---
# System prepended metadata

title: OCP 4.18 + NeuVector 5.4.X

---

OCP 4.18 + NeuVector 5.4.1

:::warning
Image請用最新的stable版本。
請先push image到客戶指定的registry。
:::

# 1.建立相關的project、account
```shell=
oc create sa controller -n neuvector
oc create sa enforcer -n neuvector
oc create sa basic -n neuvector
oc create sa updater -n neuvector
oc create sa scanner -n neuvector
oc create sa registry-adapter -n neuvector
oc create sa cert-upgrader -n neuvector
oc -n neuvector adm policy add-scc-to-user privileged -z enforcer

serviceaccount/controller created
serviceaccount/enforcer created
serviceaccount/basic created
serviceaccount/updater created
serviceaccount/scanner created
serviceaccount/registry-adapter created
serviceaccount/cert-upgrader created
clusterrole.rbac.authorization.k8s.io/system:openshift:scc:privileged added: "enforcer"
```

# 2.建立NeuVector controller與設定組態。

```yaml=
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: false
allowPrivilegedContainer: false
allowedCapabilities: null
apiVersion: security.openshift.io/v1
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
groups: []
kind: SecurityContextConstraints
metadata:
  name: neuvector-scc-controller
priority: null
readOnlyRootFilesystem: false
requiredDropCapabilities:
- ALL
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: RunAsAny
supplementalGroups:
  type: RunAsAny
users: []
volumes:
- configMap
- downwardAPI
- emptyDir
- persistentVolumeClaim
- azureFile
- projected
- secret
```

**建立SCC**
```shell=
oc apply -f neuvector-scc-controller.yaml 
securitycontextconstraints.security.openshift.io/neuvector-scc-controller created
```

# 3.設定相關的role
```shell=
oc -n neuvector adm policy add-scc-to-user neuvector-scc-controller -z controller
clusterrole.rbac.authorization.k8s.io/system:openshift:scc:neuvector-scc-controller added: "controller"

oc get rolebinding system:openshift:scc:privileged -n neuvector -o wide
NAME                              ROLE                                          AGE    USERS   GROUPS   SERVICEACCOUNTS
system:openshift:scc:privileged   ClusterRole/system:openshift:scc:privileged   9m3s                    neuvector/enforcer

oc get rolebinding system:openshift:scc:neuvector-scc-controller -n neuvector -o wide
NAME                                            ROLE                                                        AGE    USERS   GROUPS   SERVICEACCOUNTS
system:openshift:scc:neuvector-scc-controller   ClusterRole/system:openshift:scc:neuvector-scc-controller   2m6s                    neuvector/controller
```

# 4.建立相關的CRD
```shell=
# oc apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.4.0/crd-k8s-1.19.yaml
oc apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.4.0/waf-crd-k8s-1.19.yaml
oc apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.4.0/dlp-crd-k8s-1.19.yaml
oc apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.4.0/com-crd-k8s-1.19.yaml
oc apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.4.0/vul-crd-k8s-1.19.yaml
oc apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.4.0/admission-crd-k8s-1.19.yaml
oc apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.4.0/5.4.3_group-definition-k8s.yaml
customresourcedefinition.apiextensions.k8s.io/nvsecurityrules.neuvector.com created
customresourcedefinition.apiextensions.k8s.io/nvclustersecurityrules.neuvector.com created
customresourcedefinition.apiextensions.k8s.io/nvwafsecurityrules.neuvector.com created
customresourcedefinition.apiextensions.k8s.io/nvdlpsecurityrules.neuvector.com created
customresourcedefinition.apiextensions.k8s.io/nvcomplianceprofiles.neuvector.com created
customresourcedefinition.apiextensions.k8s.io/nvvulnerabilityprofiles.neuvector.com created
customresourcedefinition.apiextensions.k8s.io/nvadmissioncontrolsecurityrules.neuvector.com created
customresourcedefinition.apiextensions.k8s.io/nvgroupdefinitions.neuvector.com created
```

