Chapter 1. Red Hat Advanced Cluster Security for Kubernetes 4.7 Red Hat Advanced Cluster Security for Kubernetes (RHACS) is an enterprise-ready, Kubernetes-native container security solution that protects your vital applications across the build, deploy, and runtime stages of the application lifecycle. Red Hat Advanced Cluster Security for Kubernetes deploys into your infrastructure and integrates with your DevOps tools and workflows. This integration provides better security and compliance, enabling DevOps and InfoSec teams to operationalize security. Table 1.1. Release dates RHACS version Released on 4.7.0 17 March 2025 1.1. About release 4.7.0 RHACS 4.7 includes the following new features, improvements, and updates: External integrations Integrate vulnerability findings into the Red Hat Developer Hub Documentation Documentation updates Network Enhanced visibility into the external IPs in the network graph Enhanced options for the roxctl netpol generate command Platform Protect secured clusters running on Red Hat OpenShift on IBM Cloud Automatic certificate rotation for secured clusters Cluster Registration Secret for secured cluster bootstrapping Machine-to-machine authentication by using Microsoft Entra ID Use the short-lived OIDC credentials from Microsoft Azure Policy View the violation status directly on the Violations page Vulnerability Management Enhanced visibility for the OpenShift Container Platform component CVEs Prioritize CVEs with the EPSS integration Scan the container images in the GitHub Container Registry Generate SBOMs from the scanned container images 1.2. New features This release adds improvements related to the following components and concepts: 1.2.1. Scan the container images in the GitHub Container Registry With RHACS 4.7, you can integrate with the GitHub Container Registry (GHCR) to scan container images stored in ghcr.io . RHACS now includes a default integration that supports both public and private GHCR instances to secure your containerized workloads. For more information, see Manually configuring GitHub Container Registry . 1.2.2. Enhanced visibility for the OpenShift Container Platform component CVEs RHACS 4.7 introduces improved visibility for the OpenShift Container Platform component Common Vulnerabilities and Exposures (CVEs). You can now view these CVEs separately to assess and manage security risks. To view the platform CVEs, click Vulnerability Management Results in the RHACS portal, and then click the Platform tab. 1.2.3. Machine-to-machine authentication by using Microsoft Entra ID In RHACS 4.7, you can now enable machine-to-machine authentication by using short-lived RHACS Central tokens when you use Microsoft Entra ID, formerly known as Azure AD, as the OpenID Connect (OIDC) identity provider for your enterprise. You can exchange ID tokens with access tokens from RHACS Central. Microsoft Entra ID issues these ID tokens to your application's service principals, and you can then use the RHACS access tokens to securely authenticate to the RHACS APIs. For more information about how to exchange an identity token, see Exchanging an identity token . For more information about how to use the Azure Entra ID service principals for machine to machine authentication with RHACS, see Using Azure Entra ID service principals for machine to machine auth with RHACS . 1.2.4. View the violation status directly on the Violations page With RHACS 4.7, you can now see the status of a violation directly on the Violations page so that you can quickly determine whether the violation is still active. This streamlines automation workflows, such as creating a Jira ticket and sending it to an owner who does not use RHACS regularly. By following the link in the ticket, the owner can immediately see if the violation is still relevant, reducing the risk of unnecessary delays or deprioritization. In addition, the page provides the full context of the violation and ensures that all relevant details are immediately available. 1.2.5. Prioritize CVEs with the EPSS integration RHACS 4.7 introduces integration with the Exploit Prediction Scoring System (EPSS), a data-driven model that estimates the likelihood of a software vulnerability being exploited. In addition to the severity and Common Vulnerability Scoring System (CVSS) score, an EPSS probability score from 0%-100% is now displayed for detected Common Vulnerabilities and Exposures (CVEs). You can use the EPSS score to better prioritize the remediation of CVE vulnerabilities and strengthen your security strategy. For more information, see Prioritizing the vulnerabilities . 