diff --git a/docs/01.basics/02.requirements/02.requirements.md b/docs/01.basics/02.requirements/02.requirements.md index 8cd740792..34a7ae4af 100644 --- a/docs/01.basics/02.requirements/02.requirements.md +++ b/docs/01.basics/02.requirements/02.requirements.md @@ -53,7 +53,7 @@ Containers that are in protect mode need an allowed rule between specific contai ## Not Supported -* AWS ECS is no longer supported. (NOTE: No functionality has been actively removed for operating NeuVector on ECS deployments. However, testing on ECS is no longer being perfromed by SUSE. While protecting ECS workloads with Neuvector likely will operate as expected, issues will not be investigated.) +* AWS ECS is no longer supported. (NOTE: No functionality has been actively removed for operating NeuVector on ECS deployments. However, testing on ECS is no longer being performed by SUSE. While protecting ECS workloads with Neuvector likely will operate as expected, issues will not be investigated.) * Docker on Mac * Docker on Windows * Docker on Linux - Allinone support is deprecated from v5.5.0 diff --git a/docs/02.deploying/01.production/01.configmap/01.configmap.md b/docs/02.deploying/01.production/01.configmap/01.configmap.md index 94d948b54..f2a96e44d 100644 --- a/docs/02.deploying/01.production/01.configmap/01.configmap.md +++ b/docs/02.deploying/01.production/01.configmap/01.configmap.md @@ -522,7 +522,7 @@ Note the removal of the pipe character below if using configmap sections in a se ```yaml secret: - # NOTE: files defined here have preferrence over the ones defined in the configmap section + # NOTE: files defined here have preference over the ones defined in the configmap section enabled: true data: eulainitcfg.yaml: diff --git a/docs/04.navigation/02.multicluster/02.multicluster.md b/docs/04.navigation/02.multicluster/02.multicluster.md index 6dfce4ef5..d9d96daf7 100644 --- a/docs/04.navigation/02.multicluster/02.multicluster.md +++ b/docs/04.navigation/02.multicluster/02.multicluster.md @@ -67,7 +67,7 @@ The cluster service port `11443` is only accessible after enabling the `fed-mast ``` :::info -The URL for the `curl` command depends on how the `fed-master` services is exposed. If an `ingress` service is configured, it's not neccessary to specify a port. +The URL for the `curl` command depends on how the `fed-master` services is exposed. If an `ingress` service is configured, it's not necessary to specify a port. ::: ```shell @@ -83,7 +83,7 @@ The cluster service port `10443` is shared between `REST API` and the `fed-manag ``` :::info -The URL for the `curl` command depends on how the `fed-managed` services is exposed. If an `ingress` service is configured, it's not neccessary to specify a port. +The URL for the `curl` command depends on how the `fed-managed` services is exposed. If an `ingress` service is configured, it's not necessary to specify a port. ::: ```shell diff --git a/docs/05.policy/03.admission/03.admission.md b/docs/05.policy/03.admission/03.admission.md index bcb97ec20..8b28dff2e 100644 --- a/docs/05.policy/03.admission/03.admission.md +++ b/docs/05.policy/03.admission/03.admission.md @@ -163,7 +163,7 @@ Before NeuVector performs the match against the Admission Control rules, NeuVect NeuVector uses this information to match the results in NeuVector Assets -> Registry scan page and collects the corresponding information such as cve name, cve high or medium count etc. Image compliance violations are considered any image which has secrets or setuid/setgid violations. If users are using the image from docker registry to create a cluster resource, normally the registry server information is empty or docker.io and currently NeuVector is using the following hard-coded registry servers to match the registry scan result instead of empty or docker.io string. Of course, if there are more other than the following supported docker registry servers defined in the registry scan page, NeuVector is unable to get the registry scan results successfully. -If users are using the built-in image such as alpine or ubuntu from the docker registry, there is a hidden organization name called library. When you look at the results for docker build-in image in NeuVector Assets > Registry scan page, the repository name will be library/alpine or library/ubuntu. Currently NeuVector assumes there is only one hidden library organization name in docker registry. If there is more than one, NeuVector is unable to get the registry scan results successfully as well. +If users are using the built-in image such as alpine or ubuntu from the docker registry, there is a hidden organization name called library. When you look at the results for docker built-in image in NeuVector Assets > Registry scan page, the repository name will be library/alpine or library/ubuntu. Currently NeuVector assumes there is only one hidden library organization name in docker registry. If there is more than one, NeuVector is unable to get the registry scan results successfully as well. The above limitation could also apply on other type of docker registry servers if any. #### Creating Custom Criteria Rules @@ -200,7 +200,7 @@ Criteria with a disk icon require that the image be scanned (see registry scanni + Resource Limit Configuration (RLC). Requires resource limits to be configured for CPU Limit/Request, Memory Limit/Request, and can require operator to be \> or \<= a configured resource value.  + Run as privileged. Typically used to limit or block deployments of privileged containers.  + Run as root. Typically used to limit or block deployments of containers run as root..  -+ Service Account Bound High Risk Role. Can match on multiple criteria which could respresent a high risk service account role, including listing secrets, performing any operations on workloads, modification of RBAC resources, creation of workload resources, and allowing exec into a container.  ++ Service Account Bound High Risk Role. Can match on multiple criteria which could represent a high risk service account role, including listing secrets, performing any operations on workloads, modification of RBAC resources, creation of workload resources, and allowing exec into a container.  + Share host’s IPC namespaces. Matches on IPC namespaces.  + Share host’s Network. Allow or disallow deployments to share the host’s network.  + + Share host’s PID namespaces . Matches on PID namespaces.  diff --git a/docs/05.policy/04.groups/04.groups.md b/docs/05.policy/04.groups/04.groups.md index 4e1216b3e..693141213 100644 --- a/docs/05.policy/04.groups/04.groups.md +++ b/docs/05.policy/04.groups/04.groups.md @@ -46,7 +46,7 @@ You can configure the following DDoS detection thresholds: + **Group Session Rate** > Connection Per Second(CPS) on the group, exceeding this rate can trigger a warning event + **Group Bandwidth** -> Throughput meassured in (Mb/s) on the group, exceeding this bandwidth threshold can trigger a warning event +> Throughput measured in (Mb/s) on the group, exceeding this bandwidth threshold can trigger a warning event ![ddosDetection](group_ddos_threshold.png) diff --git a/docs/05.policy/05.networkrules/05.networkrules.md b/docs/05.policy/05.networkrules/05.networkrules.md index 90042218c..ac86c9d2e 100644 --- a/docs/05.policy/05.networkrules/05.networkrules.md +++ b/docs/05.policy/05.networkrules/05.networkrules.md @@ -34,7 +34,7 @@ Add a rule using the `+` either below another rule in the right column, or using > Specify the destination GROUP where these connections are allowed or denied. + **Applications** -> Enter applications for NeuVector to allow or deny. NeuVector understands deep application behavior and will analyze the payload to determine application protocols. Protocols include HTTP, HTTPS, SSL, SSH, DNS, DNCP, NTP, TFTP, ECHO, RTSP, SIP, MySQL, Redis, Zookeeper, Cassandra, MongoDB, PostgresSQL, Kafka, Couchbase, ActiveMQ, ElasticSearch, RabbitMQ, Radius, VoltDB, Consul, Syslog, Etcd, Spark, Apache, Nginx, Jetty, NodeJS, Oracle, MSSQL, Memcached and gRPC. +> Enter applications for NeuVector to allow or deny. NeuVector understands deep application behavior and will analyze the payload to determine application protocols. Protocols include HTTP, HTTPS, SSL, SSH, DNS, DNCP, NTP, TFTP, ECHO, RTSP, SIP, MySQL, Redis, Zookeeper, Cassandra, MongoDB, PostgreSQL, Kafka, Couchbase, ActiveMQ, ElasticSearch, RabbitMQ, Radius, VoltDB, Consul, Syslog, Etcd, Spark, Apache, Nginx, Jetty, NodeJS, Oracle, MSSQL, Memcached and gRPC. :::note To select Any/All, leave this field blank diff --git a/docs/05.policy/08.responserules/08.responserules.md b/docs/05.policy/08.responserules/08.responserules.md index 45fe2f2a4..9335efddb 100644 --- a/docs/05.policy/08.responserules/08.responserules.md +++ b/docs/05.policy/08.responserules/08.responserules.md @@ -121,7 +121,7 @@ The matching logic for multiple criteria in one response rule is: + Choose service group name if rule need to be applied for a particular service group + Choose category Benchmark + Add log level as matching criteria or benchmark number, e.g. “5.12” Ensure the container's root filesystem is mounted as read only -+ Select actions to be applied Quarantine, Webhook and suppress log (quarantine is not applicable Host Docker and Kubenetes benchmark) ++ Select actions to be applied Quarantine, Webhook and suppress log (quarantine is not applicable Host Docker and Kubernetes benchmark) + Enable status ![cis](resp8-b.png) @@ -205,7 +205,7 @@ Configuration.Import Configuration.Export Configuration.Import.Failed Configuration.Export.Failed -Cloud.Scan.Normal // for cloud scan nomal ret +Cloud.Scan.Normal // for cloud scan normal ret Cloud.Scan.Alert // for cloud scan ret with alert Cloud.Scan.Fail // for cloud scan fail Group.Auto.Remove diff --git a/docs/05.policy/13.usingcrd/13.usingcrd.md b/docs/05.policy/13.usingcrd/13.usingcrd.md index c7831aa39..10263033e 100644 --- a/docs/05.policy/13.usingcrd/13.usingcrd.md +++ b/docs/05.policy/13.usingcrd/13.usingcrd.md @@ -422,7 +422,7 @@ Policy Mode Configuration Yaml file Example + key - Must not be empty + op - Operator - If the operator is equal (=) or not-equal (!=), then its’ value must not be empty. - - If the operator is equal (=) or not-equal (!=) with a value (such as * or ?), then the value cannot have any regular expresssion format like ^$. + - If the operator is equal (=) or not-equal (!