Merge pull request #4058 from jtravee/neuvector-page

Added NeuVector page, linked to Security page
2026-05-26 22:58:45 +00:00 · 2022-05-03 16:22:01 -04:00
parent 6bae6164ef 5b23b7fae5
commit 2e31b2d475
4 changed files with 111 additions and 0 deletions
@@ -0,0 +1,104 @@
+---
+title: NeuVector Integration
+weight: 22
+---
+
+### NeuVector Integration in Rancher
+
+New in Rancher v2.6.5, [NeuVector 5.x](https://open-docs.neuvector.com/) is an open-source container-centric security platform that is now integrated into Rancher. NeuVector offers real-time compliance, visibility, and protection for critical applications and data during runtime. NeuVector provides a firewall, container process/file system monitoring, security auditing with CIS benchmarks, and vulnerability scanning. For more information on Rancher security, please see the [security documentation]({{<baseurl>}}/rancher/v2.6/en/security/).
+
+NeuVector can be enabled through a Helm chart that may be installed either through **Apps & Marketplace** or through the **Cluster Tools** button in the Rancher UI. Once the Helm chart is installed, users can easily [deploy and manage NeuVector clusters within Rancher](https://open-docs.neuvector.com/deploying/rancher#deploy-and-manage-neuvector-through-rancher-apps-marketplace).
+
+### Installing NeuVector with Rancher
+
+The Harvester Helm Chart is used to manage access to the NeuVector UI in Rancher where users can navigate directly to deploy and manage their NeuVector clusters. 
+
+**To navigate to and install the NeuVector chart through Apps & Marketplace:**
+
+1. Click **☰ > Cluster Management**.
+1. On the Clusters page, go to the cluster where you want to deploy NeuVector, and click **Explore**.
+1. Go to **Apps & Marketplace > Charts**, and install **NeuVector** from the chart repo. 
+1. Different cluster types require different container runtimes. When configuring Helm chart values, go to the **Container Runtime** section, and select your runtime in accordance with the cluster type. Finally, click **Install** again.
+
+Some examples are as follows:
+
+   - RKE1: `docker`
+   - K3s and RKE2: `k3scontainerd`
+   - AKS: `containerd` for v1.19 and up
+   - EKS: `docker` for v1.22 and below; `containerd` for v1.23 and up
+   - GKE: `containerd` (see the [Google docs](https://cloud.google.com/kubernetes-engine/docs/concepts/using-containerd) for more)
+
+    >**Note:** Only one container runtime engine may be selected at a time during installation.
+
+**To navigate to and install the NeuVector chart through Cluster Tools:**
+
+1. Click **☰ > Cluster Management**.
+1. On the Clusters page, go to the cluster where you want to deploy NeuVector, and click **Explore**.
+1. Click on **Cluster Tools** at the bottom of the left navigation bar.
+1. Repeat step 4 above to select your container runtime accordingly, then click **Install** again.
+
+### Accessing NeuVector from the Rancher UI
+
+1. Navigate to the cluster explorer of the cluster where NeuVector is installed. In the left navigation bar, click **NeuVector**.
+1. Click the external link to go to the NeuVector UI. Once the link is selected, users must accept the `END USER LICENSE AGREEMENT` to access the NeuVector UI.
+
+### Uninstalling NeuVector from the Rancher UI
+
+**To uninstall from Apps & Marketplace:**
+
+1. Click **☰ > Cluster Management**.
+1. Under **Apps & Marketplace**, click **Installed Apps**.
+1. Under `cattle-neuvector-system`, select both the NeuVector app (and the associated CRD if desired), then click **Delete**.
+
+**To uninstall from Cluster Tools:**
+
+1. Click **☰ > Cluster Management**.
+1. Click on **Cluster Tools** at the bottom-left of the screen, then click on the trash can icon under the NeuVector chart. Select `Delete the CRD associated with this app` if desired, then click **Delete**.
+
+### GitHub Repository
+
+The NeuVector project is available [here](https://github.com/neuvector/neuvector).
+
+### Documentation
+
+The NeuVector documentation is [here](https://open-docs.neuvector.com/).
+
+### Architecture
+
+The NeuVector security solution contains four types of security containers: Controllers, Enforcers, Managers, and Scanners. A special container called an All-in-One is also provided to combine the Controller, Enforcer, and Manager functions all in one container, primarily for Docker-native deployments. There is also an Updater which, when run, will update the CVE database.
+
+- **Controller:** Manages the NeuVector Enforcer container; provides REST APIs for the management console.
+- **Enforcer:** Enforces security policies.
+- **Manager:** Provides a web-UI and CLI console to manage the NeuVector platform.
+- **All-in-One:** Includes the Controller, Enforcer, and Manager.
+- **Scanner:** Performs the vulnerability and compliance scanning for images, containers, and nodes.
+- **Updater:** Updates the CVE database for Neuvector (when run); redeploys scanner pods.
+
+<figcaption>**NeuVector Security Containers:**</figcaption>
+![NeuVector Security Containers]({{<baseurl>}}/img/rancher/neuvector-security-containers.png)
+
+<figcaption>**NeuVector Architecture:**</figcaption>
+![NeuVector Architecture]({{<baseurl>}}/img/rancher/neuvector-architecture.png)
+
+To learn more about NeuVector's architecture, please refer [here](https://open-docs.neuvector.com/basics/overview#architecture).
+
+### CPU and Memory Allocations
+
+Below are the minimum recommended computing resources for the NeuVector chart installation in a default deployment. Note that the resource limit is not set.
+
+| Container   |   CPU - Request  |   Memory - Request  |
+|------------|--------|---------|
+| Controller   |  3 (1GB 1vCPU needed per controller) | *
+| Enforcer     |  On all nodes (500MB .5vCPU) | 1GB
+| Manager      |  1 (500MB .5vCPU) | *
+| Scanner      |  3 (100MB .5vCPU) | *
+
+\* Minimum 1GB of memory total required for Controller, Manager, and Scanner containers combined.
+
+### Limitations
+
+* Currently, NeuVector feature chart installation fails when a NeuVector partner chart already exists. To work around this issue, uninstall the NeuVector partner chart and reinstall the NeuVector feature chart.
+
+* Users cannot access the NeuVector UI from Rancher for a custom RKE1 cluster. To work around this, restart the controllers; note that while the controller pods are restarting, it will take additional time for the controller pods to become active.
+
+* Container runtime is not auto-detected for different cluster types when installing the NeuVector chart.
@@ -24,6 +24,7 @@ Security is at the heart of all Rancher features. From integrating with all the