1.2.6. Enhanced visibility into the external IPs in the network graph With RHACS 4.7, you can now get a better insight into the external IPs behind external entities in the network graph. Important Visualizing external entities is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope . This enhancement helps you identify the specific IP addresses that your deployments are communicating with and gives you better insight into the external interactions and potential risks. For more information, see Visualizing external entities . 1.2.7. Enhanced options for the roxctl netpol generate command In RHACS 4.7, the roxctl netpol generate command automatically detects when DNS connections are required and generates them accordingly. If you do not specify a port, port 53 is selected automatically, but you can change this by using the --dnsport flag. The --dnsport flag also accepts port names in addition to numbers. For example, --dnsport dns . You can use port names as a more robust method of specifying the port if the service has a defined name. If you are a Red Hat OpenShift customer and use the default DNS setting, you should use the --dnsport flag to change the default port, as the OpenShift DNS pod listens on port 5353 . For more information, see roxctl netpol generate . 1.2.8. Integrate vulnerability findings into the Red Hat Developer Hub In RHACS 4.7, you can now bring vulnerability findings directly into the Red Hat Developer Hub (RHDH) and other platforms based on the upstream Backstage project by using the Backstage Plugin. Important Integration of vulnerability findings into the RHDH is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope . You can incorporate the RHACS plugin into your developer environment and review key vulnerabilities for your applications within the platform. This provides information that you need before you can take the necessary remediation actions. For more information, see Viewing security information in Red Hat Developer Hub . 1.2.9. Generate SBOMs from the scanned container images With RHACS 4.7, you can now generate a Software Bill of Materials (SBOM) from the scanned container images. Important Generation of SBOMs from the scanned container images is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope . These SBOMs give you a detailed overview of all software components, dependencies, and libraries within your application. RHACS creates SBOMs of the Analyzed type and complies with the Software Package Data Exchange (SPDX) 2.3 specification. For more information about the SBOMs of the Analyzed type, see Types of SBOM Documents (America's Cyber Defense Agency documentation). For more information about how to use RHACS to generate SBOMs, see Generating SBOMs from scanned images . Note Generating SBOMs from images analyzed through secured clusters by using the delegated scanning feature is currently not supported. It is anticipated that an upcoming release will support this feature. 1.2.10. Automatic certificate rotation for secured clusters RHACS 4.7 introduces automatic certificate rotation for the secured cluster components, which ensures secure communication between Sensor, Admission Controller, and Collector within the cluster. Sensor also uses these certificates for a secure certificate-based architecture (mTLS) connection with Central. For more information about the automatic certificate renewal, see Reissuing internal certificates for secured clusters by using automatic certificate renewal . 1.2.11. Cluster Registration Secret for secured cluster bootstrapping In RHACS 4.7, you can now use the Cluster Registration Secret (CRS) to bootstrap a secured cluster and register it with Central. Important Cluster Registration Secret is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope . Unlike methods, CRS separates the bootstrap credentials from the operational certificates so that the cluster continues to work even if the bootstrap credentials are revoked. You can generate the CRS by using the roxctl CLI commands and revoke it if required. RHACS 4.7 supports both the init bundle and CRS, but in a future release the init bundle will be deprecated in favor of CRS. For more information, see: Generating and applying an init bundle or cluster registration secret for RHACS on Red Hat OpenShift Generating and applying an init bundle or cluster registration secret for RHACS on other platforms 1.2.12. Protect secured clusters running on Red Hat OpenShift on IBM Cloud In RHACS 4.7, you can now protect Red Hat OpenShift on IBM Cloud and run secured clusters on Red Hat OpenShift on IBM Cloud. 