# 5.建立相關所需帳號與rolebinding...等。

:::info
請注意第28行的檔案，如果有下載定義檔的話請修改路徑。
:::

```shell=
oc create clusterrole neuvector-binding-app --verb=get,list,watch,update --resource=nodes,pods,services,namespaces
oc create clusterrole neuvector-binding-rbac --verb=get,list,watch --resource=rolebindings.rbac.authorization.k8s.io,roles.rbac.authorization.k8s.io,clusterrolebindings.rbac.authorization.k8s.io,clusterroles.rbac.authorization.k8s.io,imagestreams.image.openshift.io
oc adm policy add-cluster-role-to-user neuvector-binding-app system:serviceaccount:neuvector:controller
oc adm policy add-cluster-role-to-user neuvector-binding-rbac system:serviceaccount:neuvector:controller
oc create clusterrole neuvector-binding-admission --verb=get,list,watch,create,update,delete --resource=validatingwebhookconfigurations,mutatingwebhookconfigurations
oc adm policy add-cluster-role-to-user neuvector-binding-admission system:serviceaccount:neuvector:controller
oc create clusterrole neuvector-binding-customresourcedefinition --verb=watch,create,get,update --resource=customresourcedefinitions
oc adm policy add-cluster-role-to-user neuvector-binding-customresourcedefinition system:serviceaccount:neuvector:controller
oc create clusterrole neuvector-binding-nvsecurityrules --verb=get,list,delete --resource=nvsecurityrules,nvclustersecurityrules
oc create clusterrole neuvector-binding-nvadmissioncontrolsecurityrules --verb=get,list,delete --resource=nvadmissioncontrolsecurityrules
oc create clusterrole neuvector-binding-nvdlpsecurityrules --verb=get,list,delete --resource=nvdlpsecurityrules
oc create clusterrole neuvector-binding-nvwafsecurityrules --verb=get,list,delete --resource=nvwafsecurityrules
oc adm policy add-cluster-role-to-user neuvector-binding-nvsecurityrules system:serviceaccount:neuvector:controller
oc adm policy add-cluster-role-to-user view system:serviceaccount:neuvector:controller --rolebinding-name=neuvector-binding-view
oc adm policy add-cluster-role-to-user neuvector-binding-nvwafsecurityrules system:serviceaccount:neuvector:controller
oc adm policy add-cluster-role-to-user neuvector-binding-nvadmissioncontrolsecurityrules system:serviceaccount:neuvector:controller
oc adm policy add-cluster-role-to-user neuvector-binding-nvdlpsecurityrules system:serviceaccount:neuvector:controller
oc create role neuvector-binding-scanner --verb=get,patch,update,watch --resource=deployments -n neuvector
oc adm policy add-role-to-user neuvector-binding-scanner system:serviceaccount:neuvector:updater system:serviceaccount:neuvector:controller -n neuvector --role-namespace neuvector
oc create clusterrole neuvector-binding-co --verb=get,list --resource=clusteroperators
oc adm policy add-cluster-role-to-user neuvector-binding-co system:serviceaccount:neuvector:enforcer system:serviceaccount:neuvector:controller
oc create role neuvector-binding-secret --verb=get,list,watch --resource=secrets -n neuvector
oc adm policy add-role-to-user neuvector-binding-secret system:serviceaccount:neuvector:controller system:serviceaccount:neuvector:enforcer system:serviceaccount:neuvector:scanner system:serviceaccount:neuvector:registry-adapter -n neuvector --role-namespace neuvector
oc create clusterrole neuvector-binding-nvcomplianceprofiles --verb=get,list,delete --resource=nvcomplianceprofiles
oc create clusterrolebinding neuvector-binding-nvcomplianceprofiles --clusterrole=neuvector-binding-nvcomplianceprofiles --serviceaccount=neuvector:controller
oc create clusterrole neuvector-binding-nvvulnerabilityprofiles --verb=get,list,delete --resource=nvvulnerabilityprofiles
oc create clusterrolebinding neuvector-binding-nvvulnerabilityprofiles --clusterrole=neuvector-binding-nvvulnerabilityprofiles --serviceaccount=neuvector:controller
oc apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.4.0/neuvector-roles-k8s.yaml
oc create role neuvector-binding-lease --verb=create,get,update --resource=leases -n neuvector
oc adm policy add-role-to-user neuvector-binding-cert-upgrader system:serviceaccount:neuvector:cert-upgrader -n neuvector --role-namespace neuvector
