Red Hat Advanced Cluster Security for Kubernetes 4.5

For RHACS Operator, Red Hat has added a label selector for caching configuration of secrets and config maps, resulting in a significant reduction in memory consumption, especially on large clusters. In testing, a 28% decrease was noted in memory usage on a new OpenShift Container Platform cluster.

The RHACS Operator now adds a app.stackrox.io/managed-by: operator label to all Helm chart resources and secrets created by the operator, providing better organization and visibility.

The RHACS Operator increases the number of requests sent to the API server to retrieve the following types of secrets:

Scanner DB now runs on PostgreSQL 15, replacing the earlier version, PostgreSQL 12. Because the database is not persisted, no migration is required, and you can continue using the scanner without any additional steps.

The Nexus and Red Hat registry integrations now attempt to pull manifest digests by using a HEAD request to /v2/<name>/manifests/<reference>. This change resolves an issue that previously resulted in an unsupported digest algorithm error when using Scanner V4. You can turn off this new behavior by setting the environment variable ROX_ATTEMPT_MANIFEST_DIGEST to false.

RHACS includes new policy categories, and some default policies are tagged with these new policy categories.

When roxctl CLI generates manifests for OpenShift Container Platform, it now defaults to OpenShift Container Platform 4.x instead of OpenShift Container Platform 3.x.

You can now delegate the Image scans triggered by image watch reprocessing based on the delegated scanning configuration. To turn off this feature, set the Central environment variable ROX_DELEGATE_WATCHED_IMAGE_REPROCESSING to false.

The Scanner V4 Matcher now completes concurrent vulnerability updates using iterators, reducing memory consumption from 4GB to 500MB.

RHACS 4.5 slowly populates the initial registry integration repository list /v2/_catalog to improve Central startup performance. This change reduces startup time in environments with many autogenerated integrations.

RHACS 4.5 includes a new configuration option, ROX_SCANNER_V4_ALLOW_ANONYMOUS_AUTH, to enable anonymous access to Scanner V4 for debugging purposes. This feature is on by default for development builds and off for release builds.

Deployment bundles created with the roxctl CLI no longer contain PodSecurityPolicies (PSPs) by default. You must specify the --enable-pod-security-policies option when you generate deployment bundles to deploy to Kubernetes 1.25 or earlier.

RHACS 4.5 includes improved event handling for Sensor image scan when ROX_UNQUALIFIED_SEARCH_REGISTRIES is set to true. This enhancement ensures that only one simultaneous scan request is allowed per unique image, reducing redundant scans. Additionally, it increases the chances of scan cache hits when multiple names for the same image are observed. This feature is on by default when ROX_UNQUALIFIED_SEARCH_REGISTRIES is true. To turn it off, set ROX_SENSOR_SINGLE_SCAN to false on Sensor.

Red Hat has reduced the default timeout setting for RHACS admission controller webhooks from 20 seconds to 10 seconds, resulting in an effective timeout of 12 seconds within the ValidatingWebhookConfiguration. This change aligns with the unconditional cap of 13 seconds in OpenShift Container Platform. If you rely on longer timeouts, such as those with inline image scanning, you must specify a longer timeout explicitly in the SecuredCluster custom resource admissionControl.timeoutSeconds, in Helm admissionControl.dynamic.timeout, or within a sensor deployment bundle ValidatingWebhookConfiguration manifest within the admission-controller.yaml file.

With RHACS 4.5, the ability to snooze Node and Platform CVEs is disabled by default. You must set ROX_VULN_MGMT_LEGACY_SNOOZE to true on Central to return to the earlier behavior.

The documentation now clarifies that when you update Scanner definitions in offline mode, Scanner retrieves data from Central every 5 minutes, with Central updating the online data every 5 - 20 minutes and the offline data every 3 hours. For more information, see Updating Scanner definitions in offline mode.

The documentation to view and configure default policies, manage policy categories, and create your own categories was updated. For more information, see Managing security policies.

The documentation was updated to include the --dnsport option and the example links in the Generating build-time network policies section.

The list of supported operating systems and versions was updated in the Supported operating systems section.

The documentation was updated to include new information about using the built-in email notifier in RHACS Cloud Service. For more information, see Integrating with email on RHACS Cloud Service.

The managing compliance guide where you can find detailed instructions on how to use the compliance feature in RHACS was updated. For more information, see Compliance feature overview.

GA: General Availability

TP: Technology Preview

DEP: Deprecated

REM: Removed

NA: Not applicable

Previously, a bug prevented users without administrator privileges from accessing the listening endpoint data for clusters and namespaces for which they had read permission. With this update, users with read permission can now receive data from the listening endpoints service.

The handling of orphaned node CVEs has been updated to prevent immediate removal and maintain accurate discovery times. To enable the updated feature, you must set the ROX_ORPHANED_CVES_KEEP_ALIVE variable in the Central deployment to true.

Fixed an issue where Sensor was unable to identify OpenShift Container Platform internal registry secrets due to a change in the pull secret annotation.

Fixed an issue where policies incorrectly displayed an enforced value of Yes in the Configuration Management → Application & Infrastructure → Deployments page due to inconsistent status handling, while showing No in the Violations page.

Fixed an issue where vulnerability data differed between the Vulnerability Management Workload CVE pages and the deprecated Vulnerability Management dashboard due to inconsistencies in vulnerability reporting.

CVE-2024-3727: Fixed a vulnerability related to Scanner where the containers/image digest type did not guarantee a valid type.

Fixed a broken pipe error that caused the RHACS web console to display incomplete data.

Added the --with-database-only option to the roxctl central debug download-diagnostics command. You can use this option to generate diagnostic bundles for troubleshooting connection issues related to policy violations and deployments.

CVE-2024-39249: Fixed a Regular expression denial of service (ReDoS) vulnerability in the RHACS main container.

Fixed incorrect timestamp data for the First discovered column on the Workload CVE single page when viewing affected images.

Fixed incorrect CVE counts when viewing an image in the Vulnerability Management window that contains CVEs with an unknown severity.

In runtime monitoring, process names and arguments could cause serialization problems when containing invalid UTF-8 characters. This resulted in error messages in the collector logs. Those characters are now filtered and replaced with a ? when necessary.

Fixed a panic issue where the Central pod restarted on systems that were using Scanner V4. When this issue occurred, the logs displayed an "invalid memory address or nil pointer dereference" runtime error.