---
# System prepended metadata

title: 部屬 Neuvector 5.3.2
tags: [工具]

---

# 部屬 Neuvector 5.3.2
## 使用 Yaml 部屬
1. 建立 NeuVector namespace 和所需的 sa
```
kubectl create namespace neuvector && \
kubectl create sa controller -n neuvector && \
kubectl create sa enforcer -n neuvector && \
kubectl create sa basic -n neuvector && \
kubectl create sa updater -n neuvector && \
kubectl create sa scanner -n neuvector && \
kubectl create sa registry-adapter -n neuvector
```
2. 對於 Kubernetes 1.25+ 中的 PSA，使用特權設定檔標記 NeuVector 命名空間，以便在啟用 PSA 的叢集上進行部署。
```
kubectl label namespace neuvector "pod-security.kubernetes.io/enforce=privileged"
```
3. 對於 Kubernetes 1.19+ 為 NeuVector 安全性規則建立自訂資源 (CRD)。
```
kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.3.0/crd-k8s-1.19.yaml
kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.3.0/waf-crd-k8s-1.19.yaml
kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.3.0/dlp-crd-k8s-1.19.yaml
kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.3.0/com-crd-k8s-1.19.yaml
kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.3.0/vul-crd-k8s-1.19.yaml
kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.3.0/admission-crd-k8s-1.19.yaml
```

4. 建立 clusterrole

```
kubectl create clusterrole neuvector-binding-app --verb=get,list,watch,update --resource=nodes,pods,services,namespaces && \
kubectl create clusterrole neuvector-binding-rbac --verb=get,list,watch --resource=rolebindings.rbac.authorization.k8s.io,roles.rbac.authorization.k8s.io,clusterrolebindings.rbac.authorization.k8s.io,clusterroles.rbac.authorization.k8s.io && \
kubectl create clusterrolebinding neuvector-binding-app --clusterrole=neuvector-binding-app --serviceaccount=neuvector:controller && \
kubectl create clusterrolebinding neuvector-binding-rbac --clusterrole=neuvector-binding-rbac --serviceaccount=neuvector:controller && \
kubectl create clusterrole neuvector-binding-admission --verb=get,list,watch,create,update,delete --resource=validatingwebhookconfigurations,mutatingwebhookconfigurations && \
kubectl create clusterrolebinding neuvector-binding-admission --clusterrole=neuvector-binding-admission --serviceaccount=neuvector:controller && \
kubectl create clusterrole neuvector-binding-customresourcedefinition --verb=watch,create,get,update --resource=customresourcedefinitions && \
kubectl create clusterrolebinding neuvector-binding-customresourcedefinition --clusterrole=neuvector-binding-customresourcedefinition --serviceaccount=neuvector:controller && \
kubectl create clusterrole neuvector-binding-nvsecurityrules --verb=get,list,delete --resource=nvsecurityrules,nvclustersecurityrules && \
kubectl create clusterrole neuvector-binding-nvadmissioncontrolsecurityrules --verb=get,list,delete --resource=nvadmissioncontrolsecurityrules && \
kubectl create clusterrole neuvector-binding-nvdlpsecurityrules --verb=get,list,delete --resource=nvdlpsecurityrules && \
kubectl create clusterrole neuvector-binding-nvwafsecurityrules --verb=get,list,delete --resource=nvwafsecurityrules && \
kubectl create clusterrolebinding neuvector-binding-nvsecurityrules --clusterrole=neuvector-binding-nvsecurityrules --serviceaccount=neuvector:controller && \
kubectl create clusterrolebinding neuvector-binding-view --clusterrole=view --serviceaccount=neuvector:controller && \
kubectl create clusterrolebinding neuvector-binding-nvwafsecurityrules --clusterrole=neuvector-binding-nvwafsecurityrules --serviceaccount=neuvector:controller && \
kubectl create clusterrolebinding neuvector-binding-nvadmissioncontrolsecurityrules --clusterrole=neuvector-binding-nvadmissioncontrolsecurityrules --serviceaccount=neuvector:controller && \
kubectl create clusterrolebinding neuvector-binding-nvdlpsecurityrules --clusterrole=neuvector-binding-nvdlpsecurityrules --serviceaccount=neuvector:controller && \
kubectl create role neuvector-binding-scanner --verb=get,patch,update,watch --resource=deployments -n neuvector && \
kubectl create rolebinding neuvector-binding-scanner --role=neuvector-binding-scanner --serviceaccount=neuvector:updater --serviceaccount=neuvector:controller -n neuvector && \
kubectl create role neuvector-binding-secret --verb=get --resource=secrets -n neuvector && \
kubectl create rolebinding neuvector-binding-secret --role=neuvector-binding-secret --serviceaccount=neuvector:controller -n neuvector && \
kubectl create clusterrole neuvector-binding-nvcomplianceprofiles --verb=get,list,delete --resource=nvcomplianceprofiles && \
kubectl create clusterrolebinding neuvector-binding-nvcomplianceprofiles --clusterrole=neuvector-binding-nvcomplianceprofiles --serviceaccount=neuvector:controller && \
kubectl create clusterrole neuvector-binding-nvvulnerabilityprofiles --verb=get,list,delete --resource=nvvulnerabilityprofiles && \
kubectl create clusterrolebinding neuvector-binding-nvvulnerabilityprofiles --clusterrole=neuvector-binding-nvvulnerabilityprofiles --serviceaccount=neuvector:controller
```

