rancher-users #neuvector-security

Docs

Join the conversation Join Slack

Channels

neuvector-security

full-lawyer-94872

03/05/2023, 3:01 AM

Hello Team, found some confusions while checking some workloads in monitor mode.

full-lawyer-94872

03/05/2023, 3:01 AM

Scenario 1:

full-lawyer-94872

03/05/2023, 3:01 AM

Check network rule id: 27 in below screenshot

full-lawyer-94872

03/05/2023, 3:02 AM

Screenshot 2023-03-05 at 05.50.46.png

full-lawyer-94872

03/05/2023, 3:03 AM

It was first reported as a violation in security events while running in monitor mode and as it's a valid connections, I just added it as a rule.

full-lawyer-94872

03/05/2023, 3:04 AM

However when checking the rest of the rules, you can also notice that there was already a rule for this connection by id: 25444.

full-lawyer-94872

03/05/2023, 3:05 AM

id: 27 is more specific than id: 25444, but still how could this be detected as a violation when the connection is already in allow list?

full-lawyer-94872

03/05/2023, 3:06 AM

=========================

full-lawyer-94872

03/05/2023, 3:06 AM

Scenario 2:

full-lawyer-94872

03/05/2023, 3:08 AM

Check network rule id: 25 in below screenshot.

full-lawyer-94872

03/05/2023, 3:08 AM

Screenshot 2023-03-05 at 05.58.32.png

full-lawyer-94872

03/05/2023, 3:09 AM

It was first reported as a violation in security events while running in monitor mode and as it's a valid connections, I just added it as a rule. However when checking the rest of the rules, you can also notice that there was already a rule for this connection by id: 2.

full-lawyer-94872

03/05/2023, 3:10 AM

How could this too be detected as a violation when the connection is already in allow list?

full-lawyer-94872

03/07/2023, 10:48 AM

BTW, I would also like to know who exactly does this rule check, is it the enforcer ?

quaint-candle-18606

03/07/2023, 8:31 PM

Yes, Enforcers

👍 1

full-lawyer-94872

03/07/2023, 11:16 PM

BTW, there have been some controller memory pressure issues in the cluster for sometime now,

full-lawyer-94872

03/07/2023, 11:16 PM

Could that lead to this type of issue?

full-lawyer-94872

03/07/2023, 11:27 PM

Screenshot 2023-03-08 at 04.54.56.png

kind-church-47495

03/08/2023, 1:32 PM

Anyone able to help explain the delta in vulnerabilities reported under Assets -> Nodes and Security Risks -> Vulnerabilities? I show the count for the first page at 1811 high/ 1393 mediums and then there's only 200 highs / 145 mediums for the same node under security risks. the count also jumped up by like 400 after running an update... so that was strange as well.

full-lawyer-94872

03/13/2023, 3:32 PM

Folks, just seeing this confusion in between network rules and the graph on K8s api server connections.

full-lawyer-94872

03/13/2023, 3:32 PM

Screenshot 2023-03-13 at 05.24.13.png

full-lawyer-94872

03/13/2023, 3:34 PM

In above screenshot, you could see that there is only one network rule detected for K8s api server connections where as if I check the network graph at the same time, you could observe the following.

full-lawyer-94872

03/13/2023, 3:35 PM

Screenshot 2023-03-13 at 05.20.52.png

full-lawyer-94872

03/13/2023, 3:36 PM

The graph shows multiple K8s api server connections than the one that appear under network rules.

full-lawyer-94872

03/13/2023, 3:36 PM

Is this a bug?

full-lawyer-94872

03/13/2023, 3:37 PM

BTW, the version I am currently on is V5.1.1

full-lawyer-94872

03/14/2023, 2:21 PM

Also the action seems to be 'open' instead of the usual 'allow' action and the connection does not seem to hold a rule id too

full-lawyer-94872

03/14/2023, 2:21 PM

Screenshot 2023-03-14 at 19.45.16.png

full-lawyer-94872

03/14/2023, 2:25 PM

Is this expected and are K8s api server connections actually allowed and open by default?

full-lawyer-94872

03/22/2023, 4:06 AM

Hi Team, for a K8s cluster with ~20 nodes, each running ~100 pods, how should we plan on scaling the controller pods? Also is it ok to set up an HPA for this instead of going into a set of statically scaled up controllers?