oc adm policy add-role-to-user neuvector-binding-job-creation system:serviceaccount:neuvector:cert-upgrader -n neuvector --role-namespace neuvector
oc adm policy add-role-to-user neuvector-binding-lease system:serviceaccount:neuvector:controller system:serviceaccount:neuvector:cert-upgrader -n neuvector --role-namespace neuvector
oc create clusterrole neuvector-binding-nvgroupdefinitions --verb=get,list,delete --resource=nvgroupdefinitions
oc create clusterrolebinding neuvector-binding-nvgroupdefinitions --clusterrole=neuvector-binding-nvgroupdefinitions --serviceaccount=neuvector:controller

clusterrole.rbac.authorization.k8s.io/neuvector-binding-app created
clusterrole.rbac.authorization.k8s.io/neuvector-binding-rbac created
clusterrole.rbac.authorization.k8s.io/neuvector-binding-app added: "system:serviceaccount:neuvector:controller"
clusterrole.rbac.authorization.k8s.io/neuvector-binding-rbac added: "system:serviceaccount:neuvector:controller"
clusterrole.rbac.authorization.k8s.io/neuvector-binding-admission created
clusterrole.rbac.authorization.k8s.io/neuvector-binding-admission added: "system:serviceaccount:neuvector:controller"
clusterrole.rbac.authorization.k8s.io/neuvector-binding-customresourcedefinition created
clusterrole.rbac.authorization.k8s.io/neuvector-binding-customresourcedefinition added: "system:serviceaccount:neuvector:controller"
clusterrole.rbac.authorization.k8s.io/neuvector-binding-nvsecurityrules created
clusterrole.rbac.authorization.k8s.io/neuvector-binding-nvadmissioncontrolsecurityrules created
clusterrole.rbac.authorization.k8s.io/neuvector-binding-nvdlpsecurityrules created
clusterrole.rbac.authorization.k8s.io/neuvector-binding-nvwafsecurityrules created
clusterrole.rbac.authorization.k8s.io/neuvector-binding-nvsecurityrules added: "system:serviceaccount:neuvector:controller"
clusterrole.rbac.authorization.k8s.io/view added: "system:serviceaccount:neuvector:controller"
clusterrole.rbac.authorization.k8s.io/neuvector-binding-nvwafsecurityrules added: "system:serviceaccount:neuvector:controller"
clusterrole.rbac.authorization.k8s.io/neuvector-binding-nvadmissioncontrolsecurityrules added: "system:serviceaccount:neuvector:controller"
clusterrole.rbac.authorization.k8s.io/neuvector-binding-nvdlpsecurityrules added: "system:serviceaccount:neuvector:controller"
role.rbac.authorization.k8s.io/neuvector-binding-scanner created
role.rbac.authorization.k8s.io/neuvector-binding-scanner added: ["system:serviceaccount:neuvector:updater" "system:serviceaccount:neuvector:controller"]
clusterrole.rbac.authorization.k8s.io/neuvector-binding-co created
clusterrole.rbac.authorization.k8s.io/neuvector-binding-co added: ["system:serviceaccount:neuvector:enforcer" "system:serviceaccount:neuvector:controller"]
role.rbac.authorization.k8s.io/neuvector-binding-secret created
role.rbac.authorization.k8s.io/neuvector-binding-secret added: ["system:serviceaccount:neuvector:controller" "system:serviceaccount:neuvector:enforcer" "system:serviceaccount:neuvector:scanner" "system:serviceaccount:neuvector:registry-adapter"]
clusterrole.rbac.authorization.k8s.io/neuvector-binding-nvcomplianceprofiles created
clusterrolebinding.rbac.authorization.k8s.io/neuvector-binding-nvcomplianceprofiles created
clusterrole.rbac.authorization.k8s.io/neuvector-binding-nvvulnerabilityprofiles created
clusterrolebinding.rbac.authorization.k8s.io/neuvector-binding-nvvulnerabilityprofiles created
role.rbac.authorization.k8s.io/neuvector-binding-cert-upgrader created
role.rbac.authorization.k8s.io/neuvector-binding-job-creation created
role.rbac.authorization.k8s.io/neuvector-binding-lease created
role.rbac.authorization.k8s.io/neuvector-binding-cert-upgrader added: "system:serviceaccount:neuvector:cert-upgrader"
role.rbac.authorization.k8s.io/neuvector-binding-job-creation added: "system:serviceaccount:neuvector:cert-upgrader"
role.rbac.authorization.k8s.io/neuvector-binding-lease added: ["system:serviceaccount:neuvector:controller" "system:serviceaccount:neuvector:cert-upgrader"]
clusterrole.rbac.authorization.k8s.io/neuvector-binding-nvgroupdefinitions created
clusterrolebinding.rbac.authorization.k8s.io/neuvector-binding-nvgroupdefinitions created
```

