Update NeuVector link

[catherineluse]

The hardcoded NeuVector button link needs to use the cattle-neuvector-system namespace.

[catherineluse]

Caleb also requested that to check if NeuVector is installed, we should look for the unique helm chart info instead of looking for all CRDs that have neuvector.com in the name.

If you could look up the helm install that would work. Or the cattle-neuvector-namespace.

[David-VTUK]

Unless we mandate that NV is installed into a specific namespace we shouldn't hard code a namespace in the proxy link.

For example, I've installed the closed-source Neuvector application via helm, and placed it into a namespace called neuvector.

The UI integration appears:

Clicking it results in:

The API call is:

GET https://<RancherURL>/k8s/clusters/<Cluster>/api/v1/namespaces/neuvector-system/services/https:neuvector-service-webui:8443/proxy

The neuvector-system namespace doesn't even exist in my environment.

If I modify the API call to reference the correct namespace I get the following:

This is due to my install of Neuvector - I expose it via an ingress & terminate TLS at the ingress controller with necessitates the following config:

manager:
  env:
    ssl: false
  ingress:
    enabled: true
    host: neuvector.mydomain.com
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-production
    tls: true
    secretName: neuvector-tls-secret

Therefore, to make this work, the link has to be modified further to change:

services/https:neuvector-service-webui:8443/proxy/
to
services/http:neuvector-service-webui:8443/proxy/

[catherineluse]

@David-VTUK We don't support installing Rancher apps with Helm. If we want to document and support it, that would be a product management decision.

[catherineluse]

Status update: I am going to add some code that makes it so that the NeuVector link will only be shown if the following are true:

• Custom resources with neuvector.com in the type name are installed. (This is the condition that as already used.)
• The cattle-neuvector-namespace exists.
• The NeuVector UI service exists in that namespace.

This should hide the button in any scenario where the link wouldn't work.

[nwmac]

I think it is enough for the presence of the cattle-neuvector-namespace namespace and the neuvector custom resource to show the link - we may not have access to the service and that requires an extra request

[gaktive]

@catherineluse if you're busy, @richard-cox can assist here.

[nwmac]

You can add an ifHave to the Neuvector poduct - see IF_HAVE in type-map.js and the ifHave function - add a custom one that checks for the namespace

[catherineluse]

@gaktive This is the absolute best I could do. #5604

I worked on it for 3 days but could not figure out how to make an async API call to check for the namespace or service to check whether to show the NeuVector link in the side nav. I kept getting error messages that said the schemas weren't loaded yet.

So my workaround was to add an error message so that if someone installed the NeuVector partner chart, they will understand why the button is not there. Caleb suggested this language for the error message:

I asked in the interlock channel if that workaround was acceptable. If not, @richard-cox can you please take it over, because I have to switch to working on project monitoring now.

[gaktive]

Thanks @catherineluse. Let's see what @richard-cox can do here.

[anupama2501]

Verified on v2.6.5-rc2

Installed neuvector chart and verified nuvector link works.