5. 執行以下指令，檢查 neuvector/controller 和 neuvector/updater 服務帳號是否已新增成功。
```
kubectl get ClusterRoleBinding neuvector-binding-app neuvector-binding-rbac neuvector-binding-admission neuvector-binding-customresourcedefinition neuvector-binding-nvsecurityrules neuvector-binding-view neuvector-binding-nvwafsecurityrules neuvector-binding-nvadmissioncontrolsecurityrules neuvector-binding-nvdlpsecurityrules -o wide
```
* 螢幕輸出
```
NAME                                                ROLE                                                            AGE   USERS   GROUPS   SERVICEACCOUNTS
neuvector-binding-app                               ClusterRole/neuvector-binding-app                               54s                    neuvector/controller
neuvector-binding-rbac                              ClusterRole/neuvector-binding-rbac                              54s                    neuvector/controller
neuvector-binding-admission                         ClusterRole/neuvector-binding-admission                         54s                    neuvector/controller
neuvector-binding-customresourcedefinition          ClusterRole/neuvector-binding-customresourcedefinition          53s                    neuvector/controller
neuvector-binding-nvsecurityrules                   ClusterRole/neuvector-binding-nvsecurityrules                   52s                    neuvector/controller
neuvector-binding-view                              ClusterRole/view                                                52s                    neuvector/controller
neuvector-binding-nvwafsecurityrules                ClusterRole/neuvector-binding-nvwafsecurityrules                52s                    neuvector/controller
neuvector-binding-nvadmissioncontrolsecurityrules   ClusterRole/neuvector-binding-nvadmissioncontrolsecurityrules   51s                    neuvector/controller
neuvector-binding-nvdlpsecurityrules                ClusterRole/neuvector-binding-nvdlpsecurityrules                51s                    neuvector/controller
```
* 檢查
```
kubectl get RoleBinding neuvector-binding-scanner -n neuvector -o wide
```
* 螢幕輸出
```
NAME                        ROLE                             AGE    USERS   GROUPS   SERVICEACCOUNTS
neuvector-binding-scanner   Role/neuvector-binding-scanner   107s                    neuvector/updater, neuvector/controller
```

6. 建立 NeuVector 主要 Service 和 Pod
> 注意!此 yaml 的 service 是 LoadBalancer，因此需要可以建立 service type 為 LoadBalancer。
```
kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.3.0/neuvector-k8s.yaml
```