=) with a value (such as * or ?), then the value cannot have any regular expression format like ^$. - Example: - Key: service - Op : = @@ -828,9 +828,9 @@ The target is a service called nv.alpine.default in the 'default' namespace. Bec Note that for service nv.alpine.default (defined as nv.xxx.yyy where xxx is the service name like alpine, yyy is the namespace like default) we can define policy mode that it is set to. Here it is defined as Protect mode (blocking all abnormal activity). -Overall since nv.alpine.defult is in protect mode, it will deny containers from running ssh and scp, and also will deny ssh connections from external or http to external. +Overall since nv.alpine.default is in protect mode, it will deny containers from running ssh and scp, and also will deny ssh connections from external or http to external. -If you change the nv.alpine.defult policymode to monitor, then NeuVector will just log it when scp/ssh is invoked, or there are ssh connections from external or http to external. +If you change the nv.alpine.default policymode to monitor, then NeuVector will just log it when scp/ssh is invoked, or there are ssh connections from external or http to external. ```yaml apiVersion: v1 diff --git a/docs/08.integration/12.rancher_sso_rbac.md b/docs/08.integration/12.rancher_sso_rbac.md index 46e6616ee..16ebc271c 100644 --- a/docs/08.integration/12.rancher_sso_rbac.md +++ b/docs/08.integration/12.rancher_sso_rbac.md @@ -80,7 +80,7 @@ It is important to note that this integration supports roles in Global, Cluster, ```yaml Verb: * Resource: RuntimeScan (choose runtimescan from drop down) - API: permission.neuvector.com (auot populated) + API: permission.neuvector.com (auto populated) ``` + Create a project/namespace role to allow access to the UI and for SSO to work. Please remember that you must add this user role to your project for it to work as expected: diff --git a/docs/10.updating/01.updating/01.updating.md b/docs/10.updating/01.updating/01.updating.md index 2981e049d..df2ada121 100644 --- a/docs/10.updating/01.updating/01.updating.md +++ b/docs/10.updating/01.updating/01.updating.md @@ -9,7 +9,7 @@ slug: /updating/updating It’s super easy to update your NeuVector containers. If there is a new release available, pull it from Docker Hub. It is recommended to use a ‘rolling update’ strategy to keep at least one Allinone or Controller container running at any time during an update. -:::warning imporant +:::warning important Host OS updates, reboots, and orchestrator updates can cause pods to be evicted or stopped. If a Controller is affected, and there are no other Controllers active to maintain the state, the Controllers can become available for some time while new controllers are started, a cluster is formed with a leader, and the persistent storage backup of the configuration is attempted to be accessed to restore the cluster. Be careful when scheduling host or orchestrator updates and reboots which may affect the number of controllers available at any time. See the Pod Disruption Budget below for possible ways to mitigate this. If deployment was done using the NeuVector Helm charts, updating will take care of additional services, rolebindings or other upgrade requirements. diff --git a/docs/12.troubleshooting/02.cli/02.cli.md b/docs/12.troubleshooting/02.cli/02.cli.md index d9967976a..1163d2726 100644 --- a/docs/12.troubleshooting/02.cli/02.cli.md +++ b/docs/12.troubleshooting/02.cli/02.cli.md @@ -70,7 +70,7 @@ MODES: ```shell > set controller debug - Turn off debug mdoe. + Turn off debug mode. ``` More CLI commands are listed below. diff --git a/versioned_docs/version-5.2/01.basics/02.requirements/02.requirements.md b/versioned_docs/version-5.2/01.basics/02.requirements/02.requirements.md index f39e80022..32d7c1653 100644 --- a/versioned_docs/version-5.2/01.basics/02.requirements/02.requirements.md +++ b/versioned_docs/version-5.2/01.basics/02.requirements/02.requirements.md @@ -33,7 +33,7 @@ AWS Bottlerocket Note: Must change path of the containerd socket specific to Bot #### Not Supported * GKE Autopilot. -* AWS ECS is no longer supported. (NOTE: No functionality has been actively removed for operating NeuVector on ECS deployments. However, testing on ECS is no longer being perfromed by SUSE. While protecting ECS workloads with Neuvector likely will operate as expected, issues will not be investigated.) +* AWS ECS is no longer supported. (NOTE: No functionality has been actively removed for operating NeuVector on ECS deployments. However, testing on ECS is no longer being performed by SUSE. While protecting ECS workloads with Neuvector likely will operate as expected, issues will not be investigated.) * Docker on Mac * Docker on Windows * ARM architectire is not currently supported, but being worked on for future releases. diff --git a/versioned_docs/version-5.2/02.deploying/01.production/01.configmap/01.configmap.md b/versioned_docs/version-5.2/02.deploying/01.production/01.configmap/01.configmap.md index 5667ca4c9..b76418c3e 100644 --- a/versioned_docs/version-5.2/02.deploying/01.production/01.configmap/01.configmap.md +++ b/versioned_docs/version-5.2/02.deploying/01.production/01.configmap/01.configmap.md @@ -417,7 +417,7 @@ Note the removal of the pipe character below if using configmap sections in a se ```yaml secret: - # NOTE: files defined here have preferrence over the ones defined in the configmap section + # NOTE: files defined here have preference over the ones defined in the configmap section enabled: true data: eulainitcfg.yaml: diff --git a/versioned_docs/version-5.2/05.policy/03.admission/03.admission.md b/versioned_docs/version-5.2/05.policy/03.admission/03.admission.md index 89e159b45..4c1080da4 100644 --- a/versioned_docs/version-5.2/05.policy/03.admission/03.admission.md +++ b/versioned_docs/version-5.2/05.policy/03.admission/03.admission.md @@ -163,7 +163,7 @@ Before NeuVector performs the match against the Admission Control rules, NeuVect NeuVector uses this information to match the results in NeuVector Assets -> Registry scan page and collects the corresponding information such as cve name, cve high or medium count etc. Image compliance violations are considered any image which has secrets or setuid/setgid violations. If users are using the image from docker registry to create a cluster resource, normally the registry server information is empty or docker.io and currently NeuVector is using the following hard-coded registry servers to match the registry scan result instead of empty or docker.io string. Of course, if there are more other than the following supported docker registry servers defined in the registry scan page, NeuVector is unable to get the registry scan results successfully. -If users are using the built-in image such as alpine or ubuntu from the docker registry, there is a hidden organization name called library. When you look at the results for docker build-in image in NeuVector Assets > Registry scan page, the repository name will be library/alpine or library/ubuntu. Currently NeuVector assumes there is only one hidden library organization name in docker registry. If there is more than one, NeuVector is unable to get the registry scan results successfully as well. +If users are using the built-in image such as alpine or ubuntu from the docker registry, there is a hidden organization name called library. When you look at the results for docker built-in image in NeuVector Assets > Registry scan page, the repository name will be library/alpine or library/ubuntu. Currently NeuVector assumes there is only one hidden library organization name in docker registry. If there is more than one, NeuVector is unable to get the registry scan results successfully as well. The above limitation could also apply on other type of docker registry servers if any. #### Creating Custom Criteria Rules @@ -200,7 +200,7 @@ Criteria with a disk icon require that the image be scanned (see registry scanni + Resource Limit Configuration (RLC). Requires resource limits to be configured for CPU Limit/Request, Memory Limit/Request, and can require operator to be \> or \<= a configured resource value.  + Run as privileged. Typically used to limit or block deployments of privileged containers.  + Run as root. Typically used to limit or block deployments of containers run as root..  -+ Service Account Bound High Risk Role. Can match on multiple criteria which could respresent a high risk service account role, including listing secrets, performing any operations on workloads, modification of RBAC resources, creation of workload resources, and allowing exec into a container.  ++ Service Account Bound High Risk Role. Can match on multiple criteria which could represent a high risk service account role, including listing secrets, performing any operations on workloads, modification of RBAC resources, creation of workload resources, and allowing exec into a container.  + Share host’s IPC namespaces. Matches on IPC namespaces.  + Share host’s Network. Allow or disallow deployments to share the host’s network.  + + Share host’s PID namespaces . Matches on PID namespaces.  diff --git a/versioned_docs/version-5.2/05.policy/05.networkrules/05.networkrules.md b/versioned_docs/version-5.2/05.policy/05.networkrules/05.networkrules.md index b410914f4..1130ad4b6 100644 --- a/versioned_docs/version-5.2/05.policy/05.networkrules/05.networkrules.md +++ b/versioned_docs/version-5.2/05.policy/05.networkrules/05.networkrules.md @@ -34,7 +34,7 @@ Add a rule using the ‘+’ either below another rule in the right column, or u > Specify the destination GROUP where these connections are allowed or denied. + **Applications** -> Enter applications for NeuVector to allow or deny. NeuVector understands deep application behavior and will analyze the payload to determine application protocols. Protocols include HTTP, HTTPS, SSL, SSH, DNS, DNCP, NTP, TFTP, ECHO, RTSP, SIP, MySQL, Redis, Zookeeper, Cassandra, MongoDB, PostgresSQL, Kafka, Couchbase, ActiveMQ, ElasticSearch, RabbitMQ, Radius, VoltDB, Consul, Syslog, Etcd, Spark, Apache, Nginx, Jetty, NodeJS, Oracle, MSSQL, Memcached and gRPC. +> Enter applications for NeuVector to allow or deny. NeuVector understands deep application behavior and will analyze the payload to determine application protocols. Protocols include HTTP, HTTPS, SSL, SSH, DNS, DNCP, NTP, TFTP, ECHO, RTSP, SIP, MySQL, Redis, Zookeeper, Cassandra, MongoDB, PostgreSQL, Kafka, Couchbase, ActiveMQ, ElasticSearch, RabbitMQ, Radius, VoltDB, Consul, Syslog, Etcd, Spark, Apache, Nginx, Jetty, NodeJS, Oracle, MSSQL, Memcached and gRPC. :::note To select Any/All, leave this field blank diff --git a/versioned_docs/version-5.2/05.policy/08.responserules/08.responserules.md b/versioned_docs/version-5.2/05.policy/08.responserules/08.responserules.md index 1a23ef045..49474d3fe 100644 --- a/versioned_docs/version-5.2/05.policy/08.responserules/08.responserules.md +++ b/versioned_docs/version-5.2/05.policy/08.responserules/08.responserules.md @@ -121,7 +121,7 @@ The matching logic for multiple criteria in one response rule is: + Choose service group name if rule need to be applied for a particular service group + Choose category Benchmark + Add log level as matching criteria or benchmark number, e.g. “5.12” Ensure the container's root filesystem is mounted as read only -+ Select actions to be applied Quarantine, Webhook and suppress log (quarantine is not applicable Host Docker and Kubenetes benchmark) ++ Select actions to be applied Quarantine, Webhook and suppress log (quarantine is not applicable Host Docker and Kubernetes benchmark) + Enable status ![cis](resp8-b.png) @@ -205,7 +205,7 @@ Configuration.Import Configuration.Export Configuration.Import.Failed Configuration.Export.Failed -Cloud.Scan.Normal // for cloud scan nomal ret +Cloud.Scan.Normal // for cloud scan normal ret Cloud.Scan.Alert // for cloud scan ret with alert Cloud.Scan.Fail // for cloud scan fail Group.Auto.Remove diff --git a/versioned_docs/version-5.2/05.policy/13.usingcrd/13.usingcrd.md b/versioned_docs/version-5.2/05.policy/13.usingcrd/13.usingcrd.md index 16a9ea07b..943ee422c 100644 --- a/versioned_docs/version-5.2/05.policy/13.usingcrd/13.usingcrd.md +++ b/versioned_docs/version-5.2/05.policy/13.usingcrd/13.usingcrd.md @@ -351,7 +351,7 @@ Policy Mode Configuration Yaml file Example + key - Must not be empty + op - Operator - If the operator is equal (=) or not-equal (!