Skip to content

NeuVector

This chart packages the upstream NeuVector core chart and its CRD and monitor dependencies for use with Big Bang. It adds Big Bang routes, network policy and Istio integration, hardened image and security-context overrides, monitoring wiring, and package tests. General product architecture, policy administration, scans, and troubleshooting are documented by NeuVector.

Components and security boundary

The upstream chart deploys the controller, manager UI, scanner, registry adapter when enabled, and the node-level enforcer DaemonSet. The controller and enforcer run privileged by default because NeuVector needs host and runtime visibility; the enforcer also uses the host PID namespace. Treat enablement and any change to their privileges, tolerations, node placement, or security context as a security review item. A cluster’s Pod Security Admission policy must permit the required privileged workloads in the NeuVector namespace.

The package sets non-privileged contexts and dropped capabilities where the upstream templates support them, but it does not make the controller or enforcer least-privilege workloads. See the versioned upstream values and upstream architecture for component behavior and the complete configuration surface.

Big Bang integration

The umbrella chart creates the neuvector namespace, image pull secret, source, and Helm release. Configure the release through the canonical packages.neuvector entry; the legacy neuvector entry remains compatible for legacy configuration. The umbrella selects package version 2.11.2-bb.0 at the time of writing.

Big Bang owns the release source, global image, ingress, monitoring, network, Istio, and SSO mappings. This chart owns the package-specific resources they render. Keep general core-chart settings beneath the upstream parent and monitor-chart settings beneath monitor. The generated README documents this parent; use the versioned upstream core values for nested upstream options rather than copying them into an umbrella override.

The controller has an optional persistent volume through the upstream upstream.controller.pvc settings. Storage class, capacity, access mode, and any existing claim are cluster-specific decisions; follow the upstream values and storage provider requirements before enabling persistence.

Ingress and single sign-on

The chart renders the manager UI route through bb-common; Big Bang maps it to the configured gateway and domain. Do not assume a fixed public hostname or configure a second upstream ingress/route unless that is an intentional, reviewed deployment design.

When packages.neuvector.sso.enabled is enabled, the umbrella supplies the OIDC issuer, client ID, client secret, role mapping, and optional CA material to the controller configuration. Supply client secrets and CA certificates through the umbrella’s secret-management path, never in values committed to this repository. See OIDC configuration for the package-specific redirect URI and claim-mapping requirements.

Network, mesh, and OpenShift

With Istio enabled, Big Bang injects the relevant NeuVector workloads and this chart supplies headless services for controller, enforcer, and scanner traffic. The controller PeerAuthentication preserves port 18300 compatibility when mesh mTLS is STRICT; health port 18500 is excluded from sidecar interception. These are coupled settings—do not independently remove the headless services, port exception, or policy without validating controller, scanner, and enforcer communication.

Optional bb-common NetworkPolicies cover Kubernetes API egress for NeuVector components and Prometheus ingress to the exporter. They are not a substitute for understanding the workload’s required runtime access. On OpenShift, the chart can render an anyuid SCC ClusterRoleBinding and an Istio CNI NetworkAttachmentDefinition; both expand the cluster security boundary and require platform-owner approval.

Monitoring and operations

When Big Bang monitoring and metric scraping are enabled, the package installs the upstream monitor/exporter, ServiceMonitor, and a Grafana dashboard. The umbrella creates or reuses a read-only metrics account and exporter password; the password is retained from the existing Secret on reconciliation to avoid unexpected rotation. Do not replace it with a static value in chart values. See Prometheus metrics for the integration background.

The upstream defaults set three controller and scanner replicas with preferred pod anti-affinity; the manager deployment is fixed at one replica and the enforcer is a DaemonSet. Scale and placement settings are upstream configuration and must be evaluated with the topology, storage, and privileged node-access requirements of the target cluster.

The chart includes UI, Prometheus, and updater test resources, but the deployed tests require a disposable cluster. The updater uses Kubernetes API access to restart the scanner and its pod name must retain the neuvector-updater-pod-* prefix for the umbrella Kyverno exception. helm lint chart validates chart structure only; it does not establish privileged runtime behavior, policy enforcement, OIDC login, mesh connectivity, storage, or monitoring health.

References