1.2.13. Use the short-lived OIDC credentials from Microsoft Azure With RHACS 4.7, you can now use short-lived OpenID Connect (OIDC) credentials. The Microsoft Azure Identity Provider provides these credentials, and you can use these credentials to access the services in Microsoft Azure, such as the Azure Container Registry and Azure Sentinel. This feature builds on the RHACS 4.4 release, which introduced the ability to use short-lived OIDC credentials from Amazon Web Services (AWS) and Google Cloud Platform (GCP) cloud providers to authenticate to the services hosted on these platforms. For more information, see Manually configuring Microsoft Azure Container Registry . 1.3. Notable technical changes This release contains the following changes: Scanner V4 now uses Red Hat VEX files instead of the Common Vulnerabilities and Exposures (CVE) map to provide vulnerability data for non-RPM content in official Red Hat images. You can no longer set the ROX_NODE_INDEX_CONTAINER_API environment variable in the Compliance pod. The node scanner never used this variable because the node scanner never connected to the Red Hat Container Catalog. To enable node scanning with Scanner V4 while the nodes continue to be scanned in parallel with Scanner V2, update the variable ROX_NODE_INDEX_ENABLED variable from a Boolean setting to a feature flag. This change ensures that the RHACS portal can access the setting through the Central API. By default, Central with Scanner V4 prioritizes Scanner V4 scans, while StackRox Scanner V2 remains operational without any changes. You can manually enable or disable Scanner V4 and StackRox Scanner V2 for node scanning without affecting image scanning. For more information, see Vulnerability management overview . stackrox.io Content Delivery Network (CDN) has been moved from CloudFlare to Akamai. When configuring firewall rules, use the hostname instead of the IP addresses. If you previously allowed the IP ranges to stackrox.io , you must update these rules. The following values are associated with a stable subset of Akamai Classless Inter-Domain Routings (CIDRs): 2.16.0.0/13 23.0.0.0/12 23.32.0.0/11 23.192.0.0/11 66.198.8.0/24 95.100.0.0/15 96.7.74.0/24 104.117.66.0/24 168.143.242.0/24 168.143.243.0/24 184.24.0.0/13 You now use the networking.externalIps.enabled setting instead of networking.externalIps.enable in the collector-config ConfigMap for the Collector runtime configuration. You also define it as an enum with the valid values ENABLED and DISABLED , and the default value is DISABLED . 1.4. Documentation updates The documentation for the System Health dashboard page has been updated to show you how to monitor component health, view administration usage, manage platform data and track system status. For more information, see Analyzing and managing the system health information . It is currently planned for Compliance 1.0 to be deprecated in RHACS 4.9. 1.5. Deprecated and removed features Some features available in earlier releases have been deprecated or removed. Deprecated functionality is still included in RHACS and continues to be supported; however, it will be removed in a future release of this product and is not recommended for new deployments. For the most recent list of major functionality deprecated and removed, see the following table. Additional removed or deprecated functionality is available after the table. In the table, features are marked with the following statuses: GA: General Availability TP: Technology Preview DEP: Deprecated REM: Removed NA: Not applicable Table 1.2. Deprecated and removed features tracker Feature RHACS 4.5 RHACS 4.6 RHACS 4.7 API token authentication for Red Hat OpenShift Cluster Manager [1] GA DEP DEP definitions.stackrox.io DEP DEP DEP Google Container Registry integration [2] GA DEP DEP Kernel support packages and driver download functionality [3] DEP DEP DEP Reporting of Istio vulnerabilities DEP DEP DEP rhacs-collector-slim* images [4] DEP DEP REM StackRox Scanner GA DEP DEP /v1/clustercves/suppress APIs [5,6] DEP DEP DEP /v1/clustercves/unsuppress APIs [5,6] DEP DEP DEP /v1/nodecves/suppress APIs [5,6] DEP DEP DEP /v1/nodecves/unsuppress APIs [5,6] DEP DEP DEP /v1/summary/counts endpoint DEP DEP DEP Vulnerability Management (1.0) menu item [7] DEP DEP DEP Vulnerability Report Creator permission DEP DEP DEP Scanner V4 support for openSUSE Leap 15.0 and 15.1 [8] GA DEP REM API token authentication is deprecated. The corresponding cloud source integration now uses service accounts for authentication. The Google Container Registry integration is deprecated in response to the deprecation of Container Registry. You can use the Artifact Registry as a registry replacement and Scanner V4 as a scanner replacement. For more information, see Transition from Container Registry (Google Cloud documentation). Kernel support packages