Quick Start
The platform integrates NeuVector in the form of a Clustering Plugin.
After deploying the NeuVector plugin on the cluster, you can provide security protection capabilities such as Vulnerability scan, Compliance Scanning, Runtime Protection, and Admission Control for containerized computing components in the cluster. At the same time, you can click on the Cluster Name in the NeuVector product interface to open the NeuVector Web UI, view security statistics data for the cluster, and perform related security management operations.
If you are using the NeuVector platform for the first time, you can refer to this article to get started.
Turn on the display entry switch of the product
-
In the left navigation bar of the Platform Management view, click Products.
-
Click the Show Entry switch on the right side of the NeuVector product.
Note: After turning on this switch, the NeuVector product entry will be displayed in the Portal or Portal page.
Deploy the NeuVector plug-in in the cluster
-
In the top navigation bar, click Portal > NeuVector.
-
Click Goto deploy on the right side of the cluster name to be deployed.
-
On the Plugins tab of the cluster, refer to Deploying NeuVector to deploy the plugin.
Access NeuVector’s Web UI
-
In the NeuVector view, click on the Cluster Name where NeuVector plugin has been successfully deployed to open the NeuVector login page.
Tip: Only when Controller, Scanner, and Enforcer are all in Running
state, the plugin deployment is considered successful. -
Click on Sign In with OpenID.
Tip:
-
If NeuVector login fails, please log out and log in to the Full Stack Cloud Native Open Platform again before trying to log in to NeuVector.
-
Click on
?in the top navigation bar to open NeuVector’s online help.
-
Introduction to the basic functions of NeuVector
Security vulnerability management
NeuVector integrates CVE vulnerability database and can perform security vulnerability scanning on the platform (Kubernetes), hosts, containers, and image repositories.
-
It can scan resources on the platform in real-time to detect vulnerabilities and automatically scan when new nodes and containers join.
-
It provides rich reference information for vulnerabilities, including severity, corresponding component versions, fixed versions, vulnerability release time, vulnerability scope, and affected versions of corresponding components.
-
It supports docking with various image repositories such as docker-registry (harbor), JFrog Artifactory, Nexus, and performs vulnerability scanning on the docked image repositories.
Compliance and confidentiality check
NeuVector’s compliance check includes CIS baseline testing, custom checks, confidential review, as well as industry-standard template scans for PCI (Peripheral Component Interconnect), GDPR (General Data Protection Regulation), and other regulations.
Note: Type indicates the corresponding baseline standard, such as K.4.1.1 corresponding to Kubernetes CIS baseline testing; the baseline standard for containers starts with D, and the baseline standard for images starts with I.
The compliance check also checks for the existence of ciphertext leakage.
Policy management
NeuVector manages containers and hosts by groups, and performs compliance checks, network rules, process and file access rules, and DLP/WAF detection configurations on groups.
NeuVector automatically adds the current cluster host to the nodes group and automatically creates a group starting with nv. to manage the cluster container.
NeuVector’s groups support three modes:
-
Learning mode
-
Learn and record the network connections and process execution information between containers and hosts.
-
Automatically build a network rule whitelist to protect the normal behavior of application networks.
-
Set a security baseline for the processes running in each service’s container and create a process configuration file rule whitelist.
-
-
Monitoring mode
NeuVector monitors the network and process running status of containers and hosts. When it encounters behavior that is not recorded in learning mode, it will issue an alert in NeuVector.
-
Protection mode
NeuVector monitors the network and process running status of containers and hosts. When it encounters behavior that is not recorded in learning mode, it will be directly rejected.
When a newly created container service is automatically discovered, its mode is set to learning mode by default. The default mode can also be set to monitoring mode or protection mode through settings.
Other use cases:
-
Dynamic micro-segmentation
Pod-to-Pod isolation can be achieved by adding network rules to Pods.
-
Process management
NeuVector supports managing processes in containers and hosts. In learning mode, running processes and commands are automatically added to the rules.
Access policy control
NeuVector supports integration with Kubernetes admission control function. Admission control rules can be configured through the UI to intercept requests and verify resource objects in the requests.
NeuVector supports multiple admission control policy configurations, such as limiting image CVE vulnerabilities, deploying privileged mode, using root users in images, and specific labels.
This feature can be enabled on the Policies > Admission Control page.
Note: NeuVector admission policy control supports two modes: Monitoring and Protection, which have the same meaning and grouping as the modes.
Dynamic security response
NeuVector can dynamically respond to security events by setting response rules for events such as vulnerability scan results, CIS benchmark tests, and admission control events.
Response actions include:
-
Isolation: all inbound and outbound traffic for the corresponding container network will be cut off.
-
Webhook notification: trigger alerts through Webhook.
-
Log suppression: suppress triggered alert information.
Visualization of network
The network connection relationships and current container connection sessions within the cluster are clearly displayed, and network connection information can be filtered for quick network problem diagnosis.