👋 Hello, team! Happy to join the community!

Regarding NeuVector deployments, has anybody got a better idea on setting up CPU/Memory requests and limits for the below workloads ?

[1] enforcer-pod, [2] controller-pod, [3] manager-pod, [4] updater-pod, [5] scanner-pod

@full-lawyer-94872 Typically ~1Gi ram each, but you’ll want to make sure overhead is available in the scanner for your largest imag + .5 Gi

per https://open-docs.neuvector.com/basics/requirements#system-requirements

There are also some rem’ed examples in the helm values file. 🙂

@brainy-match-59359 has left the channel

@rich-microphone-27545 has left the channel

Hey everyone, is there any way to deep link into a container image scan result? In particular, I'm thinking about the attached screen:

Hi, I'd opened the issue https://github.com/neuvector/neuvector/issues/666 before I realised there was a slack channel, and wondered if anyone had any insights. Essentially, certain features in neuvector appear only to apply to users bound to the global admin role, but not to the namespaced admin role. An example is vulnerability profiles. Users bound to the global admin role can create and view them, users bound to namespaced admin roles can't, even for resources in their namespace. Anyone got any advice on how to enable these features for namespaced admins or on exactly how we should be using neuvector in a multitennancy setup when certain very useful tools aren't available to us?

Hello Team, During a deployment security review of NeuVector on top of K8s, we came up with the query of setting up appropriate network policies for a NeuVector deployment. What would be your advice on the ingresses and egresses that should be allow-listed? FYI: It's also a multi-cluster deployment that we are hoping to set up.

As per https://open-docs.neuvector.com/basics/overview#architecture Following are my assumptions on the connections of each workload.

Screenshot 2023-02-21 at 18.05.15.png

Appreciate if this could be verified.

In ref: https://rancher-users.slack.com/archives/C036F6JDZ8C/p1676852753992889

https://rancher-users.slack.com/archives/C036F6JDZ8C/p1676638872141389 nudging this in case anyone has any ideas

Serious question, are issues on the github actually getting looked at? There are open issues from over a year ago and I haven't seen any confirmation that my issue has even been seen.

Hi all, wondering if anyone is able to assist, running into a strange SSL/Java error on NeuVector manager when attempting to install from helm chart 2023-02-23 220911,789|INFO |MANAGER|com.neu.web.Rest$(sslContext:31): Import manager's certificate and private key to manager's keystore 2023-02-23 220911,799|INFO |MANAGER|com.neu.web.Rest$(sslContext:53): PKCS#8 private key is being used Exception in thread "main" java.lang.ExceptionInInitializerError at com.neu.web.Rest.main(Rest.scala) Caused by: java.lang.ClassCastException: class sun.security.pkcs11.P11Key$P11PrivateKey cannot be cast to class java.security.interfaces.RSAPrivateKey (sun.security.pkcs11.P11Key$P11PrivateKey is in module jdk.crypto.cryptoki of loader 'platform'; java.security.interfaces.RSAPrivateKey is in module java.base of loader 'bootstrap') at com.neu.core.MySslConfiguration$class.sslContext(MySslConfiguration.scala:62) at com.neu.web.Rest$.sslContext(Rest.scala:6) at com.neu.core.MySslConfiguration$class.$init$(MySslConfiguration.scala:153) at com.neu.web.Rest$.<init>(Rest.scala:6) at com.neu.web.Rest$.<clinit>(Rest.scala) I submitted also a github issue: https://github.com/neuvector/neuvector/issues/672

Hello Team, Quick question on NeuVector network rules.

Can NeuVector network rules in any mode co-exist together with K8s NetPols or do we expect a clean cluster with no K8s NetPols at all to get the use of NeuVector network rules?

They can certainly coexist, but you’d have to be mindful of managing things in two places. Best practice would be to go with your latter suggestion of letting NeuVector manage rules. It’s more comprehensive and less effort.

Also, one good thing about K8s network policies is that we can apply a default deny all policy for any unknown workload inside a namespace which would effectively block malicious workloads from badly exploiting the network. I wonder how this same functionality can be achieved using NeuVector network rules as they are effectively defined per workload groups.

That’s how Neuvector works: There’s an implicit deny:deny (to use my old firewall parlance)

The rules you define in Neuvector are designed to be a narrow scope of explicit allow rules. You can then decide to alert (Monitor mode) on rule violations or alert and deny (Protect mode)

🦜 actual zero-trust

@quaint-candle-18606 Yes, an implicit deny is true for any specific workload for which we have explicitly defined an allow list. But imagine any unintentional workload that might straightway get introduced into production in the usual discover mode. I wonder if new services mode being "protect" would be the way to achieve the same blocking mode functionality that a default deny all K8s netpol provides.

Yes, I’d pursue that route. On the prod cluster, make sure that the New Services Mode is set to Protect, or at least Monitor

A best practice would be to establish those rules in a non-prod environment, then ship the rules as CRDs to the production cluster for any groups you choose.

It’s actually a lot easier than the docs make it look. 😆

Yep, Agreed, that would be the exact plan for workloads that are already known to us 🙂