NeuVector-开源容器安全平台

NeuVector
https://github.com/neuvector/neuvector-helm
https://github.com/neuvector/neuvector
https://open-docs.neuvector.com/basics/overview

设置中文

安装部署

helm repo add neuvector https://neuvector.github.io/neuvector-helm/
helm search repo neuvector/core

kubectl create namespace neuvector

[root@UR-20210425NAMA ~]# helm install neuvector --namespace neuvector neuvector/core
NAME: neuvector
LAST DEPLOYED: Tue Feb 22 15:10:14 2022
NAMESPACE: neuvector
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Get the NeuVector URL by running these commands:
  NODE_PORT=$(kubectl get --namespace neuvector -o jsonpath="{.spec.ports[0].nodePort}" services neuvector-service-webui)
  NODE_IP=$(kubectl get nodes --namespace neuvector -o jsonpath="{.items[0].status.addresses[0].address}")
  echo https://$NODE_IP:$NODE_PORT
[root@UR-20210425NAMA ~]#

kubectl set image deployment.apps/neuvector-controller-pod *=neuvector/controller.preview:5.0.0-preview.2 -n neuvector
kubectl set image deployment.apps/neuvector-manager-pod *=neuvector/manager.preview:5.0.0-preview.2 -n neuvector
kubectl set image deployment.apps/neuvector-scanner-pod *=neuvector/scanner.preview:latest -n neuvector
kubectl set image daemonset.apps/neuvector-enforcer-pod *=neuvector/enforcer.preview:5.0.0-preview.2 -n neuvector
kubectl get cronjob/neuvector-updater-pod -n neuvector -o yaml | sed 's#image: registry.neuvector.com/updater:latest#image: neuvector/updater.preview:latest#' | kubectl replace -f -

