Chapter 1. Red Hat Advanced Cluster Security for Kubernetes 4.10

In RHACS 4.10, you are automatically redirected from HTTP to HTTPS when accessing the Central URL. Before this update, the system did not automatically redirect HTTP requests. As a result, this enhancement improves security, user experience, and consistency with Red Hat OpenShift platform standards.

For example, if you enter http://central-stackrox.apps.ocp.example.com, Central automatically redirects the connection to https://central-stackrox.apps.ocp.example.com.

In RHACS 4.10, you can configure global node taints and tolerations within both the Central and Secured Cluster custom resources (CRs). When you define these once at the CR level, the system automatically applies your settings to all RHACS components that run as Kubernetes deployments.

Before this update, you had to duplicate configurations for environments by using tainted or dedicated node pools. With this update, you ensure consistent scheduling behavior across your Central services and secured cluster components, which provides greater flexibility when you deploy RHACS into clusters with strict workload isolation policies.

For more information, see Central configuration options in the RHACS installation documentation.

In RHACS 4.10, you can define standardized base images that your organization has approved for application development. When you use these images, RHACS detects and distinguishes the layers originating from the base image from those added by the application owner.

This new capability establishes a clear separation of duties between base image owners and application owners. This structure ensures clear accountability and faster remediation while enabling more exact patch responsiveness metrics for each team.

For more information about base image definition, see "Defining base images used in application development".

For more information about viewing vulnerabilities from base images, see "Viewing vulnerabilities from base images".

In RHACS 4.10, RHACS supports vulnerability management of virtual machine (VM) workloads at runtime on Red Hat OpenShift Virtualization (RHOCPV). This feature requires you to run a VM agent, which performs continuous package scanning from inside the VM. As a result, you gain visibility into vulnerabilities within your virtualized workloads. This capability is a Technology Preview feature.

For more information, see "Scanning virtual machines".

In RHACS 4.10, you gain access to a new dynamic plugin for the OpenShift console on your secured clusters. This plugin adds a Security tab that displays real-time vulnerability information about your cluster. You can now analyze vulnerability data directly within your OpenShift console interface without switching applications. This capability is a Technology Preview feature.

For more information, see "Accessing vulnerability information in the OpenShift Container Platform web console".

In RHACS 4.10, teams can allow violation grace periods based on the date a fix became available for a published vulnerability.

In RHACS 4.10, the roxctl CLI and API requests that trigger image scans now generate administrative events when scanning fails. As a result, administrators gain better visibility into scanning reliability and failures.

In RHACS 4.10, the cluster registration secret (CRS), introduced in RHACS 4.9 as a Technology Preview, is fully supported with this release. Additionally, you can now use this method when installing by using the Operator. CRS provides a means to securely bootstrap secured cluster registration with RHACS Central. This method replaces the init bundle for registration.

CRS provides clear separation of credentials used for bootstrapping registration of secured cluster components from the workflow of internal communication between these components. Existing clusters that used the init bundle for registration are not impacted. However, you should use CRS for new cluster registrations.

For more information, see the RHACS installation documentation.

In RHACS 4.10, file activity monitoring provides real-time visibility into file execution and modifications. Different security standards such as PCI-DSS specify requirements for ensuring file integrity that traditional solutions such as the File Integrity Operator could not fully meet. As a result, this feature bridges visibility gaps by capturing the timestamp, process name, execution path, and UID for every change. It distinguishes between host and container initiated changes and automatically maps activity to specific Kubernetes deployments and namespaces.

You can scope deployment policies to filter out expected activity and tune policies for relevant file operations. Enable this feature per cluster by using the Operator options or the Helm installation. In this release, you can monitor the four most critical paths of a node. This capability is a Technology Preview feature.

For more information, see "Configuring file activity monitoring".

In RHACS 4.10, when you install RHACS by using the Operator, the output for the oc get central and oc get securedcluster commands provides key information fields, including the software version and immediate visibility into resource health and operational detail. As a result, administrators can more quickly assess and confirm if the resource is currently processing or is fully operational.