# 6.確認相關帳號、角色等等是否已經建立完全。
```shell=
oc get ClusterRoleBinding neuvector-binding-app neuvector-binding-rbac neuvector-binding-admission neuvector-binding-customresourcedefinition neuvector-binding-nvsecurityrules neuvector-binding-view neuvector-binding-nvwafsecurityrules neuvector-binding-nvadmissioncontrolsecurityrules neuvector-binding-nvdlpsecurityrules neuvector-binding-co -o wide
NAME                                                ROLE                                                            AGE   USERS   GROUPS   SERVICEACCOUNTS
neuvector-binding-app                               ClusterRole/neuvector-binding-app                               55s                    neuvector/controller
neuvector-binding-rbac                              ClusterRole/neuvector-binding-rbac                              54s                    neuvector/controller
neuvector-binding-admission                         ClusterRole/neuvector-binding-admission                         54s                    neuvector/controller
neuvector-binding-customresourcedefinition          ClusterRole/neuvector-binding-customresourcedefinition          54s                    neuvector/controller
neuvector-binding-nvsecurityrules                   ClusterRole/neuvector-binding-nvsecurityrules                   53s                    neuvector/controller
neuvector-binding-view                              ClusterRole/view                                                52s                    neuvector/controller
neuvector-binding-nvwafsecurityrules                ClusterRole/neuvector-binding-nvwafsecurityrules                52s                    neuvector/controller
neuvector-binding-nvadmissioncontrolsecurityrules   ClusterRole/neuvector-binding-nvadmissioncontrolsecurityrules   52s                    neuvector/controller
neuvector-binding-nvdlpsecurityrules                ClusterRole/neuvector-binding-nvdlpsecurityrules                52s                    neuvector/controller
neuvector-binding-co                                ClusterRole/neuvector-binding-co                                51s                    neuvector/enforcer, neuvector/controller

oc get RoleBinding neuvector-binding-scanner neuvector-binding-cert-upgrader neuvector-binding-job-creation neuvector-binding-lease neuvector-binding-secret -n neuvector -o wide
NAME                              ROLE                                   AGE   USERS   GROUPS   SERVICEACCOUNTS
neuvector-binding-scanner         Role/neuvector-binding-scanner         96s                    neuvector/updater, neuvector/controller
neuvector-binding-cert-upgrader   Role/neuvector-binding-cert-upgrader   94s                    neuvector/cert-upgrader
neuvector-binding-job-creation    Role/neuvector-binding-job-creation    93s                    neuvector/cert-upgrader
neuvector-binding-lease           Role/neuvector-binding-lease           93s                    neuvector/controller, neuvector/cert-upgrader
neuvector-binding-secret          Role/neuvector-binding-secret          96s                    neuvector/controller, neuvector/enforcer, neuvector/scanner, neuvector/registry-adapter
```

