greetings! I’m currently evaluating neuvector for our company and got a bit stuck when reading the docs. I was thinking about managing rules via custom groups (for example all container with image redis) and define rules and then set protect mode but the docs clearly state that we cannot change the mode for custom groups because the group might have members from different namespaces and/or deployments…*but that is exactly what we want.* Is there a oppiniated way of managing this? As of now all I’m seeing is we need to interact with the automagically created groups from NV to then say we only allow the redis process to run in all containers with image redis…but as I’m looking at my NV UI I don’t see a group for all container with redis image but multiple groups all with 1 member and names nv.xxxredis.xxx So TLDR.: how are we supposed to built dedicated groups with rules and manage the mode for these groups without having to set the rules on every possible automagically created group which then need to have a mode set?

@future-smartphone-18156 FYI ☝️ 😉

@quaint-candle-18606 first of, great Rodeo! 👏 Maybe I should rephrase it a little, I don’t understand the feature to create custom groups where we can add rules for processes/network/etc. but we cannot manage the actual mode this group behaves in. Although after the rodeo maybe I had the wrong idea as the goal for NV should be to end up having all the deployments in protected mode anyway i suppose🤔

yea, I think this will require you to re-think the application a little bit. There is no way to do it the way you are thinking. If a custom group is an umbrella above a few

Learned

groups. The way processes and network rules will be enforced would be based on a child group's mode. The better way to do it - to have groups defined as CRDs - this way you have a full control of what mode they are in and what processes are allowed to run on them. You could define like a template for any image that has image redis and then use that to create your YAMLs. Those YAMLs will end up in your repo and then you will use Fleet/ArgoCD/FluxCD to deploy them into the cluster. Now you can have processes in Protect Mode right away, and then Network will be in Discover, once Network Rules get learned - you can add them to the CRD file. Now the question - are your redis pods so locked out that they only run redis process and nothing else?

yeah that makes more sense, I will try that out the coming days - redis was just an example but we had specialised images from inhouse developers where security incidents occurred in the past. I’m just trying to think of a good way to implement a “kill-switch” for dedicated resources in an environment where complete protect mode just isn’t welcomed yet because of routines and incident management processes. I’m gonna rethink my ideas and questions and will try out your suggestion for now, thanks! 🙂

My pleasure!

@astonishing-lizard-40705 That's a very common challenge. 😉