Chapter 1. Red Hat Advanced Cluster Security for Kubernetes 4.11

This update includes enhancements in vulnerability management reporting that provide more data, additional filtering options, and scheduling flexibility.

This release includes the following changes:

Red Hat Advanced Cluster Security Clair can scan Red Hat hardened images (Project Hummingbird) and cross-reference findings with Red Hat VEX metadata, supporting validation and ongoing monitoring of hardened image CVE posture.

Policy scope selection capabilities have been expanded, allowing you to include clusters by label.

RHACS policies now cover Kubernetes pod attach requests, including oc debug and oc debug node, in addition to the existing pod exec and port forward controls. The default Kubernetes Actions: Attach to Pod policy alerts on interactive attach sessions and can block them when you enable enforcement.

RHACS now supports seamless integration of existing tailored profiles from Compliance Operator. You can now schedule and manage your custom security configurations directly from the RHACS interface. This update fully accommodates profiles with suppressed rules or multi-profile combinations and profiles that are using the latest CustomRules functionality.

The Splunk Technology Add On has been updated, adding support for File Activity violations and aligning with recent Splunk changes. The new version, 3.0.0, is available for download on SplunkBase.

Images are now uniquely identified by the combination of name and digest, rather than by digest alone. This new data model resolves several long-standing issues when multiple images share the same digest but have different names, for example, different registries or tags.

RHACS now uses a more efficient runtime data collection mechanism that reduces resource consumption while maintaining comprehensive security monitoring capabilities.

Admission controller performance has been improved by keeping the image cache warm longer, and eliminating image fetches for policies that do not evaluate images. The default memory limit of admission controller pods is now 1 Gi, which has increased from 500 Mi.

API list performance was optimized to improve performance and resource consumption of certain endpoints returning List<Type> objects.

All RHACS Operator and operand images are now built on UBI 9 Minimal base images. This improves your security posture by shrinking the attack surface and eliminating CVE noise from unnecessary packages.

This migration provides a smaller attack surface, reduced image size, and alignment with the latest Red Hat Universal Base Image standards.

Installation methods have been consolidated to focus on Operator-based deployment as the primary installation approach.

This consolidation simplifies the installation experience and aligns with Kubernetes-native deployment patterns. The RHACS Operator provides a consistent, automated installation and upgrade experience across all supported platforms.

Cluster registration secrets (CRSes) were generally available in an earlier release and make the bootstrapping process more secure. In this release, you can configure the CRS maximum expiration time and the maximum number of clusters that can generate and use CRSes through the RHACS web console. This flexibility provides additional hardening and strengthening for CRSes. Credential management is key to the secure functioning of your fleet application and helps prevent exfiltration attacks.

RHACS now scans images used by init containers and displays init container information, if it exists, in the deployment details.

This feature is available as a Technology Preview and is disabled by default. To enable init container scanning, set the ROX_INIT_CONTAINER_SUPPORT feature flag to true.

When enabled, RHACS extracts, scans, and displays init containers in the following RHACS locations:

Init containers are included in risk scores and compliance checks. However, policies do not evaluate init containers in this Technology Preview release.

File activity monitoring now supports user-defined path specifications with wildcard patterns, enhanced filtering options, and file rename operation detection.

With this feature, you can define custom paths to monitor using wildcard patterns, filter file activity based on criteria such as process name and ancestor, create policies for file rename operations, and combine process criteria with file access criteria in deployment and node policies.

You can use this Technology Preview feature to experiment with the planned user interface. To use this feature, you must set the feature flag ROX_POLICY_FILTERS_UI to enabled.

The RHACS vulnerability management integration with the Red Hat OpenShift console plugin is now generally available.

This feature provides vulnerability information directly within the OpenShift Container Platform web console, enabling platform administrators and developers to view and manage security vulnerabilities without leaving their primary workflow interface.

The plugin is supported on OpenShift Container Platform versions 4.19 and later.

Standardized base image definition and layer detection is now generally available.