修改镜像版本

[root@UR-20210425NAMA ~]# ls -l core-1.9.1.tgz
-rw-r--r-- 1 root root 14393 Mar  3 10:21 core-1.9.1.tgz
[root@UR-20210425NAMA ~]# tar xf core-1.9.1.tgz
[root@UR-20210425NAMA ~]# cd core/
[root@UR-20210425NAMA core]# ls -l
total 32
-rwxr-xr-x 1 root root   285 Feb 19 15:43 Chart.yaml
-rwxr-xr-x 1 root root 16378 Feb 19 15:43 README.md
drwxr-xr-x 1 root root  4096 Mar  3 10:22 templates
-rwxr-xr-x 1 root root  6550 Feb 19 15:43 values.yaml
[root@UR-20210425NAMA core]# cat values.yaml
# Default values for neuvector.
# This is a YAML-formatted file.
# Declare variables to be passed into the templates.
openshift: false
registry: registry.neuvector.com
tag: 4.4.4
oem:
imagePullSecrets:
psp: false
serviceAccount: default
controller:
  # If false, controller will not be installed
  enabled: true
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  image:
    repository: neuvector/controller
    hash:
  replicas: 3
  disruptionbudget: 0
  schedulerName:
  priorityClassName:
  env: []
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: app
              operator: In
              values:
              - neuvector-controller-pod
          topologyKey: "kubernetes.io/hostname"
  tolerations: []
  nodeSelector: {}
    # key1: value1
    # key2: value2
  apisvc:
    type:
    annotations: {}
    # OpenShift Route configuration
    route:
      enabled: false
      termination: passthrough
      host:
  pvc:
    enabled: false
    accessModes:
      - ReadWriteMany
    storageClass:
    capacity:
  azureFileShare:
    enabled: false
    secretName:
    shareName:
  certificate:
    secret:
    keyFile: tls.key
    pemFile: tls.pem
  federation:
    mastersvc:
      type:
      # Federation Master Ingress
      ingress:
        enabled: false
        host:  # MUST be set, if ingress is enabled
        path: "/"  # or this could be "/api", but might need "rewrite-target" annotation
        annotations:
          ingress.kubernetes.io/protocol: https
          # ingress.kubernetes.io/rewrite-target: /
        tls: false
        secretName:
      # OpenShift Route configuration
      route:
        enabled: false
        termination: passthrough
        host:
    managedsvc:
      type:
      # Federation Managed Ingress
      ingress:
        enabled: false
        host:  # MUST be set, if ingress is enabled
        path: "/"  # or this could be "/api", but might need "rewrite-target" annotation
        annotations:
          ingress.kubernetes.io/protocol: https
          # ingress.kubernetes.io/rewrite-target: /
        tls: false
        secretName:
      # OpenShift Route configuration
      route:
        enabled: false
        termination: passthrough
        host:
  ingress:
    enabled: false
    host:  # MUST be set, if ingress is enabled
    path: "/"  # or this could be "/api", but might need "rewrite-target" annotation
    annotations:
      ingress.kubernetes.io/protocol: https
      # ingress.kubernetes.io/rewrite-target: /
    tls: false
    secretName:
  resources: {}
    # limits:
    #   cpu: 400m
    #   memory: 2792Mi
    # requests:
    #   cpu: 100m
    #   memory: 2280Mi
  configmap:
    enabled: false
    data:
      # eulainitcfg.yaml: |
      #  ...
      # ldapinitcfg.yaml: |
      #  ...
      # oidcinitcfg.yaml: |
      # ...
      # samlinitcfg.yaml: |
      # ...
      # sysinitcfg.yaml: |
      # ...
      # userinitcfg.yaml: |
      # ...
  secret:
    # NOTE: files defined here have preferrence over the ones defined in the configmap section
    enabled: false
    data: {}
      # eulainitcfg.yaml:
      #   license_key: 0Bca63Iy2FiXGqjk...
      #   ...
      # ldapinitcfg.yaml:
      #   directory: OpenLDAP
      #   ...
      # oidcinitcfg.yaml:
      #   Issuer: https://...
      #   ...
      # samlinitcfg.yaml:
      #   ...
      # sysinitcfg.yaml:
      #   ...
      # userinitcfg.yaml:
      #   ...
enforcer:
  # If false, enforcer will not be installed
  enabled: true
  image:
    repository: neuvector/enforcer
    hash:
  priorityClassName:
  tolerations:
    - effect: NoSchedule
      key: node-role.kubernetes.io/master
  resources: {}
    # limits:
    #   cpu: 400m
    #   memory: 2792Mi
    # requests:
    #   cpu: 100m
    #   memory: 2280Mi
manager:
  # If false, manager will not be installed
  enabled: true
  image:
    repository: neuvector/manager
    hash:
  priorityClassName:
  env:
    ssl: true
  svc:
    type: NodePort
    loadBalancerIP:
    annotations: {}
      # azure
      # service.beta.kubernetes.io/azure-load-balancer-internal: "true"
      # service.beta.kubernetes.io/azure-load-balancer-internal-subnet: "apps-subnet"
  # OpenShift Route configuration
  route:
    enabled: true
    termination: passthrough
    host:
  certificate:
    secret:
    keyFile: tls.key
    pemFile: tls.pem
  ingress:
    enabled: false
    host:  # MUST be set, if ingress is enabled
    path: "/"
    annotations: {}
      # kubernetes.io/ingress.class: my-nginx
      # nginx.ingress.kubernetes.io/whitelist-source-range: "1.1.1.1"
      # nginx.ingress.kubernetes.io/rewrite-target: /
      # nginx.ingress.kubernetes.io/enable-rewrite-log: "true"
      # only for end-to-end tls conf - ingress-nginx accepts backend self-signed cert
      # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    tls: false
    secretName:  # my-tls-secret
  resources: {}
    # limits:
    #   cpu: 400m
    #   memory: 2792Mi
    # requests:
    #   cpu: 100m
    #   memory: 2280Mi
  affinity: {}
  tolerations: []
  nodeSelector: {}
    # key1: value1
    # key2: value2
cve:
  updater:
    # If false, cve updater will not be installed
    enabled: true
    secure: false
    image:
      repository: neuvector/updater
      tag: latest
      hash:
    schedule: "0 0 * * *"
    priorityClassName:
  scanner:
    enabled: true
    replicas: 3
    dockerPath: ""
    strategy:
      type: RollingUpdate
      rollingUpdate:
        maxSurge: 1
        maxUnavailable: 0
    image:
      repository: neuvector/scanner
      tag: latest
      hash:
    priorityClassName:
    resources: {}
      # limits:
      #   cpu: 400m
      #   memory: 2792Mi
      # requests:
      #   cpu: 100m
      #   memory: 2280Mi
    affinity: {}
    tolerations: []
    nodeSelector: {}
      # key1: value1
      # key2: value2
docker:
  path: /var/run/docker.sock
resources: {}
  # limits:
  #   cpu: 400m
  #   memory: 2792Mi
  # requests:
  #   cpu: 100m
  #   memory: 2280Mi
k3s:
  enabled: false
  runtimePath: /run/k3s/containerd/containerd.sock
bottlerocket:
  enabled: false
  runtimePath: /run/dockershim.sock
containerd:
  enabled: false
  path: /var/run/containerd/containerd.sock
crio:
  enabled: false
  path: /var/run/crio/crio.sock
admissionwebhook:
  type: ClusterIP
crdwebhook:
  enabled: true
  type: ClusterIP
[root@UR-20210425NAMA core]#