=), then its’ value must not be empty. - - If the operator is equal (=) or not-equal (!=) with a value (such as * or ?), then the value cannot have any regular expresssion format like ^$. + - If the operator is equal (=) or not-equal (!=) with a value (such as * or ?), then the value cannot have any regular expression format like ^$. - Example: - Key: service - Op : = @@ -757,9 +757,9 @@ The target is a service called nv.alpine.default in the 'default' namespace. Bec Note that for service nv.alpine.default (defined as nv.xxx.yyy where xxx is the service name like alpine, yyy is the namespace like default) we can define policy mode that it is set to. Here it is defined as Protect mode (blocking all abnormal activity). -Overall since nv.alpine.defult is in protect mode, it will deny containers from running ssh and scp, and also will deny ssh connections from external or http to external. +Overall since nv.alpine.default is in protect mode, it will deny containers from running ssh and scp, and also will deny ssh connections from external or http to external. -If you change the nv.alpine.defult policymode to monitor, then NeuVector will just log it when scp/ssh is invoked, or there are ssh connections from external or http to external. +If you change the nv.alpine.default policymode to monitor, then NeuVector will just log it when scp/ssh is invoked, or there are ssh connections from external or http to external. ```yaml apiVersion: v1 diff --git a/versioned_docs/version-5.2/10.updating/01.updating/01.updating.md b/versioned_docs/version-5.2/10.updating/01.updating/01.updating.md index 3e61195ad..2b2e968c8 100644 --- a/versioned_docs/version-5.2/10.updating/01.updating/01.updating.md +++ b/versioned_docs/version-5.2/10.updating/01.updating/01.updating.md @@ -9,7 +9,7 @@ slug: /updating/updating It’s super easy to update your NeuVector containers. If there is a new release available, pull it from Docker Hub. It is recommended to use a ‘rolling update’ strategy to keep at least one Allinone or Controller container running at any time during an update. -:::warning imporant +:::warning important Host OS updates, reboots, and orchestrator updates can cause pods to be evicted or stopped. If a Controller is affected, and there are no other Controllers active to maintain the state, the Controllers can become available for some time while new controllers are started, a cluster is formed with a leader, and the persistent storage backup of the configuration is attempted to be accessed to restore the cluster. Be careful when scheduling host or orchestrator updates and reboots which may affect the number of controllers available at any time. See the Pod Disruption Budget below for possible ways to mitigate this. If deployment was done using the NeuVector Helm charts, updating will take care of additional services, rolebindings or other upgrade requirements. diff --git a/versioned_docs/version-5.2/12.troubleshooting/02.cli/02.cli.md b/versioned_docs/version-5.2/12.troubleshooting/02.cli/02.cli.md index d9967976a..1163d2726 100644 --- a/versioned_docs/version-5.2/12.troubleshooting/02.cli/02.cli.md +++ b/versioned_docs/version-5.2/12.troubleshooting/02.cli/02.cli.md @@ -70,7 +70,7 @@ MODES: ```shell > set controller debug - Turn off debug mdoe. + Turn off debug mode. ``` More CLI commands are listed below. diff --git a/versioned_docs/version-5.3/01.basics/02.requirements/02.requirements.md b/versioned_docs/version-5.3/01.basics/02.requirements/02.requirements.md index 95566c3a8..bd449497b 100644 --- a/versioned_docs/version-5.3/01.basics/02.requirements/02.requirements.md +++ b/versioned_docs/version-5.3/01.basics/02.requirements/02.requirements.md @@ -35,7 +35,7 @@ AWS Bottlerocket Note: Must change path of the containerd socket specific to Bot * GKE Autopilot. * The multus cni is not currently supported but is on the 2024 roadmap. -* AWS ECS is no longer supported. (NOTE: No functionality has been actively removed for operating NeuVector on ECS deployments. However, testing on ECS is no longer being perfromed by SUSE. While protecting ECS workloads with Neuvector likely will operate as expected, issues will not be investigated.) +* AWS ECS is no longer supported. (NOTE: No functionality has been actively removed for operating NeuVector on ECS deployments. However, testing on ECS is no longer being performed by SUSE. While protecting ECS workloads with Neuvector likely will operate as expected, issues will not be investigated.) * Docker on Mac * Docker on Windows * Rkt (container linux) from CoreOS diff --git a/versioned_docs/version-5.3/02.deploying/01.production/01.configmap/01.configmap.md b/versioned_docs/version-5.3/02.deploying/01.production/01.configmap/01.configmap.md index 17389ec84..fcdc48bc8 100644 --- a/versioned_docs/version-5.3/02.deploying/01.production/01.configmap/01.configmap.md +++ b/versioned_docs/version-5.3/02.deploying/01.production/01.configmap/01.configmap.md @@ -417,7 +417,7 @@ Note the removal of the pipe character below if using configmap sections in a se ```yaml secret: - # NOTE: files defined here have preferrence over the ones defined in the configmap section + # NOTE: files defined here have preference over the ones defined in the configmap section enabled: true data: eulainitcfg.yaml: diff --git a/versioned_docs/version-5.3/02.deploying/01.production/04.internal/04.internal.md b/versioned_docs/version-5.3/02.deploying/01.production/04.internal/04.internal.md index ac5852aea..9504e3b7d 100644 --- a/versioned_docs/version-5.3/02.deploying/01.production/04.internal/04.internal.md +++ b/versioned_docs/version-5.3/02.deploying/01.production/04.internal/04.internal.md @@ -108,7 +108,7 @@ kubectl patch deployment -n ${NAMESPACE} neuvector-controller-pod --type='json' ``` -If your certificate files were created before NeuVector version 5.3, you need to upate the certificate with at least one Subject Alternative Name, or SAN for short. +If your certificate files were created before NeuVector version 5.3, you need to update the certificate with at least one Subject Alternative Name, or SAN for short. If you still have the files `ca.key` and `ca.crt` accessible, run the commands as follows: @@ -133,7 +133,7 @@ kubectl rollout restart ds neuvector-enforcer-pod ``` -If your certificate files were created before NeuVector version 5.3, you need to upate the certificate with at least one Subject Alternative Name, or SAN for short. +If your certificate files were created before NeuVector version 5.3, you need to update the certificate with at least one Subject Alternative Name, or SAN for short. If you don´t have the files `ca.key` and `ca.crt` anymore, follow the steps below: diff --git a/versioned_docs/version-5.3/04.navigation/02.multicluster/02.multicluster.md b/versioned_docs/version-5.3/04.navigation/02.multicluster/02.multicluster.md index c7ee4a8da..154d7af34 100644 --- a/versioned_docs/version-5.3/04.navigation/02.multicluster/02.multicluster.md +++ b/versioned_docs/version-5.3/04.navigation/02.multicluster/02.multicluster.md @@ -67,7 +67,7 @@ The cluster service port `11443` is only accessible after enabling the `fed-mast ``` :::info -The URL for the `curl` command depends on how the `fed-master` services is exposed. If an `ingress` service is configured, it's not neccessary to specify a port. +The URL for the `curl` command depends on how the `fed-master` services is exposed. If an `ingress` service is configured, it's not necessary to specify a port. ::: ```shell @@ -83,7 +83,7 @@ The cluster service port `10443` is shared between `REST API` and the `fed-manag ``` :::info -The URL for the `curl` command depends on how the `fed-managed` services is exposed. If an `ingress` service is configured, it's not neccessary to specify a port. +The URL for the `curl` command depends on how the `fed-managed` services is exposed. If an `ingress` service is configured, it's not necessary to specify a port. ::: ```shell diff --git a/versioned_docs/version-5.3/05.policy/03.admission/03.admission.md b/versioned_docs/version-5.3/05.policy/03.admission/03.admission.md index 89e159b45..4c1080da4 100644 --- a/versioned_docs/version-5.3/05.policy/03.admission/03.admission.md +++ b/versioned_docs/version-5.3/05.policy/03.admission/03.admission.md @@ -163,7 +163,7 @@ Before NeuVector performs the match against the Admission Control rules, NeuVect NeuVector uses this information to match the results in NeuVector Assets -> Registry scan page and collects the corresponding information such as cve name, cve high or medium count etc. Image compliance violations are considered any image which has secrets or setuid/setgid violations. If users are using the image from docker registry to create a cluster resource, normally the registry server information is empty or docker.io and currently NeuVector is using the following hard-coded registry servers to match the registry scan result instead of empty or docker.io string. Of course, if there are more other than the following supported docker registry servers defined in the registry scan page, NeuVector is unable to get the registry scan results successfully. -If users are using the built-in image such as alpine or ubuntu from the docker registry, there is a hidden organization name called library. When you look at the results for docker build-in image in NeuVector Assets > Registry scan page, the repository name will be library/alpine or library/ubuntu. Currently NeuVector assumes there is only one hidden library organization name in docker registry. If there is more than one, NeuVector is unable to get the registry scan results successfully as well. +If users are using the built-in image such as alpine or ubuntu from the docker registry, there is a hidden organization name called library. When you look at the results for docker built-in image in NeuVector Assets > Registry scan page, the repository name will be library/alpine or library/ubuntu. Currently NeuVector assumes there is only one hidden library organization name in docker registry. If there is more than one, NeuVector is unable to get the registry scan results successfully as well. The above limitation could also apply on other type of docker registry servers if any. #### Creating Custom Criteria Rules @@ -200,7 +200,7 @@ Criteria with a disk icon require that the image be scanned (see registry scanni + Resource Limit Configuration (RLC). Requires resource limits to be configured for CPU Limit/Request, Memory Limit/Request, and can require operator to be \> or \<= a configured resource value.  + Run as privileged. Typically used to limit or block deployments of privileged containers.  + Run as root. Typically used to limit or block deployments of containers run as root..  -+ Service Account Bound High Risk Role. Can match on multiple criteria which could respresent a high risk service account role, including listing secrets, performing any operations on workloads, modification of RBAC resources, creation of workload resources, and allowing exec into a container.  ++ Service Account Bound High Risk Role. Can match on multiple criteria which could represent a high risk service account role, including listing secrets, performing any operations on workloads, modification of RBAC resources, creation of workload resources, and allowing exec into a container.  + Share host’s IPC namespaces. Matches on IPC namespaces.  + Share host’s Network. Allow or disallow deployments to share the host’s network.  + + Share host’s PID namespaces . Matches on PID namespaces.  diff --git a/versioned_docs/version-5.3/05.policy/05.networkrules/05.networkrules.md b/versioned_docs/version-5.3/05.policy/05.networkrules/05.networkrules.md index 0f8aa287b..27220c290 100644 --- a/versioned_docs/version-5.3/05.policy/05.networkrules/05.networkrules.md +++ b/versioned_docs/version-5.3/05.policy/05.networkrules/05.networkrules.md @@ -34,7 +34,7 @@ Add a rule using the ‘+’ either below another rule in the right column, or u > Specify the destination GROUP where these connections are allowed or denied. + **Applications** -> Enter applications for NeuVector to allow or deny. NeuVector understands deep application behavior and will analyze the payload to determine application protocols. Protocols include HTTP, HTTPS, SSL, SSH, DNS, DNCP, NTP, TFTP, ECHO, RTSP, SIP, MySQL, Redis, Zookeeper, Cassandra, MongoDB, PostgresSQL, Kafka, Couchbase, ActiveMQ, ElasticSearch, RabbitMQ, Radius, VoltDB, Consul, Syslog, Etcd, Spark, Apache, Nginx, Jetty, NodeJS, Oracle, MSSQL, Memcached and gRPC. +> Enter applications for NeuVector to allow or deny. NeuVector understands deep application behavior and will analyze the payload to determine application protocols. Protocols include HTTP, HTTPS, SSL, SSH, DNS, DNCP, NTP, TFTP, ECHO, RTSP, SIP, MySQL, Redis, Zookeeper, Cassandra, MongoDB, PostgreSQL, Kafka, Couchbase, ActiveMQ, ElasticSearch, RabbitMQ, Radius, VoltDB, Consul, Syslog, Etcd, Spark, Apache, Nginx, Jetty, NodeJS, Oracle, MSSQL, Memcached and gRPC. :::note To select Any/All, leave this field blank diff --git a/versioned_docs/version-5.3/05.policy/08.responserules/08.responserules.md b/versioned_docs/version-5.3/05.policy/08.responserules/08.responserules.md index 71ee51598..3a60df3fe 100644 --- a/versioned_docs/version-5.3/05.policy/08.responserules/08.responserules.md +++ b/versioned_docs/version-5.3/05.policy/08.responserules/08.responserules.md @@ -121,7 +121,7 @@ The matching logic for multiple criteria in one response rule is: + Choose service group name if rule need to be applied for a particular service group + Choose category Benchmark + Add log level as matching criteria or benchmark number, e.g. “5.12” Ensure the container's root filesystem is mounted as read only -+ Select actions to be applied Quarantine, Webhook and suppress log (quarantine is not applicable Host Docker and Kubenetes benchmark) ++ Select actions to be applied Quarantine, Webhook and suppress log (quarantine is not applicable Host Docker and Kubernetes benchmark) + Enable status ![cis](resp8-b.png) @@ -205,7 +205,7 @@ Configuration.Import Configuration.Export Configuration.Import.Failed Configuration.Export.Failed -Cloud.Scan.Normal // for cloud scan nomal ret +Cloud.Scan.Normal // for cloud scan normal ret Cloud.Scan.Alert // for cloud scan ret with alert Cloud.Scan.Fail // for cloud scan fail Group.Auto.Remove diff --git a/versioned_docs/version-5.3/05.policy/13.usingcrd/13.usingcrd.md b/versioned_docs/version-5.3/05.policy/13.usingcrd/13.usingcrd.md index 16a9ea07b..943ee422c 100644 --- a/versioned_docs/version-5.3/05.policy/13.usingcrd/13.usingcrd.md +++ b/versioned_docs/version-5.3/05.policy/13.usingcrd/13.usingcrd.md @@ -351,7 +351,7 @@ Policy Mode Configuration Yaml file Example + key - Must not be empty + op - Operator - If the operator is equal (=) or not-equal (!=), then its’ value must not be empty. - - If the operator is equal (=) or not-equal (!=) with a value (such as * or ?), then the value cannot have any regular expresssion format like ^$. + - If the operator is equal (=) or not-equal (!=) with a value (such as * or ?), then the value cannot have any regular expression format like ^$. - Example: - Key: service - Op : = @@ -757,9 +757,9 @@ The target is a service called nv.alpine.default in the 'default' namespace. Bec Note that for service nv.alpine.default (defined as nv.xxx.yyy where xxx is the service name like alpine, yyy is the namespace like default) we can define policy mode that it is set to. Here it is defined as Protect mode (blocking all abnormal activity). -Overall since nv.alpine.defult is in protect mode, it will deny containers from running ssh and scp, and also will deny ssh connections from external or http to external. +Overall since nv.alpine.default is in protect mode, it will deny containers from running ssh and scp, and also will deny ssh connections from external or http to external. -If you change the nv.alpine.defult policymode to monitor, then NeuVector will just log it when scp/ssh is invoked, or there are ssh connections from external or http to external. +If you change the nv.alpine.default policymode to monitor, then NeuVector will just log it when scp/ssh is invoked, or there are ssh connections from external or http to external. ```yaml apiVersion: v1 diff --git a/versioned_docs/version-5.3/10.updating/01.updating/01.updating.md b/versioned_docs/version-5.3/10.updating/01.updating/01.updating.md index 2981e049d..df2ada121 100644 --- a/versioned_docs/version-5.3/10.updating/01.updating/01.updating.md +++ b/versioned_docs/version-5.3/10.updating/01.updating/01.updating.md @@ -9,7 +9,7 @@ slug: /updating/updating It’s super easy to update your NeuVector containers. If there is a new release available, pull it from Docker Hub. It is recommended to use a ‘rolling update’ strategy to keep at least one Allinone or Controller container running at any time during an update. -:::warning imporant +:::warning important Host OS updates, reboots, and orchestrator updates can cause pods to be evicted or stopped. If a Controller is affected, and there are no other Controllers active to maintain the state, the Controllers can become available for some time while new controllers are started, a cluster is formed with a leader, and the persistent storage backup of the configuration is attempted to be accessed to restore the cluster. Be careful when scheduling host or orchestrator updates and reboots which may affect the number of controllers available at any time. See the Pod Disruption Budget below for possible ways to mitigate this. If deployment was done using the NeuVector Helm charts, updating will take care of additional services, rolebindings or other upgrade requirements. diff --git a/versioned_docs/version-5.3/12.troubleshooting/02.cli/02.cli.md b/versioned_docs/version-5.3/12.troubleshooting/02.cli/02.cli.md index d9967976a..1163d2726 100644 --- a/versioned_docs/version-5.3/12.troubleshooting/02.cli/02.cli.md +++ b/versioned_docs/version-5.3/12.troubleshooting/02.cli/02.cli.md @@ -70,7 +70,7 @@ MODES: ```shell > set controller debug - Turn off debug mdoe. + Turn off debug mode. ``` More CLI commands are listed below. diff --git a/versioned_docs/version-5.4/01.basics/02.requirements/02.requirements.md b/versioned_docs/version-5.4/01.basics/02.requirements/02.requirements.md index ee2e0f6ea..0941fa8d1 100644 --- a/versioned_docs/version-5.4/01.basics/02.requirements/02.requirements.md +++ b/versioned_docs/version-5.4/01.basics/02.requirements/02.requirements.md @@ -55,7 +55,7 @@ Containers that are in protect mode need an allowed rule between specific contai ## Not Supported * GKE Autopilot. -* AWS ECS is no longer supported. (NOTE: No functionality has been actively removed for operating NeuVector on ECS deployments. However, testing on ECS is no longer being perfromed by SUSE. While protecting ECS workloads with Neuvector likely will operate as expected, issues will not be investigated.) +* AWS ECS is no longer supported. (NOTE: No functionality has been actively removed for operating NeuVector on ECS deployments. However, testing on ECS is no longer being performed by SUSE. While protecting ECS workloads with Neuvector likely will operate as expected, issues will not be investigated.) * Docker on Mac * Docker on Windows * Rkt (container linux) from CoreOS diff --git a/versioned_docs/version-5.4/02.deploying/01.production/01.configmap/01.configmap.md b/versioned_docs/version-5.4/02.deploying/01.production/01.configmap/01.configmap.md index 150796818..bff5a9cc8 100644 --- a/versioned_docs/version-5.4/02.deploying/01.production/01.configmap/01.configmap.md +++ b/versioned_docs/version-5.4/02.deploying/01.production/01.configmap/01.configmap.md @@ -506,7 +506,7 @@ Note the removal of the pipe character below if using configmap sections in a se ```yaml secret: - # NOTE: files defined here have preferrence over the ones defined in the configmap section + # NOTE: files defined here have preference over the ones defined in the configmap section enabled: true data: eulainitcfg.yaml: diff --git a/versioned_docs/version-5.4/04.navigation/02.multicluster/02.multicluster.md b/versioned_docs/version-5.4/04.navigation/02.multicluster/02.multicluster.md index 6dfce4ef5..d9d96daf7 100644 --- a/versioned_docs/version-5.4/04.navigation/02.multicluster/02.multicluster.md +++ b/versioned_docs/version-5.4/04.navigation/02.multicluster/02.multicluster.md @@ -67,7 +67,7 @@ The cluster