# 7.建立federate service(如果有需要的話)
```shell=
[root@bastion ~]# vim federate.yaml
[root@bastion ~]# oc create -f federate.yaml 
service/neuvector-service-controller-fed-master created
service/neuvector-service-controller-fed-worker created
```

**federate.yaml**
```yaml=
apiVersion: v1
kind: Service
metadata:
  name: neuvector-service-controller-fed-master
  namespace: neuvector
spec:
  ports:
  - port: 11443
    name: fed
    protocol: TCP
  type: LoadBalancer
  selector:
    app: neuvector-controller-pod

---

apiVersion: v1
kind: Service
metadata:
  name: neuvector-service-controller-fed-worker
  namespace: neuvector
spec:
  ports:
  - port: 10443
    name: fed
    protocol: TCP
  type: LoadBalancer
  selector:
    app: neuvector-controller-pod
```

# 8.建立NeuVector
```shell=
[root@bastion ~]# vim neuvector.yaml 
[root@bastion ~]# oc create -f neuvector.yaml 
service/neuvector-svc-crd-webhook created
service/neuvector-svc-admission-webhook created
service/neuvector-service-webui created
service/neuvector-svc-controller created
route.route.openshift.io/neuvector-route-webui created
deployment.apps/neuvector-manager-pod created
deployment.apps/neuvector-controller-pod created
Warning: spec.template.metadata.annotations[container.apparmor.security.beta.kubernetes.io/neuvector-enforcer-pod]: deprecated since v1.30; use the "appArmorProfile" field instead
daemonset.apps/neuvector-enforcer-pod created
deployment.apps/neuvector-scanner-pod created
cronjob.batch/neuvector-updater-pod created
```

