I have a couple of questions about deploying neuvector concerning the helm chart. Ultimately, I will deploy neuvector using Argo CD, however for now I am using straight helm. 1. Why is NeuVector deploying Leases by default? Argo CD 3.0+ hardcodes an exclusion for Lease objects claiming they are not really in the GitOps space and should be dynamically as part of the K8s control plane lifecycle. When deploying the chart in Argo CD, I get an warning. I realize there is a flag to disable the leases but why have them defined explicitly? 2. The apisvc and ingress are mutually exclusive meaning the ingress can be create with out the controller-api service with throws and error. 3. The backend protocol defaults to HTTPS which should be driven by a separate key like

manager.env.ssl: false

or the internal certificate section. Our cluster only has internal access. 4. Because the controller-api has no way to change to to change the backend protocol, we have to disable apisvc and create it using an additional-source on Argo CD. 5. the bootstrapPasssword doesnto behave as adveritized. If you activate it it still wants the password to be reset upon initial login. Further, it assumes the value is a plain string making the use of an external secret store unusable. The only way to use this feature is to random generate the password, reset it at initial login, and then store it in AWS Secrets Manager for future reference. Not kewl.

Hey David. 1 - Leases is an object that is used to define the leader of a set of pods. In the case of controller we use Leases to define which one of the 3 controller pods is going to be the leader. There is an open bug on ArgoCD about this leases topic https://github.com/argoproj/argo-cd/issues/12722. Since a couple of versions ago we support deploying NeuVector by disabling the leases flag. You should try that. 2 - If you want to define ingress you must define controller.apisvc.type as ingress needs a service where to redirect the request. 3 - https://open-docs.neuvector.com/configuration/console/#enabling-http-for-manager I think this documentation can help you with it. 4 - This is indeed weird as I've been able to access controller-api service without https/tls on my lab which is making me think that controller api is accessible without TLS cert

k get ingress -n cattle-neuvector-system neuvector-restapi-ingress
NAME                        CLASS    HOSTS                                  ADDRESS                                    PORTS   AGE
neuvector-restapi-ingress   <none>   <http://neuvector-api.209.38.180.34.sslip.io|neuvector-api.209.38.180.34.sslip.io>   138.68.68.112,161.35.77.3,164.92.167.242   80      30m

curl --tlsv1.2 -k -H "Content-Type: application/json" -d '{"password": {"username": "admin", "password": "XXXX"}}' "<https://neuvector-api.209.38.180.34.sslip.io/v1/auth>" 
{"need_to_reset_password":false,"password_days_until_expire":-1,"password_hours_until_expire":0,"token":{"blocked_for_failed_login":false,"blocked_for_password_expired":false,"default_password":false,"domain_permissions":{},"email":"","fullname":"admin","global_permissions":[{"id":"ci_scan","read":false,"write":true},{"id":"admctrl","read":true,"write":true},{"id":"events","read":true,"write":false},{"id":"authentication","read":true,"write":true},{"id":"nv_resource","read":true,"write":true},{"id":"reg_scan","read":true,"write":true},{"id":"rt_policy","read":true,"write":true},{"id":"security_events","read":true,"write":false},{"id":"vulnerability","read":true,"write":true},{"id":"rt_scan","read":true,"write":true},{"id":"audit_events","read":true,"write":false},{"id":"authorization","read":true,"write":true},{"id":"config","read":true,"write":true},{"id":"compliance","read":true,"write":true}],"last_login_at":"2025-11-06T09:16:07Z","last_login_timestamp":1762420567,"locale":"en","login_count":5,"modify_password":false,"password":"","password_resettable":false,"role":"admin","role_domains":{},"server":"","timeout":300,"token":XXXXXXX","username":"admin"}}

5 - You might want to to take a look at the configmap neuvector feature to be able to make configurations during startups or complete restart. https://open-docs.neuvector.com/deploying/production/configmap/

1. I have sen that ArgoCD issue and I don think it is a bug as it was intentionally added in Argo CD 3.0> The GitOps puritans claim lease are not GitOps object as they are typically created dynamically ny K8s. Luckily, there is a flag in the chart which we are disabling. 2. If that is indeed behavior, what I was pointing out is they should be linked. if you define a ingress the apisvc is set with some default type one can override. 3. The chart provides manager.env.ssl which we are using. 4. When we first deployed this, our ingresses were created but the URL did. not resolve. We hit the endpoint inside the cluster and found the endpoint had a self signed cert. Further inspection shod the services were had a backend protocol of HTTPS but way to override it like manager. 5. Are you referring to the passwordprofileinitcfg section? Which flag controls this. from. Google search: “NeuVector does not have a specific configuration setting in a ConfigMap to “disable password reset” in the sense of preventing a user from ever resetting their password via a self-service mechanismNeuVector does not have a specific configuration setting in a ConfigMap to “disable password reset” in the sense of preventing a user from ever resetting their password via a self-service mechanismNeuVector does not have a specific configuration setting in a ConfigMap to “disable password reset” in the sense of preventing a user from ever resetting their password via a self-service mechanism.NeuVector does not have a specific configuration setting in a ConfigMap to “disable password reset” in the sense of preventing a user from ever resetting their password via a self-service mechanism” What I am suggesting is true ESO support. Thanks for your answers - I really appreciate it