service port `11443` is only accessible after enabling the `fed-mast ``` :::info -The URL for the `curl` command depends on how the `fed-master` services is exposed. If an `ingress` service is configured, it's not neccessary to specify a port. +The URL for the `curl` command depends on how the `fed-master` services is exposed. If an `ingress` service is configured, it's not necessary to specify a port. ::: ```shell @@ -83,7 +83,7 @@ The cluster service port `10443` is shared between `REST API` and the `fed-manag ``` :::info -The URL for the `curl` command depends on how the `fed-managed` services is exposed. If an `ingress` service is configured, it's not neccessary to specify a port. +The URL for the `curl` command depends on how the `fed-managed` services is exposed. If an `ingress` service is configured, it's not necessary to specify a port. ::: ```shell diff --git a/versioned_docs/version-5.4/05.policy/03.admission/03.admission.md b/versioned_docs/version-5.4/05.policy/03.admission/03.admission.md index dd88ffcea..f505c1485 100644 --- a/versioned_docs/version-5.4/05.policy/03.admission/03.admission.md +++ b/versioned_docs/version-5.4/05.policy/03.admission/03.admission.md @@ -163,7 +163,7 @@ Before NeuVector performs the match against the Admission Control rules, NeuVect NeuVector uses this information to match the results in NeuVector Assets -> Registry scan page and collects the corresponding information such as cve name, cve high or medium count etc. Image compliance violations are considered any image which has secrets or setuid/setgid violations. If users are using the image from docker registry to create a cluster resource, normally the registry server information is empty or docker.io and currently NeuVector is using the following hard-coded registry servers to match the registry scan result instead of empty or docker.io string. Of course, if there are more other than the following supported docker registry servers defined in the registry scan page, NeuVector is unable to get the registry scan results successfully. -If users are using the built-in image such as alpine or ubuntu from the docker registry, there is a hidden organization name called library. When you look at the results for docker build-in image in NeuVector Assets > Registry scan page, the repository name will be library/alpine or library/ubuntu. Currently NeuVector assumes there is only one hidden library organization name in docker registry. If there is more than one, NeuVector is unable to get the registry scan results successfully as well. +If users are using the built-in image such as alpine or ubuntu from the docker registry, there is a hidden organization name called library. When you look at the results for docker built-in image in NeuVector Assets > Registry scan page, the repository name will be library/alpine or library/ubuntu. Currently NeuVector assumes there is only one hidden library organization name in docker registry. If there is more than one, NeuVector is unable to get the registry scan results successfully as well. The above limitation could also apply on other type of docker registry servers if any. #### Creating Custom Criteria Rules @@ -200,7 +200,7 @@ Criteria with a disk icon require that the image be scanned (see registry scanni + Resource Limit Configuration (RLC). Requires resource limits to be configured for CPU Limit/Request, Memory Limit/Request, and can require operator to be \> or \<= a configured resource value.  + Run as privileged. Typically used to limit or block deployments of privileged containers.  + Run as root. Typically used to limit or block deployments of containers run as root..  -+ Service Account Bound High Risk Role. Can match on multiple criteria which could respresent a high risk service account role, including listing secrets, performing any operations on workloads, modification of RBAC resources, creation of workload resources, and allowing exec into a container.  ++ Service Account Bound High Risk Role. Can match on multiple criteria which could represent a high risk service account role, including listing secrets, performing any operations on workloads, modification of RBAC resources, creation of workload resources, and allowing exec into a container.  + Share host’s IPC namespaces. Matches on IPC namespaces.  + Share host’s Network. Allow or disallow deployments to share the host’s network.  + + Share host’s PID namespaces . Matches on PID namespaces.  diff --git a/versioned_docs/version-5.4/05.policy/05.networkrules/05.networkrules.md b/versioned_docs/version-5.4/05.policy/05.networkrules/05.networkrules.md index 60d8e030e..5ed2aea98 100644 --- a/versioned_docs/version-5.4/05.policy/05.networkrules/05.networkrules.md +++ b/versioned_docs/version-5.4/05.policy/05.networkrules/05.networkrules.md @@ -34,7 +34,7 @@ Add a rule using the `+` either below another rule in the right column, or using > Specify the destination GROUP where these connections are allowed or denied. + **Applications** -> Enter applications for NeuVector to allow or deny. NeuVector understands deep application behavior and will analyze the payload to determine application protocols. Protocols include HTTP, HTTPS, SSL, SSH, DNS, DNCP, NTP, TFTP, ECHO, RTSP, SIP, MySQL, Redis, Zookeeper, Cassandra, MongoDB, PostgresSQL, Kafka, Couchbase, ActiveMQ, ElasticSearch, RabbitMQ, Radius, VoltDB, Consul, Syslog, Etcd, Spark, Apache, Nginx, Jetty, NodeJS, Oracle, MSSQL, Memcached and gRPC. +> Enter applications for NeuVector to allow or deny. NeuVector understands deep application behavior and will analyze the payload to determine application protocols. Protocols include HTTP, HTTPS, SSL, SSH, DNS, DNCP, NTP, TFTP, ECHO, RTSP, SIP, MySQL, Redis, Zookeeper, Cassandra, MongoDB, PostgreSQL, Kafka, Couchbase, ActiveMQ, ElasticSearch, RabbitMQ, Radius, VoltDB, Consul, Syslog, Etcd, Spark, Apache, Nginx, Jetty, NodeJS, Oracle, MSSQL, Memcached and gRPC. :::note To select Any/All, leave this field blank diff --git a/versioned_docs/version-5.4/05.policy/08.responserules/08.responserules.md b/versioned_docs/version-5.4/05.policy/08.responserules/08.responserules.md index 71ee51598..3a60df3fe 100644 --- a/versioned_docs/version-5.4/05.policy/08.responserules/08.responserules.md +++ b/versioned_docs/version-5.4/05.policy/08.responserules/08.responserules.md @@ -121,7 +121,7 @@ The matching logic for multiple criteria in one response rule is: + Choose service group name if rule need to be applied for a particular service group + Choose category Benchmark + Add log level as matching criteria or benchmark number, e.g. “5.12” Ensure the container's root filesystem is mounted as read only -+ Select actions to be applied Quarantine, Webhook and suppress log (quarantine is not applicable Host Docker and Kubenetes benchmark) ++ Select actions to be applied Quarantine, Webhook and suppress log (quarantine is not applicable Host Docker and Kubernetes benchmark) + Enable status ![cis](resp8-b.png) @@ -205,7 +205,7 @@ Configuration.Import Configuration.Export Configuration.Import.Failed Configuration.Export.Failed -Cloud.Scan.Normal // for cloud scan nomal ret +Cloud.Scan.Normal // for cloud scan normal ret Cloud.Scan.Alert // for cloud scan ret with alert Cloud.Scan.Fail // for cloud scan fail Group.Auto.Remove diff --git a/versioned_docs/version-5.4/05.policy/13.usingcrd/13.usingcrd.md b/versioned_docs/version-5.4/05.policy/13.usingcrd/13.usingcrd.md index c7831aa39..10263033e 100644 --- a/versioned_docs/version-5.4/05.policy/13.usingcrd/13.usingcrd.md +++ b/versioned_docs/version-5.4/05.policy/13.usingcrd/13.usingcrd.md @@ -422,7 +422,7 @@ Policy Mode Configuration Yaml file Example + key - Must not be empty + op - Operator - If the operator is equal (=) or not-equal (!=), then its’ value must not be empty. - - If the operator is equal (=) or not-equal (!=) with a value (such as * or ?), then the value cannot have any regular expresssion format like ^$. + - If the operator is equal (=) or not-equal (!=) with a value (such as * or ?), then the value cannot have any regular expression format like ^$. - Example: - Key: service - Op : = @@ -828,9 +828,9 @@ The target is a service called nv.alpine.default in the 'default' namespace. Bec Note that for service nv.alpine.default (defined as nv.xxx.yyy where xxx is the service name like alpine, yyy is the namespace like default) we can define policy mode that it is set to. Here it is defined as Protect mode (blocking all abnormal activity). -Overall since nv.alpine.defult is in protect mode, it will deny containers from running ssh and scp, and also will deny ssh connections from external or http to external. +Overall since nv.alpine.default is in protect mode, it will deny containers from running ssh and scp, and also will deny ssh connections from external or http to external. -If you change the nv.alpine.defult policymode to monitor, then NeuVector will just log it when scp/ssh is invoked, or there are ssh connections from external or http to external. +If you change the nv.alpine.default policymode to monitor, then NeuVector will just log it when scp/ssh is invoked, or there are ssh connections from external or http to external. ```yaml apiVersion: v1 diff --git a/versioned_docs/version-5.4/06.scanning/07.scan_caching/scan_caching.md b/versioned_docs/version-5.4/06.scanning/07.scan_caching/scan_caching.md index b1a88c51d..c8a5509ea 100644 --- a/versioned_docs/version-5.4/06.scanning/07.scan_caching/scan_caching.md +++ b/versioned_docs/version-5.4/06.scanning/07.scan_caching/scan_caching.md @@ -11,7 +11,7 @@ This feature is only supported from v5.4.0 onwards. ### Using scan caching with scanners Scanner caching feature is used to cache image layers on the scanner which will reused for other image scanning requests which significantely reduces the network bandwidth usage. -The feature can be enabled by using "MAX_CACHE_RECORD_MB" environment variable and size allocated for the scanner cache. Recommneded to use "1000" (Size in MegaBytes) +The feature can be enabled by using "MAX_CACHE_RECORD_MB" environment variable and size allocated for the scanner cache. Recommended to use "1000" (Size in MegaBytes) #### Enabling scan caching with HELM deployment Scan caching can be enabled when deploying NeuVector on the cluster or "helm update" can be used to enable the scan caching feature. diff --git a/versioned_docs/version-5.4/08.integration/12.rancher_sso_rbac.md b/versioned_docs/version-5.4/08.integration/12.rancher_sso_rbac.md index 305b4134e..fca6fdf72 100644 --- a/versioned_docs/version-5.4/08.integration/12.rancher_sso_rbac.md +++ b/versioned_docs/version-5.4/08.integration/12.rancher_sso_rbac.md @@ -80,7 +80,7 @@ It is important to note that this integration supports roles in Global, Cluster, ```yaml Verb: * Resource: RuntimeScan (choose