 On this page, we provide security related documentation along with resources to help you secure your Rancher installation and your downstream Kubernetes clusters:

+- [NeuVector Integration with Rancher](#neuvector-integration-with-rancher)
 - [Running a CIS security scan on a Kubernetes cluster](#running-a-cis-security-scan-on-a-kubernetes-cluster)
 - [SELinux RPM](#selinux-rpm)
 - [Guide to hardening Rancher installations](#rancher-hardening-guide)
@@ -32,6 +33,12 @@ On this page, we provide security related documentation along with resources to
 - [Rancher Security Advisories and CVEs](#rancher-security-advisories-and-cves)
 - [Kubernetes Security Best Practices](#kubernetes-security-best-practices)

+### NeuVector Integration with Rancher
+
+_New in v2.6.5_
+
+NeuVector is an open-source, container-focused security application that is now integrated into Rancher. NeuVector provides production security, DevOps vulnerability protection, and a container firewall, et al. Please see the [Rancher docs]({{<baseurl>}}/rancher/v2.6/en/neuvector-integration) and the [NeuVector docs](https://open-docs.neuvector.com/) for more information.
+
 ### Running a CIS Security Scan on a Kubernetes Cluster

 Rancher leverages [kube-bench](https://github.com/aquasecurity/kube-bench) to run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the [CIS](https://www.cisecurity.org/cis-benchmarks/) (Center for Internet Security) Kubernetes Benchmark.