and driver download functionality are deprecated. The rhacs-collector-slim* image is deprecated and has been removed in RHACS 4.7.0. rhacs-collector* image used to contain kernel modules and eBPF probes, but RHACS no longer needs those items. The rhacs-collector* and the rhacs-collector-slim* images are now functionally the same. A feature flag controls this API object, and you can enable or disable this API object by using the ROX_VULN_MGMT_LEGACY_SNOOZE environment variable. The format for specifying duration in JSON requests to v1/nodecves/suppress , v1/clustercves/suppress , and v1/imagecves/suppress has been changed to the ProtoJSON format. Only a numeric value representing seconds with optional fractional seconds for nanosecond precision and followed by the s suffix is supported. For example, 0.300s , -5400s , or 9900s . The previously valid time units of ns , us , ms , ms , m , and h are no longer supported. The Vulnerability Management Dashboard view is deprecated and is planned to be removed in a future release. You can use the User workload vulnerabilities , Exception management , Platform vulnerabilities , and Node CVEs views as alternatives. Scanner V4 support for openSUSE Leap 15.0 and 15.1 is deprecated and has been removed in RHACS 4.7.0. 1.6. Bug fixes in version 4.7.0 Release date : 3 March 2025 Before this update, reports remained in the DOWNLOAD state even after they were downloaded. This issue is now fixed. Before this update, the logs repeatedly displayed the following error message: [Throttled] Could not determine network namespace: No such file or directory This issue occurred when the system reported errors when encountering zombie processes. With this update, the system now specifically recognizes zombie processes and adjusts the message level to a less strict classification. However, the system can still trigger an error if the detection of zombie processes exceeds a certain threshold, helping to identify faulty workloads. Before this update, the Central logs were not rotated, which caused the log file for RHACS to grow indefinitely and eventually take up the entire node memory. This issue occurred because /var/log/stackrox was mounted by using an emptyDir volume, which does not persist across pod restarts and has no built-in log rotation. With this update, logs are deleted and the emptyDir volume is recreated when you restart the Central pod. A log size limit has been introduced to prevent excessive memory usage and to ensure that the Central logs do not overload the node. Before this update, Central might have filtered out selected storage.IndexReport messages representing the state of the RPM packages on a Red Hat Enterprise Linux CoreOS (RHCOS) node due to missing timestamps. This caused issues in RHACS 4.6.0 and 4.6.1 when testing the technical preview feature of RHCOS node scanning with Scanner V4. With this update, the filter logic in Central has been adjusted to ensure that IndexReport messages are processed correctly over time. Before to this update, the RHACS portal incorrectly validated Slack webhook URLs and blocked the Mattermost integration due to strict regex rules. With this update, the regex check has been removed to allow for more flexible URL formats. 1.7. Image versions You can manually pull, retag, and push Red Hat Advanced Cluster Security for Kubernetes (RHACS) images to your registry. The current version includes the following images: Table 1.3. Red Hat Advanced Cluster Security for Kubernetes images Image Description Current version Main Includes Central, Sensor, Admission controller, and Compliance components. Also includes roxctl for use in continuous integration (CI) systems. registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.7.0 Central DB PostgreSQL instance that provides the database storage for Central. registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8:4.7.0 Scanner Scans images and nodes. registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8:4.7.0 registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8:4.7.0 Scanner DB Stores image scan results and vulnerability definitions. registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8:4.7.0 Scanner V4 Scans images. registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel8:4.7.0 Scanner V4 DB Stores image scan results and vulnerability definitions for Scanner V4. registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel8:4.7.0 Collector Collects runtime activity in Kubernetes or OpenShift Container Platform clusters. registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8:4.7.0

Commands:
[Throttled] Could not determine network namespace: No such file or directory