runtimescan from drop down) - API: permission.neuvector.com (auot populated) + API: permission.neuvector.com (auto populated) ``` + Create a project/namespace role to allow access to the UI and for SSO to work. Please remember that you must add this user role to your project for it to work as expected: diff --git a/versioned_docs/version-5.4/10.updating/01.updating/01.updating.md b/versioned_docs/version-5.4/10.updating/01.updating/01.updating.md index 2981e049d..df2ada121 100644 --- a/versioned_docs/version-5.4/10.updating/01.updating/01.updating.md +++ b/versioned_docs/version-5.4/10.updating/01.updating/01.updating.md @@ -9,7 +9,7 @@ slug: /updating/updating It’s super easy to update your NeuVector containers. If there is a new release available, pull it from Docker Hub. It is recommended to use a ‘rolling update’ strategy to keep at least one Allinone or Controller container running at any time during an update. -:::warning imporant +:::warning important Host OS updates, reboots, and orchestrator updates can cause pods to be evicted or stopped. If a Controller is affected, and there are no other Controllers active to maintain the state, the Controllers can become available for some time while new controllers are started, a cluster is formed with a leader, and the persistent storage backup of the configuration is attempted to be accessed to restore the cluster. Be careful when scheduling host or orchestrator updates and reboots which may affect the number of controllers available at any time. See the Pod Disruption Budget below for possible ways to mitigate this. If deployment was done using the NeuVector Helm charts, updating will take care of additional services, rolebindings or other upgrade requirements. diff --git a/versioned_docs/version-5.4/12.troubleshooting/02.cli/02.cli.md b/versioned_docs/version-5.4/12.troubleshooting/02.cli/02.cli.md index d9967976a..1163d2726 100644 --- a/versioned_docs/version-5.4/12.troubleshooting/02.cli/02.cli.md +++ b/versioned_docs/version-5.4/12.troubleshooting/02.cli/02.cli.md @@ -70,7 +70,7 @@ MODES: ```shell > set controller debug - Turn off debug mdoe. + Turn off debug mode. ``` More CLI commands are listed below. diff --git a/versioned_docs/version-5.5/01.basics/02.requirements/02.requirements.md b/versioned_docs/version-5.5/01.basics/02.requirements/02.requirements.md index ee2e0f6ea..0941fa8d1 100644 --- a/versioned_docs/version-5.5/01.basics/02.requirements/02.requirements.md +++ b/versioned_docs/version-5.5/01.basics/02.requirements/02.requirements.md @@ -55,7 +55,7 @@ Containers that are in protect mode need an allowed rule between specific contai ## Not Supported * GKE Autopilot. -* AWS ECS is no longer supported. (NOTE: No functionality has been actively removed for operating NeuVector on ECS deployments. However, testing on ECS is no longer being perfromed by SUSE. While protecting ECS workloads with Neuvector likely will operate as expected, issues will not be investigated.) +* AWS ECS is no longer supported. (NOTE: No functionality has been actively removed for operating NeuVector on ECS deployments. However, testing on ECS is no longer being performed by SUSE. While protecting ECS workloads with Neuvector likely will operate as expected, issues will not be investigated.) * Docker on Mac * Docker on Windows * Rkt (container linux) from CoreOS diff --git a/versioned_docs/version-5.5/02.deploying/01.production/01.configmap/01.configmap.md b/versioned_docs/version-5.5/02.deploying/01.production/01.configmap/01.configmap.md index 71fa5fae1..ba88c372c 100644 --- a/versioned_docs/version-5.5/02.deploying/01.production/01.configmap/01.configmap.md +++ b/versioned_docs/version-5.5/02.deploying/01.production/01.configmap/01.configmap.md @@ -522,7 +522,7 @@ Note the removal of the pipe character below if using configmap sections in a se ```yaml secret: - # NOTE: files defined here have preferrence over the ones defined in the configmap section + # NOTE: files defined here have preference over the ones defined in the configmap section enabled: true data: eulainitcfg.yaml: diff --git a/versioned_docs/version-5.5/04.navigation/02.multicluster/02.multicluster.md b/versioned_docs/version-5.5/04.navigation/02.multicluster/02.multicluster.md index 6dfce4ef5..d9d96daf7 100644 --- a/versioned_docs/version-5.5/04.navigation/02.multicluster/02.multicluster.md +++ b/versioned_docs/version-5.5/04.navigation/02.multicluster/02.multicluster.md @@ -67,7 +67,7 @@ The cluster service port `11443` is only accessible after enabling the `fed-mast ``` :::info -The URL for the `curl` command depends on how the `fed-master` services is exposed. If an `ingress` service is configured, it's not neccessary to specify a port. +The URL for the `curl` command depends on how the `fed-master` services is exposed. If an `ingress` service is configured, it's not necessary to specify a port. ::: ```shell @@ -83,7 +83,7 @@ The cluster service port `10443` is shared between `REST API` and the `fed-manag ``` :::info -The URL for the `curl` command depends on how the `fed-managed` services is exposed. If an `ingress` service is configured, it's not neccessary to specify a port. +The URL for the `curl` command depends on how the `fed-managed` services is exposed. If an `ingress` service is configured, it's not necessary to specify a port. ::: ```shell diff --git a/versioned_docs/version-5.5/05.policy/03.admission/03.admission.md b/versioned_docs/version-5.5/05.policy/03.admission/03.admission.md index dd88ffcea..f505c1485 100644 --- a/versioned_docs/version-5.5/05.policy/03.admission/03.admission.md +++ b/versioned_docs/version-5.5/05.policy/03.admission/03.admission.md @@ -163,7 +163,7 @@ Before NeuVector performs the match against the Admission Control rules, NeuVect NeuVector uses this information to match the results in NeuVector Assets -> Registry scan page and collects the corresponding information such as cve name, cve high or medium count etc. Image compliance violations are considered any image which has secrets or setuid/setgid violations. If users are using the image from docker registry to create a cluster resource, normally the registry server information is empty or docker.io and currently NeuVector is using the following hard-coded registry servers to match the registry scan result instead of empty or docker.io string. Of course, if there are more other than the following supported docker registry servers defined in the registry scan page, NeuVector is unable to get the registry scan results successfully. -If users are using the built-in image such as alpine or ubuntu from the docker registry, there is a hidden organization name called library. When you look at the results for docker build-in image in NeuVector Assets > Registry scan page, the repository name will be library/alpine or library/ubuntu. Currently NeuVector assumes there is only one hidden library organization name in docker registry. If there is more than one, NeuVector is unable to get the registry scan results successfully as well. +If users are using the built-in image such as alpine or ubuntu from the docker registry, there is a hidden organization name called library. When you look at the results for docker built-in image in NeuVector Assets > Registry scan page, the repository name will be library/alpine or library/ubuntu. Currently NeuVector assumes there is only one hidden library organization name in docker registry. If there is more than one, NeuVector is unable to get the registry scan results successfully as well. The above limitation could also apply on other type of docker registry servers if any. #### Creating Custom Criteria Rules @@ -200,7 +200,7 @@ Criteria with a disk icon require that the image be scanned (see registry scanni + Resource Limit Configuration (RLC). Requires resource limits to be configured for CPU Limit/Request, Memory Limit/Request, and can require operator to be \> or \<= a configured resource value.  + Run as privileged. Typically used to limit or block deployments of privileged containers.  + Run as root. Typically used to limit or block deployments of containers run as root..  -+ Service Account Bound High Risk Role. Can match on multiple criteria which could respresent a high risk service account role, including listing secrets, performing any operations on workloads, modification of RBAC resources, creation of workload resources, and allowing exec into a container.  ++ Service Account Bound High Risk Role. Can match on multiple criteria which could represent a high risk service account role, including listing secrets, performing any operations on workloads, modification of RBAC resources, creation of workload resources, and allowing exec into a container.  + Share host’s IPC namespaces. Matches on IPC namespaces.  + Share host’s Network. Allow or disallow deployments to share the host’s network.  + + Share host’s PID namespaces . Matches on PID namespaces.  diff --git a/versioned_docs/version-5.5/05.policy/05.networkrules/05.networkrules.md b/versioned_docs/version-5.5/05.policy/05.networkrules/05.networkrules.md index 60d8e030e..5ed2aea98 100644 --- a/versioned_docs/version-5.5/05.policy/05.networkrules/05.networkrules.md +++ b/versioned_docs/version-5.5/05.policy/05.networkrules/05.networkrules.md @@ -34,7 +34,7 @@ Add a rule using the `+` either below another rule in the right column, or using > Specify the destination GROUP where these connections are allowed or denied. + **Applications** -> Enter applications for NeuVector to allow or deny. NeuVector understands deep application behavior and will analyze the payload to determine application protocols. Protocols include HTTP, HTTPS, SSL, SSH, DNS, DNCP, NTP, TFTP, ECHO, RTSP, SIP, MySQL, Redis, Zookeeper, Cassandra, MongoDB, PostgresSQL, Kafka, Couchbase, ActiveMQ, ElasticSearch, RabbitMQ, Radius, VoltDB, Consul, Syslog, Etcd, Spark, Apache, Nginx, Jetty, NodeJS, Oracle, MSSQL, Memcached and gRPC. +> Enter applications for NeuVector to allow or deny. NeuVector understands deep application behavior and will analyze the payload to determine application protocols. Protocols include HTTP, HTTPS, SSL, SSH, DNS, DNCP, NTP, TFTP, ECHO, RTSP, SIP, MySQL, Redis, Zookeeper, Cassandra, MongoDB, PostgreSQL, Kafka, Couchbase, ActiveMQ, ElasticSearch, RabbitMQ, Radius, VoltDB, Consul, Syslog, Etcd, Spark, Apache, Nginx, Jetty, NodeJS, Oracle, MSSQL, Memcached and gRPC. :::note To select Any/All, leave this field blank diff --git a/versioned_docs/version-5.5/05.policy/08.responserules/08.responserules.md b/versioned_docs/version-5.5/05.policy/08.responserules/08.responserules.md index 71ee51598..3a60df3fe 100644 --- a/versioned_docs/version-5.5/05.policy/08.responserules/08.responserules.md +++ b/versioned_docs/version-5.5/05.policy/08.responserules/08.responserules.md @@ -121,7 +121,7 @@ The matching logic for multiple criteria in one response rule is: + Choose service group name if rule need to be applied for a particular service group + Choose category Benchmark + Add log level as matching criteria or benchmark number, e.g. “5.12” Ensure the container's root filesystem is mounted as read only -+ Select actions to be applied Quarantine, Webhook and suppress log (quarantine is not applicable Host Docker and Kubenetes benchmark) ++ Select actions to be applied Quarantine, Webhook and suppress log (quarantine is not applicable Host Docker and Kubernetes benchmark) + Enable status ![cis](resp8-b.png) @@ -205,7 +205,7 @@ Configuration.Import Configuration.Export Configuration.Import.Failed Configuration.Export.Failed -Cloud.Scan.Normal // for cloud scan nomal ret +Cloud.Scan.Normal // for cloud scan normal ret Cloud.Scan.Alert // for cloud scan ret with alert Cloud.Scan.Fail // for cloud scan fail Group.Auto.Remove diff --git a/versioned_docs/version-5.5/05.policy/13.usingcrd/13.usingcrd.md b/versioned_docs/version-5.5/05.policy/13.usingcrd/13.usingcrd.md index c7831aa39..10263033e 100644 --- a/versioned_docs/version-5.5/05.policy/13.usingcrd/13.usingcrd.md +++ b/versioned_docs/version-5.5/05.policy/13.usingcrd/13.usingcrd.md @@ -422,7 +422,7 @@ Policy Mode Configuration Yaml file Example + key - Must not be empty + op - Operator - If the operator is equal (=) or not-equal (!