Peer feedback for version 5.6

Author: kakabisht

versioned_docs/version-5.6/10.updating/01.updating/01.updating.md

@@ -9,6 +9,12 @@ slug: /updating/updating
 
 It’s super easy to update your NeuVector containers. If there is a new release available, pull it from Docker Hub. It is recommended to use a ‘rolling update’ strategy to keep at least one Allinone or Controller container running at any time during an update. 
 
+:::note Critical CVE Stats After Upgrades
+When upgrading controllers to version `5.6.0-rc1` (or later) from a version that does not support critical-level severity (e.g., `5.5.3`), existing scanner pods must be restarted or redeployed. 
+
+Older scanner pods cache the controller's initial capability response. They will not recognize that the upgraded controller supports critical-level severity until they are restarted and re-query the controller on startup.
+:::
+
 :::warning imporant
 Host OS updates, reboots, and orchestrator updates can cause pods to be evicted or stopped. If a Controller is affected, and there are no other Controllers active to maintain the state, the Controllers can become available for some time while new controllers are started, a cluster is formed with a leader, and the persistent storage backup of the configuration is attempted to be accessed to restore the cluster. Be careful when scheduling host or orchestrator updates and reboots which may affect the number of controllers available at any time. See the Pod Disruption Budget below for possible ways to mitigate this.
 
@@ -125,66 +131,3 @@ spec:
     matchLabels:
       app: neuvector-controller-pod
 ```
-
-### Upgrading from NeuVector 4.x to 5.1.x
-
-Upgrade first to a 5.1.x release such as 5.1.3, then see the [Kubernetes deployment section](/deploying/kubernetes) for updating to 5.2.x+ for important changes to services accounts and bindings.
-
-For Helm users, update to NeuVector Helm chart 2.0.0 or later (prior to NeuVector 5.2.0). If updating an Operator or Helm install on OpenShift, see note below.
-
-1. Delete old neuvector-binding-customresourcedefinition clusterrole
-
-```shell
-kubectl delete clusterrole neuvector-binding-customresourcedefinition
-```
-
-2. Apply new update verb for neuvector-binding-customresourcedefinition clusterrole
-
-```shell
-kubectl create clusterrole neuvector-binding-customresourcedefinition --verb=watch,create,get,update --resource=customresourcedefinitions
-```
-
-3. Delete old crd schema for Kubernetes 1.19+
-
-```shell
-kubectl delete -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/crd-k8s-1.19.yaml
-```
-
-4. Create new crd schema for Kubernetes 1.19+
-
-```shell
-kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.0.0/crd-k8s-1.19.yaml
-kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.0.0/waf-crd-k8s-1.19.yaml
-kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.0.0/dlp-crd-k8s-1.19.yaml
-kubectl apply -f https://raw.githubusercontent.com/neuvector/manifests/main/kubernetes/5.0.0/admission-crd-k8s-1.19.yaml
-```
-
-5. Create a new DLP, WAP, Admission clusterrole and clusterrolebinding
-
-```shell
-kubectl create clusterrole neuvector-binding-nvwafsecurityrules --verb=list,delete --resource=nvwafsecurityrules
-kubectl create clusterrolebinding neuvector-binding-nvwafsecurityrules --clusterrole=neuvector-binding-nvwafsecurityrules --serviceaccount=neuvector:default
-kubectl create clusterrole neuvector-binding-nvadmissioncontrolsecurityrules --verb=list,delete --resource=nvadmissioncontrolsecurityrules
-kubectl create clusterrolebinding neuvector-binding-nvadmissioncontrolsecurityrules --clusterrole=neuvector-binding-nvadmissioncontrolsecurityrules --serviceaccount=neuvector:default
-kubectl create clusterrole neuvector-binding-nvdlpsecurityrules --verb=list,delete --resource=nvdlpsecurityrules
-kubectl create clusterrolebinding neuvector-binding-nvdlpsecurityrules --clusterrole=neuvector-binding-nvdlpsecurityrules --serviceaccount=neuvector:default
-```
-
-6. Update image names and paths for pulling NeuVector images from Docker hub (docker.io).
-The images are on the NeuVector Docker Hub registry. Use the appropriate version tag for the manager, controller, enforcer, and leave the version as 'latest' for scanner and updater. For example:
-
-+ neuvector/manager:5.1.3
-+ neuvector/controller:5.1.3
-+ neuvector/enforcer:5.1.3
-+ neuvector/scanner:latest
-+ neuvector/updater:latest
-
-Optionally, remove any references to the NeuVector license and secrets in Helm charts, deployment yaml, configmap, scripts etc, as these are no longer required to pull the images or to start using NeuVector.
-
-**Note about SCC and Upgrading via Operator/Helm**
-
-Privileged SCC is added to the Service Account specified in the deployment yaml by Operator version 1.3.4 and above in new deployments. In the case of upgrading the NeuVector Operator from a previous version to 1.3.4 or Helm to 2.0.0, please delete Privileged SCC before upgrading.
-
-```shell
-oc delete rolebinding -n neuvector system:openshift:scc:privileged
-```

versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md

@@ -15,6 +15,12 @@ To receive email notifications of new releases, please subscribe to this SUSE ma
 
 #### 5.6.0 July 2026
 
+:::note Critical CVE Stats After Upgrades
+When upgrading controllers to version `5.6.0-rc1` (or later) from a version that does not support critical-level severity (e.g., `5.5.3`), existing scanner pods must be restarted or redeployed. 
+
+Older scanner pods cache the controller's initial capability response. They will not recognize that the upgraded controller supports critical-level severity until they are restarted and re-query the controller on startup.
+:::
+
 ##### Feature requests
 
 - **issue-2235**: Add a column containing the image digest in generated reports for containers.

versioned_sidebars/version-5.6-sidebars.json

@@ -0,0 +1,8 @@
+{
+  "tutorialSidebar": [
+    {
+      "type": "autogenerated",
+      "dirName": "."
+    }
+  ]
+}