date: 2026-08-18

Fixes an upgrade deadlock: the controller could not publish gateway configs and the gateway Deployment could not roll out.

Highlights

Changes in this release:

• The controller can publish the gateway Vector config again — its own validation step could never complete on real clusters.
• The gateway Deployment now rolls out on clusters with as many system nodes as replicas, instead of stalling on a Pending pod.
• A destination whose credential cannot be resolved no longer takes the whole gateway config down with it.
• Gateway reloader metrics are renamed to stop colliding with log-shipper’s.

Improvements

This release improves:

• New controller.vectorValidateTimeout parameter (default 60s) for the vector validate run the controller performs before publishing a gateway config.
• New alerts: D8SecurityEventsManagerControllerConfigNotPublished, D8SecurityEventsManagerDestinationCredentialMissing and D8SecurityEventsManagerControllerValidateUnavailable. Previously the controller could stop publishing configs indefinitely without any alert firing.

Fixes

This release fixes:

• The controller no longer freezes the published gateway config. Its vector validate step ran with a 10s timeout in a 64Mi container and was either killed by the deadline or OOM-killed, and the failure was treated as a verdict that the config was invalid, so the Secret stayed at its last revision permanently. Validation now runs with --no-environment (~2s instead of ~5s on a 256 KB config, no topology build and no network healthchecks), the container floor is 192Mi, the timeout default is 60s, and a check that cannot be executed no longer blocks publishing — the gateway reloader validates the config regardless.
• The gateway Deployment now uses maxSurge: 0 / maxUnavailable: 1. With the default surge, updating a 2-replica gateway asked for a third pod, and the required host anti-affinity meant that pod stayed Pending forever on a cluster with two system nodes: the module reported itself Deployed while still running the previous image.
• A ClusterSecurityEventDestination that declares a credential the controller cannot resolve now blocks publishing and reports the exact destination and field, instead of emitting an auth block without its token. Vector rejects such a block outright, which made the whole gateway config fail to load and stopped delivery to every destination, not just the affected one. Covers Loki, Elasticsearch, Splunk HEC and Kafka SASL.
• auth.strategy: None, the CRD default, no longer reaches the generated config as {"strategy": "none"}, which Vector does not accept.
• The controller Deployment now has a system node selector; it previously had none and could be scheduled onto worker nodes.
• The CI Vector validation test now validates the defaults.json the gateway image actually ships instead of a hand-written stand-in.

Breaking changes

Changes that affect backward compatibility:

• Gateway reloader metrics are renamed with a security_events_manager_gateway_ prefix: vector_config_validation_error, vector_config_apply_failures_total, vector_config_periodic_retry_attempts_total, vector_config_reloads_success_total, vector_config_last_reload_success_timestamp_seconds, reloader_validate_duration_seconds, reloader_validate_timeout_seconds, reloader_apply_duration_seconds, reloader_vector_restarts_total, reloader_fsnotify_events_total. The old names collided with log-shipper’s vector-reloader, whose alerting rules do not filter by namespace, so this module’s config problems fired D8LogShipperConfigInvalid. Module rules, dashboards and docs are updated; custom recording rules, alerts and panels built on the old names need updating.
• The CONTROLLER_VECTOR_VALIDATE_SKIP_ABOVE_BYTES environment variable is removed. Its 256 KiB threshold sat just above the real config size, so it was liable to skip validation by accident rather than by intent; the new fail-open behaviour covers the case it was meant to.
• The default minimalSeverity changed from Medium to Low in v1.0.3 without a release note. Clusters upgrading from v1.0.0 or earlier ship substantially more events than before, which interacts with the disk buffer defaults also introduced in v1.0.3. Set it explicitly if the previous volume is wanted.

Upgrade notes

Before upgrading, note the following:

• The controller container memory floor rises from 64Mi to 192Mi (VPA ceiling from 256Mi to 512Mi). This is what vector validate needs to run at all; below it the container is OOM-killed mid-validation.

v1.0.3

Release date: 2026-08-17

Gateway buffer configuration, enrichment plugins, SecretRefs for destinations, CEF/Socket sinks, and security hardening for the Vector gateway and controller RBAC.

