Channels
#neuvector-security
- f
full-lawyer-94872
03/03/2023, 11:24 PM - f
full-lawyer-94872
03/03/2023, 11:25 PM[2] https://open-docs.neuvector.com/deploying/kubernetes Step number 6 - f
full-lawyer-94872
03/03/2023, 11:27 PMBut if we could have achieved the same with some pre-configuration and just using the helm chart and may be a bash, things could have been a lot easier even for automation. - q
quaint-candle-18606
03/04/2023, 11:33 PMThink about what you are risking vs what you are saving (?) by not deploying a Manager to each cluster. Recommend deploying a Manager unless there’s a profoundly compelling reason not to. - f
full-lawyer-94872
03/05/2023, 12:23 AMHow about we deploy manager and scale down to zero until we might need it back? - q
quaint-candle-18606
03/05/2023, 2:28 AMGiven the scenario you outlined above, that sounds indeed doable.👍 2 - f
full-lawyer-94872
03/05/2023, 3:01 AMHello Team, found some confusions while checking some workloads in monitor mode. - f
full-lawyer-94872
03/05/2023, 3:01 AMScenario 1: - f
full-lawyer-94872
03/05/2023, 3:01 AMCheck network rule id: 27 in below screenshot - f
full-lawyer-94872
03/05/2023, 3:02 AMScreenshot 2023-03-05 at 05.50.46.png - f
full-lawyer-94872
03/05/2023, 3:03 AMIt was first reported as a violation in security events while running in monitor mode and as it's a valid connections, I just added it as a rule. - f
full-lawyer-94872
03/05/2023, 3:04 AMHowever when checking the rest of the rules, you can also notice that there was already a rule for this connection by id: 25444. - f
full-lawyer-94872
03/05/2023, 3:05 AMid: 27 is more specific than id: 25444, but still how could this be detected as a violation when the connection is already in allow list? - f
full-lawyer-94872
03/05/2023, 3:06 AM========================= - f
full-lawyer-94872
03/05/2023, 3:06 AMScenario 2: - f
full-lawyer-94872
03/05/2023, 3:08 AMCheck network rule id: 25 in below screenshot. - f
full-lawyer-94872
03/05/2023, 3:08 AMScreenshot 2023-03-05 at 05.58.32.png - f
full-lawyer-94872
03/05/2023, 3:09 AMIt was first reported as a violation in security events while running in monitor mode and as it's a valid connections, I just added it as a rule. However when checking the rest of the rules, you can also notice that there was already a rule for this connection by id: 2.kq- 3
- 21
- f
full-lawyer-94872
03/05/2023, 3:10 AMHow could this too be detected as a violation when the connection is already in allow list? - f
full-lawyer-94872
03/07/2023, 10:48 AMBTW, I would also like to know who exactly does this rule check, is it the enforcer ? - q
quaint-candle-18606
03/07/2023, 8:31 PMYes, Enforcers👍 1 - f
full-lawyer-94872
03/07/2023, 11:16 PMBTW, there have been some controller memory pressure issues in the cluster for sometime now, - f
full-lawyer-94872
03/07/2023, 11:16 PMCould that lead to this type of issue? - f
full-lawyer-94872
03/07/2023, 11:27 PMScreenshot 2023-03-08 at 04.54.56.pngq- 2
- 14
- k
kind-church-47495
03/08/2023, 1:32 PMAnyone able to help explain the delta in vulnerabilities reported under Assets -> Nodes and Security Risks -> Vulnerabilities? I show the count for the first page at 1811 high/ 1393 mediums and then there's only 200 highs / 145 mediums for the same node under security risks. the count also jumped up by like 400 after running an update... so that was strange as well.q- 2
- 4
- f
full-lawyer-94872
03/13/2023, 3:32 PMFolks, just seeing this confusion in between network rules and the graph on K8s api server connections. - f
full-lawyer-94872
03/13/2023, 3:32 PMScreenshot 2023-03-13 at 05.24.13.png - f
full-lawyer-94872
03/13/2023, 3:34 PMIn above screenshot, you could see that there is only one network rule detected for K8s api server connections where as if I check the network graph at the same time, you could observe the following. - f
full-lawyer-94872
03/13/2023, 3:35 PMScreenshot 2023-03-13 at 05.20.52.png - f
full-lawyer-94872
03/13/2023, 3:36 PMThe graph shows multiple K8s api server connections than the one that appear under network rules.