[root@ur-scm-master01 ~]# helm install neuvector --namespace neuvector neuvector/core
Error: rendered manifests contain a resource that already exists. Unable to continue with install: CustomResourceDefinition "nvadmissioncontrolsecurityrules.neuvector.com" in namespace "" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by": must be set to "Helm"; annotation validation error: missing key "meta.helm.sh/release-name": must be set to "neuvector"; annotation validation error: missing key "meta.helm.sh/release-namespace": must be set to "neuvector"
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# helm -n neuvector list
NAME    NAMESPACE    REVISION    UPDATED    STATUS    CHART    APP VERSION
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# kubectl get crd | grep nvad
nvadmissioncontrolsecurityrules.neuvector.com         2022-01-19T05:23:50Z
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# kubectl delete crd nvadmissioncontrolsecurityrules.neuvector.com 
customresourcedefinition.apiextensions.k8s.io "nvadmissioncontrolsecurityrules.neuvector.com" deleted
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# helm install neuvector --namespace neuvector neuvector/core
Error: rendered manifests contain a resource that already exists. Unable to continue with install: CustomResourceDefinition "nvwafsecurityrules.neuvector.com" in namespace "" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by": must be set to "Helm"; annotation validation error: missing key "meta.helm.sh/release-name": must be set to "neuvector"; annotation validation error: missing key "meta.helm.sh/release-namespace": must be set to "neuvector"
[root@ur-scm-master01 ~]# kubectl get crd | grep neuvector
nvwafsecurityrules.neuvector.com                      2022-01-19T05:23:50Z
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# kubectl delete crd nvwafsecurityrules.neuvector.com 
customresourcedefinition.apiextensions.k8s.io "nvwafsecurityrules.neuvector.com" deleted
[root@ur-scm-master01 ~]# helm install neuvector --namespace neuvector neuvector/core
NAME: neuvector
LAST DEPLOYED: Thu Mar  3 10:06:43 2022
NAMESPACE: neuvector
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Get the NeuVector URL by running these commands:
  NODE_PORT=$(kubectl get --namespace neuvector -o jsonpath="{.spec.ports[0].nodePort}" services neuvector-service-webui)
  NODE_IP=$(kubectl get nodes --namespace neuvector -o jsonpath="{.items[0].status.addresses[0].address}")
  echo https://$NODE_IP:$NODE_PORT
[root@ur-scm-master01 ~]#[root@ur-scm-master01 ~]# helm install neuvector --namespace neuvector neuvector/core
Error: rendered manifests contain a resource that already exists. Unable to continue with install: CustomResourceDefinition "nvadmissioncontrolsecurityrules.neuvector.com" in namespace "" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by": must be set to "Helm"; annotation validation error: missing key "meta.helm.sh/release-name": must be set to "neuvector"; annotation validation error: missing key "meta.helm.sh/release-namespace": must be set to "neuvector"
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# helm -n neuvector list
NAME    NAMESPACE    REVISION    UPDATED    STATUS    CHART    APP VERSION
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# kubectl get crd | grep nvad
nvadmissioncontrolsecurityrules.neuvector.com         2022-01-19T05:23:50Z
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# kubectl delete crd nvadmissioncontrolsecurityrules.neuvector.com 
customresourcedefinition.apiextensions.k8s.io "nvadmissioncontrolsecurityrules.neuvector.com" deleted
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# helm install neuvector --namespace neuvector neuvector/core
Error: rendered manifests contain a resource that already exists. Unable to continue with install: CustomResourceDefinition "nvwafsecurityrules.neuvector.com" in namespace "" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by": must be set to "Helm"; annotation validation error: missing key "meta.helm.sh/release-name": must be set to "neuvector"; annotation validation error: missing key "meta.helm.sh/release-namespace": must be set to "neuvector"
[root@ur-scm-master01 ~]# kubectl get crd | grep neuvector
nvwafsecurityrules.neuvector.com                      2022-01-19T05:23:50Z
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# 
[root@ur-scm-master01 ~]# kubectl delete crd nvwafsecurityrules.neuvector.com 
customresourcedefinition.apiextensions.k8s.io "nvwafsecurityrules.neuvector.com" deleted
[root@ur-scm-master01 ~]# helm install neuvector --namespace neuvector neuvector/core
NAME: neuvector
LAST DEPLOYED: Thu Mar  3 10:06:43 2022
NAMESPACE: neuvector
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Get the NeuVector URL by running these commands:
  NODE_PORT=$(kubectl get --namespace neuvector -o jsonpath="{.spec.ports[0].nodePort}" services neuvector-service-webui)
  NODE_IP=$(kubectl get nodes --namespace neuvector -o jsonpath="{.items[0].status.addresses[0].address}")
  echo https://$NODE_IP:$NODE_PORT
[root@ur-scm-master01 ~]#