**neuvector.yaml**
:::spoiler
```yaml=
apiVersion: v1
kind: Service
metadata:
  name: neuvector-svc-crd-webhook
  namespace: neuvector
spec:
  ports:
  - port: 443
    targetPort: 30443
    protocol: TCP
    name: crd-webhook
  type: ClusterIP
  selector:
    app: neuvector-controller-pod

---

apiVersion: v1
kind: Service
metadata:
  name: neuvector-svc-admission-webhook
  namespace: neuvector
spec:
  ports:
  - port: 443
    targetPort: 20443
    protocol: TCP
    name: admission-webhook
  type: ClusterIP
  selector:
    app: neuvector-controller-pod

---

apiVersion: v1
kind: Service
metadata:
  name: neuvector-service-webui
  namespace: neuvector
spec:
  ports:
    - port: 8443
      name: manager
      protocol: TCP
  type: ClusterIP
  selector:
    app: neuvector-manager-pod

---

apiVersion: v1
kind: Service
metadata:
  name: neuvector-svc-controller
  namespace: neuvector
spec:
  ports:
  - port: 18300
    protocol: "TCP"
    name: "cluster-tcp-18300"
  - port: 18301
    protocol: "TCP"
    name: "cluster-tcp-18301"
  - port: 18301
    protocol: "UDP"
    name: "cluster-udp-18301"
  clusterIP: None
  selector:
    app: neuvector-controller-pod

---

apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: neuvector-route-webui
  namespace: neuvector
spec:
  to:
    kind: Service
    name: neuvector-service-webui
  port:
    targetPort: manager
  tls:
    termination: passthrough

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: neuvector-manager-pod
  namespace: neuvector
spec:
  selector:
    matchLabels:
      app: neuvector-manager-pod
  replicas: 1
  template:
    metadata:
      labels:
        app: neuvector-manager-pod
    spec:
      serviceAccountName: basic
      serviceAccount: basic
      containers:
        - name: neuvector-manager-pod
          image: image-registry.openshift-image-registry.svc:5000/neuvector/manager:<version>
          env:
            - name: CTRL_SERVER_IP
              value: neuvector-svc-controller.neuvector
      restartPolicy: Always

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: neuvector-controller-pod
  namespace: neuvector
spec:
  selector:
    matchLabels:
      app: neuvector-controller-pod
  minReadySeconds: 60
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  replicas: 3
  template:
    metadata:
      labels:
        app: neuvector-controller-pod
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - neuvector-controller-pod
              topologyKey: "kubernetes.io/hostname"
      serviceAccountName: controller
      serviceAccount: controller
      containers:
        - name: neuvector-controller-pod
          image: image-registry.openshift-image-registry.svc:5000/neuvector/controller:<version>
          securityContext:
            runAsUser: 0
          readinessProbe:
            exec:
              command:
              - cat
              - /tmp/ready
            initialDelaySeconds: 5
            periodSeconds: 5
          env:
            - name: CLUSTER_JOIN_ADDR
              value: neuvector-svc-controller.neuvector
            - name: CLUSTER_ADVERTISED_ADDR
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: CLUSTER_BIND_ADDR
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            # - name: CTRL_PERSIST_CONFIG
            #   value: "1"
          volumeMounts:
            # - mountPath: /var/neuvector
            #   name: nv-share
            #   readOnly: false
            - mountPath: /etc/config
              name: config-volume
              readOnly: true
      terminationGracePeriodSeconds: 300
      restartPolicy: Always
      volumes:
        # - name: nv-share
        #   persistentVolumeClaim:
        #     claimName: neuvector-data
        - name: config-volume
          projected:
            sources:
              - configMap:
                  name: neuvector-init
                  optional: true
              - secret:
                  name: neuvector-init
                  optional: true
              - secret:
                  name: neuvector-secret
                  optional: true

---

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: neuvector-enforcer-pod
  namespace: neuvector
spec:
  selector:
    matchLabels:
      app: neuvector-enforcer-pod
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: neuvector-enforcer-pod
      annotations:
        container.apparmor.security.beta.kubernetes.io/neuvector-enforcer-pod: unconfined
      # Add the following for pre-v1.19
      # container.seccomp.security.alpha.kubernetes.io/neuvector-enforcer-pod: unconfined
    spec:
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
        - effect: NoSchedule
          key: node-role.kubernetes.io/control-plane
      hostPID: true
      serviceAccountName: enforcer
      serviceAccount: enforcer
      containers:
        - name: neuvector-enforcer-pod
          image: image-registry.openshift-image-registry.svc:5000/neuvector/enforcer:<version>
          securityContext:
            # openshift
            seLinuxOptions:
              type: unconfined_t
            # the following two lines are required for k8s v1.19+. pls comment out both lines if version is pre-1.19. Otherwise, a validating data error message will show
            seccompProfile:
              type: Unconfined
            capabilities:
              add:
              - SYS_ADMIN
              - NET_ADMIN
              - SYS_PTRACE
              - IPC_LOCK
              - NET_RAW
              - SYS_CHROOT
              - MKNOD
              - AUDIT_WRITE
              - SETFCAP
          env:
            - name: CLUSTER_JOIN_ADDR
              value: neuvector-svc-controller.neuvector
            - name: CLUSTER_ADVERTISED_ADDR
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: CLUSTER_BIND_ADDR
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
          volumeMounts:
            - mountPath: /lib/modules
              name: modules-vol
              readOnly: true
            # - mountPath: /run/runtime.sock
            #   name: runtime-sock
            #   readOnly: true
            # - mountPath: /host/proc
            #   name: proc-vol
            #   readOnly: true
            # - mountPath: /host/cgroup
            #   name: cgroup-vol
            #   readOnly: true
            - mountPath: /var/nv_debug
              name: nv-debug
              readOnly: false
      terminationGracePeriodSeconds: 1200
      restartPolicy: Always
      volumes:
        - name: modules-vol
          hostPath:
            path: /lib/modules
        # - name: runtime-sock
        #   hostPath:
        #     path: /var/run/crio/crio.sock
        # - name: proc-vol
        #   hostPath:
        #     path: /proc
        # - name: cgroup-vol
        #   hostPath:
        #     path: /sys/fs/cgroup
        - name: nv-debug
          hostPath:
            path: /var/nv_debug

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: neuvector-scanner-pod
  namespace: neuvector
spec:
  selector:
    matchLabels:
      app: neuvector-scanner-pod
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  replicas: 2
  template:
    metadata:
      labels:
        app: neuvector-scanner-pod
    spec:
      serviceAccountName: scanner
      serviceAccount: scanner
      containers:
        - name: neuvector-scanner-pod
          image: image-registry.openshift-image-registry.svc:5000/neuvector/scanner:<version>
          imagePullPolicy: Always
          env:
            - name: CLUSTER_JOIN_ADDR
              value: neuvector-svc-controller.neuvector
      restartPolicy: Always

---

apiVersion: batch/v1
kind: CronJob
metadata:
  name: neuvector-updater-pod
  namespace: neuvector
spec:
  schedule: "0 0 * * *"
  jobTemplate:
    spec:
      template:
        metadata:
          labels:
            app: neuvector-updater-pod
        spec:
          serviceAccountName: updater
          serviceAccount: updater
          containers:
          - name: neuvector-updater-pod
            image: image-registry.openshift-image-registry.svc:5000/neuvector/updater:<version>
            imagePullPolicy: Always
            command:
            - /bin/sh
            - -c
            - TOKEN=`cat /var/run/secrets/kubernetes.io/serviceaccount/token`; /usr/bin/curl -kv -X PATCH -H "Authorization:Bearer $TOKEN" -H "Content-Type:application/strategic-merge-patch+json" -d '{"spec":{"template":{"metadata":{"annotations":{"kubectl.kubernetes.io/restartedAt":"'`date +%Y-%m-%dT%H:%M:%S%z`'"}}}}}' 'https://kubernetes.default/apis/apps/v1/namespaces/neuvector/deployments/neuvector-scanner-pod'
          restartPolicy: Never
```
:::