=), then its’ value must not be empty. - - If the operator is equal (=) or not-equal (!=) with a value (such as * or ?), then the value cannot have any regular expresssion format like ^$. + - If the operator is equal (=) or not-equal (!=) with a value (such as * or ?), then the value cannot have any regular expression format like ^$. - Example: - Key: service - Op : = @@ -828,9 +828,9 @@ The target is a service called nv.alpine.default in the 'default' namespace. Bec Note that for service nv.alpine.default (defined as nv.xxx.yyy where xxx is the service name like alpine, yyy is the namespace like default) we can define policy mode that it is set to. Here it is defined as Protect mode (blocking all abnormal activity). -Overall since nv.alpine.defult is in protect mode, it will deny containers from running ssh and scp, and also will deny ssh connections from external or http to external. +Overall since nv.alpine.default is in protect mode, it will deny containers from running ssh and scp, and also will deny ssh connections from external or http to external. -If you change the nv.alpine.defult policymode to monitor, then NeuVector will just log it when scp/ssh is invoked, or there are ssh connections from external or http to external. +If you change the nv.alpine.default policymode to monitor, then NeuVector will just log it when scp/ssh is invoked, or there are ssh connections from external or http to external. ```yaml apiVersion: v1 diff --git a/versioned_docs/version-5.5/06.scanning/07.scan_caching/scan_caching.md b/versioned_docs/version-5.5/06.scanning/07.scan_caching/scan_caching.md index b1a88c51d..c8a5509ea 100644 --- a/versioned_docs/version-5.5/06.scanning/07.scan_caching/scan_caching.md +++ b/versioned_docs/version-5.5/06.scanning/07.scan_caching/scan_caching.md @@ -11,7 +11,7 @@ This feature is only supported from v5.4.0 onwards. ### Using scan caching with scanners Scanner caching feature is used to cache image layers on the scanner which will reused for other image scanning requests which significantely reduces the network bandwidth usage. -The feature can be enabled by using "MAX_CACHE_RECORD_MB" environment variable and size allocated for the scanner cache. Recommneded to use "1000" (Size in MegaBytes) +The feature can be enabled by using "MAX_CACHE_RECORD_MB" environment variable and size allocated for the scanner cache. Recommended to use "1000" (Size in MegaBytes) #### Enabling scan caching with HELM deployment Scan caching can be enabled when deploying NeuVector on the cluster or "helm update" can be used to enable the scan caching feature. diff --git a/versioned_docs/version-5.5/08.integration/12.rancher_sso_rbac.md b/versioned_docs/version-5.5/08.integration/12.rancher_sso_rbac.md index 305b4134e..fca6fdf72 100644 --- a/versioned_docs/version-5.5/08.integration/12.rancher_sso_rbac.md +++ b/versioned_docs/version-5.5/08.integration/12.rancher_sso_rbac.md @@ -80,7 +80,7 @@ It is important to note that this integration supports roles in Global, Cluster, ```yaml Verb: * Resource: RuntimeScan (choose runtimescan from drop down) - API: permission.neuvector.com (auot populated) + API: permission.neuvector.com (auto populated) ``` + Create a project/namespace role to allow access to the UI and for SSO to work. Please remember that you must add this user role to your project for it to work as expected: diff --git a/versioned_docs/version-5.5/10.updating/01.updating/01.updating.md b/versioned_docs/version-5.5/10.updating/01.updating/01.updating.md index 2981e049d..df2ada121 100644 --- a/versioned_docs/version-5.5/10.updating/01.updating/01.updating.md +++ b/versioned_docs/version-5.5/10.updating/01.updating/01.updating.md @@ -9,7 +9,7 @@ slug: /updating/updating It’s super easy to update your NeuVector containers. If there is a new release available, pull it from Docker Hub. It is recommended to use a ‘rolling update’ strategy to keep at least one Allinone or Controller container running at any time during an update. -:::warning imporant +:::warning important Host OS updates, reboots, and orchestrator updates can cause pods to be evicted or stopped. If a Controller is affected, and there are no other Controllers active to maintain the state, the Controllers can become available for some time while new controllers are started, a cluster is formed with a leader, and the persistent storage backup of the configuration is attempted to be accessed to restore the cluster. Be careful when scheduling host or orchestrator updates and reboots which may affect the number of controllers available at any time. See the Pod Disruption Budget below for possible ways to mitigate this. If deployment was done using the NeuVector Helm charts, updating will take care of additional services, rolebindings or other upgrade requirements. diff --git a/versioned_docs/version-5.5/12.troubleshooting/02.cli/02.cli.md b/versioned_docs/version-5.5/12.troubleshooting/02.cli/02.cli.md index d9967976a..1163d2726 100644 --- a/versioned_docs/version-5.5/12.troubleshooting/02.cli/02.cli.md +++ b/versioned_docs/version-5.5/12.troubleshooting/02.cli/02.cli.md @@ -70,7 +70,7 @@ MODES: ```shell > set controller debug - Turn off debug mdoe. + Turn off debug mode. ``` More CLI commands are listed below. diff --git a/versioned_docs/version-5.6/01.basics/02.requirements/02.requirements.md b/versioned_docs/version-5.6/01.basics/02.requirements/02.requirements.md index 8cd740792..34a7ae4af 100644 --- a/versioned_docs/version-5.6/01.basics/02.requirements/02.requirements.md +++ b/versioned_docs/version-5.6/01.basics/02.requirements/02.requirements.md @@ -53,7 +53,7 @@ Containers that are in protect mode need an allowed rule between specific contai ## Not Supported -* AWS ECS is no longer supported. (NOTE: No functionality has been actively removed for operating NeuVector on ECS deployments. However, testing on ECS is no longer being perfromed by SUSE. While protecting ECS workloads with Neuvector likely will operate as expected, issues will not be investigated.) +* AWS ECS is no longer supported. (NOTE: No functionality has been actively removed for operating NeuVector on ECS deployments. However, testing on ECS is no longer being performed by SUSE. While protecting ECS workloads with Neuvector likely will operate as expected, issues will not be investigated.) * Docker on Mac * Docker on Windows * Docker on Linux - Allinone support is deprecated from v5.5.0 diff --git a/versioned_docs/version-5.6/02.deploying/01.production/01.configmap/01.configmap.md b/versioned_docs/version-5.6/02.deploying/01.production/01.configmap/01.configmap.md index 0507197df..a40e0a047 100644 --- a/versioned_docs/version-5.6/02.deploying/01.production/01.configmap/01.configmap.md +++ b/versioned_docs/version-5.6/02.deploying/01.production/01.configmap/01.configmap.md @@ -522,7 +522,7 @@ Note the removal of the pipe character below if using configmap sections in a se ```yaml secret: - # NOTE: files defined here have preferrence over the ones defined in the configmap section + # NOTE: files defined here have preference over the ones defined in the configmap section enabled: true data: eulainitcfg.yaml: diff --git a/versioned_docs/version-5.6/04.navigation/02.multicluster/02.multicluster.md b/versioned_docs/version-5.6/04.navigation/02.multicluster/02.multicluster.md index 6dfce4ef5..d9d96daf7 100644 --- a/versioned_docs/version-5.6/04.navigation/02.multicluster/02.multicluster.md +++ b/versioned_docs/version-5.6/04.navigation/02.multicluster/02.multicluster.md @@ -67,7 +67,7 @@ The cluster service port `11443` is only accessible after enabling the `fed-mast ``` :::info -The URL for the `curl` command depends on how the `fed-master` services is exposed. If an `ingress` service is configured, it's not neccessary to specify a port. +The URL for the `curl` command depends on how the `fed-master` services is exposed. If an `ingress` service is configured, it's not necessary to specify a port. ::: ```shell @@ -83,7 +83,7 @@ The cluster service port `10443` is shared between `REST API` and the `fed-manag ``` :::info -The URL for the `curl` command depends on how the `fed-managed` services is exposed. If an `ingress` service is configured, it's not neccessary to specify a port. +The URL for the `curl` command depends on how the `fed-managed` services is exposed. If an `ingress` service is configured, it's not necessary to specify a port. ::: ```shell diff --git a/versioned_docs/version-5.6/05.policy/03.admission/03.admission.md b/versioned_docs/version-5.6/05.policy/03.admission/03.admission.md index bcb97ec20..8b28dff2e 100644 --- a/versioned_docs/version-5.6/05.policy/03.admission/03.admission.md +++ b/versioned_docs/version-5.6/05.policy/03.admission/03.admission.md @@ -163,7 +163,7 @@ Before NeuVector performs the match against the Admission Control rules, NeuVect NeuVector uses this information to match the results in NeuVector Assets -> Registry scan page and collects the corresponding information such as cve name, cve high or medium count etc. Image compliance violations are considered any image which has secrets or setuid/setgid violations. If users are using the image from docker registry to create a cluster resource, normally the registry server information is empty or docker.io and currently NeuVector is using the following hard-coded registry servers to match the registry scan result instead of empty or