什么是 NeuVector ？

NeuVector 是一款专门为容器安全而设计的安全平台，提供全面的容器安全防御和威胁检测。它使用了一系列高级技术，如深度学习和情境感知等，来识别和预防各种安全威胁，并在发现异常行为时进行及时报警和响应。

• 该平台特点

  1. 对容器内部对网络流量进行监控和分析
  2. 自动检测和阻止恶意行为和攻击，确保容器环境的安全性，漏洞管理等
  3. 对容器运行时防御、容器镜像扫描和安全策略管理
  4. 可视化的安全策略管理工具，使用户更好地管理和调整安全策略

• 组件

  1. Manager：为用户提供了统一的管理 UI，便于用户查看安全事件、管理安全解决方案、规则等
  2. Controller：Backend 服务器及控制器，管理如 Enforcer、Scanner 等其他组件，分发安全策略及调度扫描任务
  3. Scanner：用户执行漏洞扫描、基线扫描等任务
  4. Enforcer：一个轻量级的容器，用于拦截系统事件，执行安全策略等。通常以 Daemon set 运行再集群中的每个节点上
  5. Updater：用于更新 CVE 数据库

NeuVector 支持多种容器平台

• Docker
• Kubernetes
• OpenShift

NeuVector 安装

添加 NeuVector 的 repo 及检索版本

[root@master01 ~]# helm repo add neuvector https://neuvector.github.io/neuvector-helm/  

"neuvector" has been added to your repositories
[root@master01 ~]# helm search repo neuvector/core
NAME CHART VERSION APP VERSION DESCRIPTION
neuvector/core 2.4.5 5.1.3 Helm chart for NeuVector's core services
[root@master01 ~]# helm search repo neuvector/core -l
NAME CHART VERSION APP VERSION DESCRIPTION
neuvector/core 2.4.5 5.1.3 Helm chart for NeuVector's core services
neuvector/core 2.4.4 5.1.3 Helm chart for NeuVector's core services
neuvector/core 2.4.3 5.1.2 Helm chart for NeuVector's core services
neuvector/core 2.4.2 5.1.1 Helm chart for NeuVector's core services
neuvector/core 2.4.1 5.1.0 Helm chart for NeuVector's core services
neuvector/core 2.4.0 5.1.0 Helm chart for NeuVector's core services
neuvector/core 2.2.5 5.0.5 Helm chart for NeuVector's core services
neuvector/core 2.2.4 5.0.4 Helm chart for NeuVector's core services
neuvector/core 2.2.3 5.0.3 Helm chart for NeuVector's core services
neuvector/core 2.2.2 5.0.2 Helm chart for NeuVector's core services
neuvector/core 2.2.1 5.0.1 Helm chart for NeuVector's core services
neuvector/core 2.2.0 5.0.0 Helm chart for NeuVector's core services
neuvector/core 1.9.2 4.4.4-s2 Helm chart for NeuVector's core services
neuvector/core 1.9.1 4.4.4 Helm chart for NeuVector's core services
neuvector/core 1.9.0 4.4.4 Helm chart for NeuVector's core services
neuvector/core 1.8.9 4.4.3 Helm chart for NeuVector's core services
neuvector/core 1.8.8 4.4.2 Helm chart for NeuVector's core services
neuvector/core 1.8.7 4.4.1 Helm chart for NeuVector's core services
neuvector/core 1.8.6 4.4.0 Helm chart for NeuVector's core services
neuvector/core 1.8.5 4.3.2 Helm chart for NeuVector's core services
neuvector/core 1.8.4 4.3.2 Helm chart for NeuVector's core services
neuvector/core 1.8.3 4.3.2 Helm chart for NeuVector's core services
neuvector/core 1.8.2 4.3.1 Helm chart for NeuVector's core services
neuvector/core 1.8.0 4.3.0 Helm chart for NeuVector's core services
neuvector/core 1.7.7 4.2.2 Helm chart for NeuVector's core services
neuvector/core 1.7.6 4.2.2 Helm chart for NeuVector's core services
neuvector/core 1.7.5 4.2.0 Helm chart for NeuVector's core services
neuvector/core 1.7.2 4.2.0 Helm chart for NeuVector's core services
neuvector/core 1.7.1 4.2.0 Helm chart for NeuVector's core services
neuvector/core 1.7.0 4.0.0 Helm chart for NeuVector's core services
neuvector/core 1.6.9 4.0.0 Helm chart for NeuVector's core services
neuvector/core 1.6.8 4.0.0 Helm chart for NeuVector's core services
neuvector/core 1.6.7 4.0.0 Helm chart for NeuVector's core services
neuvector/core 1.6.6 4.0.0 Helm chart for NeuVector's core services
neuvector/core 1.6.5 4.0.0 Helm chart for NeuVector's core services
neuvector/core 1.6.4 4.0.0 Helm chart for NeuVector's core services
neuvector/core 1.6.1 4.0.0 NeuVector Full Lifecycle Container Security Pla...

创建 namespace 及安装

[root@master01 ~]# kubectl create namespace neuvector  

namespace/neuvector created
[root@master01 ~]# kubectl label namespace neuvector "pod-security.kubernetes.io/enforce=privileged"
namespace/neuvector labeled
[root@master01 ~]# helm install neuvector --namespace neuvector --create-namespace neuvector/core
NAME: neuvector
LAST DEPLOYED: Sat Jun 17 17:40:43 2023
NAMESPACE: neuvector
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Get the NeuVector URL by running these commands:
NODE_PORT=$(kubectl get --namespace neuvector -o jsonpath="{.spec.ports[0].nodePort}" services neuvector-service-webui)
NODE_IP=$(kubectl get nodes --namespace neuvector -o jsonpath="{.items[0].status.addresses[0].address}")
echo https://$NODE_IP:$NODE_PORT

[root@master01 ~]# NODE_PORT=$(kubectl get --namespace neuvector -o jsonpath="{.spec.ports[0].nodePort}" services neuvector-service-webui)
[root@master01 ~]# NODE_IP=$(kubectl get nodes --namespace neuvector -o jsonpath="{.items[0].status.addresses[0].address}")
[root@master01 ~]# echo https://$NODE_IP:$NODE_PORT
https://10.2x.16.x:30196

依赖镜像

docker.io/neuvector/controller:5.1.3  
docker.io/neuvector/enforcer:5.1.3  
docker.io/neuvector/manager:5.1.3  
docker.io/neuvector/scanner:latest

登录UI

• 默认：admin/admin

[ 1 ] https://github.com/neuvector/neuvector-helm