# 9.確認連線資訊

:::info
連線時請注意您所使用的本機是否有設定正確的hosts指向到NeuVector URL。
:::

```shell=
oc get svc,route -owide
NAME                                              TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                         AGE   SELECTOR
service/neuvector-service-controller-fed-master   NodePort    172.30.48.236    <none>        11443:32007/TCP                 20h   app=neuvector-controller-pod
service/neuvector-service-controller-fed-worker   NodePort    172.30.196.154   <none>        10443:32455/TCP                 20h   app=neuvector-controller-pod
service/neuvector-service-webui                   ClusterIP   172.30.146.255   <none>        8443/TCP                        20h   app=neuvector-manager-pod
service/neuvector-svc-admission-webhook           ClusterIP   172.30.6.62      <none>        443/TCP                         20h   app=neuvector-controller-pod
service/neuvector-svc-controller                  ClusterIP   None             <none>        18300/TCP,18301/TCP,18301/UDP   20h   app=neuvector-controller-pod
service/neuvector-svc-crd-webhook                 ClusterIP   172.30.36.152    <none>        443/TCP                         20h   app=neuvector-controller-pod

NAME                                             HOST/PORT                                                 PATH   SERVICES                  PORT      TERMINATION   WILDCARD
route.route.openshift.io/neuvector-route-webui   neuvector-route-webui-neuvector.apps.container.demo.com          neuvector-service-webui   manager   passthrough   None
```
:::info
如果沒有定義預設帳密的話，請用admin / admin登入
:::

# 10.參考資料與注意事項

[1. 官方文件，照做基本上會成功。](https://open-docs.neuvector.com/deploying/openshift)
:::info
若node有taint，請把相關的pod加上nodeSelector與node label，不然應該會看到daemonSet沒有pod啟動。
:::