Highlights

Changes in this release:

• Configurable Disk buffers for gateway and log-shipper layers, with per-destination overrides.
• Enrichment plugins (k8s-pod-info, k8s-container-info, k8s-nodeuser-info) via ClusterSecurityEventEnrichmentPlugin.
• Credentials for destinations can use SecretRefs instead of plaintext in the CR.
• CEF encoding and Socket destinations for SIEM integration.
• Gateway API bound to loopback; tighter Secret RBAC and SSRF checks on enrichment endpoints.

New features

This release adds:

• Configurable buffer settings: gateway.buffer and gateway.logShipperBuffer in module values; per-destination override via spec.buffer in ClusterSecurityEventDestination; default Disk + Block; maxSize requires a Kubernetes quantity with a unit suffix (for example 512Mi).
• Event K8S_ADMISSION_POLICY_DENIED for admission-policy-engine denials in the Kubernetes audit log.
• CRD ClusterSecurityEventEnrichmentPlugin for built-in Internal enrichment plugins served by the enrichment-cache sidecar (External plugins are in the schema but not wired yet).
• Enrichment plugins k8s-pod-info, k8s-container-info, and k8s-nodeuser-info.
• tokenSecretRef and passwordSecretRef on ClusterSecurityEventDestination for Loki, Elasticsearch, Kafka SASL, and Splunk HEC; built-in cluster-loki stores its token in a Secret.
• CEF encoding for Kafka, Vector, File, and Console destinations (encoding.codec: CEF), optional syslog wrapping, and default CEF metadata via spec.cef / module values.
• Socket destination type (TCP/UDP/Unix) for CEF-over-syslog to SIEM systems.

Fixes

This release fixes:

• Fixed the D8SecurityEventsManagerControllerReconcileErrorsHigh alert.
• gateway.reloaderValidateTimeout configures the Vector validate timeout (default 120s) so large gateway configs do not fail with a silent timeout.
• TLS Secrets in d8-log-shipper are cleaned up when the related SecurityEventDefinition is deleted.
• Credential Secret resolution failures are logged at warning with field path context.
• Credential Secret watcher uses label security-events-manager.deckhouse.io/credential-secret: true instead of watching all Secrets.
• Reloader SaveTo() writes the Vector config with mode 0600.
• resolveDestinationSecretRefs() returns a deep copy so credentials stay fresh after Secret rotation.
• Lua extractJSON returns nil and logs when cjson is unavailable (no fragile regex fallback).
• Corrected the enrichment-cache port comment (9260 → 9261).
• E2E triggers for K8S_CLUSTERROLEBINDING_DELETED and K8S_CONFIGMAP_MODIFIED create the test namespace and guard CRB delete against 404 races.
• Controller-created Secrets and log-shipper CRs include the heritage: deckhouse label.

Security updates

Security updates in this release:

• Fixed CVEs in module images.
• Vector gateway API listens on 127.0.0.1:8686 only; port 8686 removed from the Service.
• mTLS client private key is stored in a Secret in d8-log-shipper, not embedded in ClusterLogDestination.
• Controller Secret RBAC limited to d8-security-events-manager and d8-log-shipper.
• CEL blocks SSRF on ClusterSecurityEventEnrichmentPlugin spec.endpoint.url.
• gateway-vector-config Secret annotated with security.deckhouse.io/contains-credentials: true.

Breaking changes

Changes that affect backward compatibility:

• Shipper enrich shape: plugin is a free-form string; args is an ordered {key,value} array; plugin names use hyphens (k8s-pod-info). Old CRs with the previous shape fail to parse; Plugin enrichment was not functional before.
• spec.splunkHEC.token is optional when tokenSecretRef is set.
• CEL enforces mutual exclusivity of inline token/password and their *SecretRef counterparts on ClusterSecurityEventDestination.

v1.0.0

Release date: 2026-06-26

Initial release of the security-events-manager module.

Highlights

Changes in this release:

• First public release of the module.