7. 檢查 Neuvector 環境
```
kubectl -n neuvector get all
```
* 螢幕輸出
```
NAME                                            READY   STATUS    RESTARTS   AGE
pod/neuvector-controller-pod-574dc86d7b-bxn77   1/1     Running   0          5m20s
pod/neuvector-controller-pod-574dc86d7b-tkd5k   1/1     Running   0          5m20s
pod/neuvector-controller-pod-574dc86d7b-w6vqq   1/1     Running   0          5m20s
pod/neuvector-enforcer-pod-84qdh                1/1     Running   0          5m20s
pod/neuvector-enforcer-pod-dhrwp                1/1     Running   0          5m20s
pod/neuvector-enforcer-pod-jxs7k                1/1     Running   0          5m20s
pod/neuvector-enforcer-pod-rc7lm                1/1     Running   0          5m20s
pod/neuvector-manager-pod-76749f57c-wfjt6       1/1     Running   0          5m20s
pod/neuvector-scanner-pod-787774b697-7dznh      1/1     Running   0          5m20s
pod/neuvector-scanner-pod-787774b697-zpcf9      1/1     Running   0          5m20s

NAME                                      TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)                         AGE
service/neuvector-service-webui           LoadBalancer   10.43.97.8      192.168.11.146   8443:30923/TCP                  5m21s
service/neuvector-svc-admission-webhook   ClusterIP      10.43.229.118   <none>           443/TCP                         5m21s
service/neuvector-svc-controller          ClusterIP      None            <none>           18300/TCP,18301/TCP,18301/UDP   5m21s
service/neuvector-svc-crd-webhook         ClusterIP      10.43.152.38    <none>           443/TCP                         5m21s

NAME                                    DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
daemonset.apps/neuvector-enforcer-pod   4         4         4       4            4           <none>          5m20s

NAME                                       READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/neuvector-controller-pod   3/3     3            3           5m20s
deployment.apps/neuvector-manager-pod      1/1     1            1           5m20s
deployment.apps/neuvector-scanner-pod      2/2     2            2           5m20s

NAME                                                  DESIRED   CURRENT   READY   AGE
replicaset.apps/neuvector-controller-pod-574dc86d7b   3         3         3       5m20s
replicaset.apps/neuvector-manager-pod-76749f57c       1         1         1       5m20s
replicaset.apps/neuvector-scanner-pod-787774b697      2         2         2       5m20s

NAME                                  SCHEDULE    SUSPEND   ACTIVE   LAST SCHEDULE   AGE
cronjob.batch/neuvector-updater-pod   0 0 * * *   False     0        <none>          5m20s
```



## 登入 Neuvector

* 帳號/密碼:admin/admin
* 檢查 service 資訊，使用 `https://192.168.11.146:8443` 登入
```
kubectl get svc -n neuvector neuvector-service-webui
```
* 螢幕輸出
```
NAME                      TYPE           CLUSTER-IP   EXTERNAL-IP      PORT(S)          AGE
neuvector-service-webui   LoadBalancer   10.43.97.8   192.168.11.146   8443:30923/TCP   6m21s
```
* 登入畫面

![image](https://hackmd.io/_uploads/SkqQPj54C.png)


## 使用 helm 部屬

* 以下為在 rke2 cluster 上部屬
```
$ helm repo add neuvector https://neuvector.github.io/neuvector-helm/

$ helm search repo neuvector/core
NAME            CHART VERSION   APP VERSION     DESCRIPTION
neuvector/core  2.7.6           5.3.2           Helm chart for NeuVector's core services

$ helm show values neuvector/core --version 2.7.6 > neuvector-values.yaml

$ nano neuvector-values.yaml
......
k3s:
  enabled: true
  runtimePath: /run/k3s/containerd/containerd.sock

$ kubectl create ns neuvector

$ helm install neuvector neuvector/core --version 2.7.6 --namespace neuvector --values neuvector-values.yaml
```
* 環境檢查
```
$ kubectl -n neuvector get po
NAME                                       READY   STATUS    RESTARTS   AGE
neuvector-controller-pod-f7b49c6dc-8xzvt   1/1     Running   0          65s
neuvector-controller-pod-f7b49c6dc-mv728   1/1     Running   0          65s
neuvector-controller-pod-f7b49c6dc-nkvk8   1/1     Running   0          65s
neuvector-enforcer-pod-jvgj8               1/1     Running   0          65s
neuvector-manager-pod-6945bb7858-4rfxw     1/1     Running   0          65s
neuvector-scanner-pod-654b465b64-bzhg8     1/1     Running   0          65s
neuvector-scanner-pod-654b465b64-mkmcl     1/1     Running   0          65s
neuvector-scanner-pod-654b465b64-vhpzh     1/1     Running   0          65s
```
* 離線安裝，獲取 chart 離線檔
```
$ helm fetch neuvector/core --version=2.8.6

$ ls -l core*
-rw-r--r-- 1 root root 34125 May 20 13:54 core-2.8.6.tgz
```
* 開始部屬 Neuvector
```
$ kubectl create namespace neuvector

$ nano neuvector-values.yaml
......
k3s:
  enabled: true
  runtimePath: /run/k3s/containerd/containerd.sock

$ helm install neuvector core-2.8.6.tgz \
  -n neuvector \
  -f neuvector-values.yaml
```

## 參考文件

https://open-docs.neuvector.com/deploying/kubernetes/