docker.io string. Of course, if there are more other than the following supported docker registry servers defined in the registry scan page, NeuVector is unable to get the registry scan results successfully. -If users are using the built-in image such as alpine or ubuntu from the docker registry, there is a hidden organization name called library. When you look at the results for docker build-in image in NeuVector Assets > Registry scan page, the repository name will be library/alpine or library/ubuntu. Currently NeuVector assumes there is only one hidden library organization name in docker registry. If there is more than one, NeuVector is unable to get the registry scan results successfully as well. +If users are using the built-in image such as alpine or ubuntu from the docker registry, there is a hidden organization name called library. When you look at the results for docker built-in image in NeuVector Assets > Registry scan page, the repository name will be library/alpine or library/ubuntu. Currently NeuVector assumes there is only one hidden library organization name in docker registry. If there is more than one, NeuVector is unable to get the registry scan results successfully as well. The above limitation could also apply on other type of docker registry servers if any. #### Creating Custom Criteria Rules @@ -200,7 +200,7 @@ Criteria with a disk icon require that the image be scanned (see registry scanni + Resource Limit Configuration (RLC). Requires resource limits to be configured for CPU Limit/Request, Memory Limit/Request, and can require operator to be \> or \<= a configured resource value.  + Run as privileged. Typically used to limit or block deployments of privileged containers.  + Run as root. Typically used to limit or block deployments of containers run as root..  -+ Service Account Bound High Risk Role. Can match on multiple criteria which could respresent a high risk service account role, including listing secrets, performing any operations on workloads, modification of RBAC resources, creation of workload resources, and allowing exec into a container.  ++ Service Account Bound High Risk Role. Can match on multiple criteria which could represent a high risk service account role, including listing secrets, performing any operations on workloads, modification of RBAC resources, creation of workload resources, and allowing exec into a container.  + Share host’s IPC namespaces. Matches on IPC namespaces.  + Share host’s Network. Allow or disallow deployments to share the host’s network.  + + Share host’s PID namespaces . Matches on PID namespaces.  diff --git a/versioned_docs/version-5.6/05.policy/04.groups/04.groups.md b/versioned_docs/version-5.6/05.policy/04.groups/04.groups.md index 614eb9a64..91027c010 100644 --- a/versioned_docs/version-5.6/05.policy/04.groups/04.groups.md +++ b/versioned_docs/version-5.6/05.policy/04.groups/04.groups.md @@ -46,7 +46,7 @@ You can configure the following DDoS detection thresholds: + **Group Session Rate** > Connection Per Second(CPS) on the group, exceeding this rate can trigger a warning event + **Group Bandwidth** -> Throughput meassured in (Mb/s) on the group, exceeding this bandwidth threshold can trigger a warning event +> Throughput measured in (Mb/s) on the group, exceeding this bandwidth threshold can trigger a warning event ![ddosDetection](group_ddos_threshold.png) diff --git a/versioned_docs/version-5.6/05.policy/05.networkrules/05.networkrules.md b/versioned_docs/version-5.6/05.policy/05.networkrules/05.networkrules.md index 90042218c..ac86c9d2e 100644 --- a/versioned_docs/version-5.6/05.policy/05.networkrules/05.networkrules.md +++ b/versioned_docs/version-5.6/05.policy/05.networkrules/05.networkrules.md @@ -34,7 +34,7 @@ Add a rule using the `+` either below another rule in the right column, or using > Specify the destination GROUP where these connections are allowed or denied. + **Applications** -> Enter applications for NeuVector to allow or deny. NeuVector understands deep application behavior and will analyze the payload to determine application protocols. Protocols include HTTP, HTTPS, SSL, SSH, DNS, DNCP, NTP, TFTP, ECHO, RTSP, SIP, MySQL, Redis, Zookeeper, Cassandra, MongoDB, PostgresSQL, Kafka, Couchbase, ActiveMQ, ElasticSearch, RabbitMQ, Radius, VoltDB, Consul, Syslog, Etcd, Spark, Apache, Nginx, Jetty, NodeJS, Oracle, MSSQL, Memcached and gRPC. +> Enter applications for NeuVector to allow or deny. NeuVector understands deep application behavior and will analyze the payload to determine application protocols. Protocols include HTTP, HTTPS, SSL, SSH, DNS, DNCP, NTP, TFTP, ECHO, RTSP, SIP, MySQL, Redis, Zookeeper, Cassandra, MongoDB, PostgreSQL, Kafka, Couchbase, ActiveMQ, ElasticSearch, RabbitMQ, Radius, VoltDB, Consul, Syslog, Etcd, Spark, Apache, Nginx, Jetty, NodeJS, Oracle, MSSQL, Memcached and gRPC. :::note To select Any/All, leave this field blank diff --git a/versioned_docs/version-5.6/05.policy/08.responserules/08.responserules.md b/versioned_docs/version-5.6/05.policy/08.responserules/08.responserules.md index 45fe2f2a4..9335efddb 100644 --- a/versioned_docs/version-5.6/05.policy/08.responserules/08.responserules.md +++ b/versioned_docs/version-5.6/05.policy/08.responserules/08.responserules.md @@ -121,7 +121,7 @@ The matching logic for multiple criteria in one response rule is: + Choose service group name if rule need to be applied for a particular service group + Choose category Benchmark + Add log level as matching criteria or benchmark number, e.g. “5.12” Ensure the container's root filesystem is mounted as read only -+ Select actions to be applied Quarantine, Webhook and suppress log (quarantine is not applicable Host Docker and Kubenetes benchmark) ++ Select actions to be applied Quarantine, Webhook and suppress log (quarantine is not applicable Host Docker and Kubernetes benchmark) + Enable status ![cis](resp8-b.png) @@ -205,7 +205,7 @@ Configuration.Import Configuration.Export Configuration.Import.Failed Configuration.Export.Failed -Cloud.Scan.Normal // for cloud scan nomal ret +Cloud.Scan.Normal // for cloud scan normal ret Cloud.Scan.Alert // for cloud scan ret with alert Cloud.Scan.Fail // for cloud scan fail Group.Auto.Remove diff --git a/versioned_docs/version-5.6/05.policy/13.usingcrd/13.usingcrd.md b/versioned_docs/version-5.6/05.policy/13.usingcrd/13.usingcrd.md index c7831aa39..10263033e 100644 --- a/versioned_docs/version-5.6/05.policy/13.usingcrd/13.usingcrd.md +++ b/versioned_docs/version-5.6/05.policy/13.usingcrd/13.usingcrd.md @@ -422,7 +422,7 @@ Policy Mode Configuration Yaml file Example + key - Must not be empty + op - Operator - If the operator is equal (=) or not-equal (!=), then its’ value must not be empty. - - If the operator is equal (=) or not-equal (!=) with a value (such as * or ?), then the value cannot have any regular expresssion format like ^$. + - If the operator is equal (=) or not-equal (!=) with a value (such as * or ?), then the value cannot have any regular expression format like ^$. - Example: - Key: service - Op : = @@ -828,9 +828,9 @@ The target is a service called nv.alpine.default in the 'default' namespace. Bec Note that for service nv.alpine.default (defined as nv.xxx.yyy where xxx is the service name like alpine, yyy is the namespace like default) we can define policy mode that it is set to. Here it is defined as Protect mode (blocking all abnormal activity). -Overall since nv.alpine.defult is in protect mode, it will deny containers from running ssh and scp, and also will deny ssh connections from external or http to external. +Overall since nv.alpine.default is in protect mode, it will deny containers from running ssh and scp, and also will deny ssh connections from external or http to external. -If you change the nv.alpine.defult policymode to monitor, then NeuVector will just log it when scp/ssh is invoked, or there are ssh connections from external or http to external. +If you change the nv.alpine.default policymode to monitor, then NeuVector will just log it when scp/ssh is invoked, or there are ssh connections from external or http to external. ```yaml apiVersion: v1 diff --git a/versioned_docs/version-5.6/08.integration/12.rancher_sso_rbac.md b/versioned_docs/version-5.6/08.integration/12.rancher_sso_rbac.md index 737c1ad66..c8832cfc1 100644 --- a/versioned_docs/version-5.6/08.integration/12.rancher_sso_rbac.md +++ b/versioned_docs/version-5.6/08.integration/12.rancher_sso_rbac.md @@ -80,7 +80,7 @@ It is important to note that this integration supports roles in Global, Cluster, ```yaml Verb: * Resource: RuntimeScan (choose runtimescan from drop down) - API: permission.neuvector.com (auot populated) + API: permission.neuvector.com (auto populated) ``` + Create a project/namespace role to allow access to the UI and for SSO to work. Please remember that you must add this user role to your project for it to work as expected: diff --git a/versioned_docs/version-5.6/10.updating/01.updating/01.updating.md b/versioned_docs/version-5.6/10.updating/01.updating/01.updating.md index aef4c386b..8bc8e2110 100644 --- a/versioned_docs/version-5.6/10.updating/01.updating/01.updating.md +++ b/versioned_docs/version-5.6/10.updating/01.updating/01.updating.md @@ -15,7 +15,7 @@ When upgrading controllers to version `5.6.0-rc1` (or later) from a version that Older scanner pods cache the controller's initial capability response. They will not recognize that the upgraded controller supports critical-level severity until they are restarted and re-query the controller on startup. ::: -:::warning imporant +:::warning important Host OS updates, reboots, and orchestrator updates can cause pods to be evicted or stopped. If a Controller is affected, and there are no other Controllers active to maintain the state, the Controllers can become available for some time while new controllers are started, a cluster is formed with a leader, and the persistent storage backup of the configuration is attempted to be accessed to restore the cluster. Be careful when scheduling host or orchestrator updates and reboots which may affect the number of controllers available at any time. See the Pod Disruption Budget below for possible ways to mitigate this. If deployment was done using the NeuVector Helm charts, updating will take care of additional services, rolebindings or other upgrade requirements. diff --git a/versioned_docs/version-5.6/12.troubleshooting/02.cli/02.cli.md b/versioned_docs/version-5.6/12.troubleshooting/02.cli/02.cli.md index d9967976a..1163d2726 100644 --- a/versioned_docs/version-5.6/12.troubleshooting/02.cli/02.cli.md +++ b/versioned_docs/version-5.6/12.troubleshooting/02.cli/02.cli.md @@ -70,7 +70,7 @@ MODES: ```shell > set controller debug - Turn off debug mdoe. + Turn off debug mode. ``` More CLI commands are listed below.