Welcome to Support Portal

Summary

Aqua has identified two known issues affecting specific Enforcer versions and configurations:

• Network connectivity issues when upgrading Enforcers with Network Protection enabled.
• Increased memory utilization and pods becoming stuck during termination when Secure AI is enabled.

Customers using the affected configurations should upgrade their Enforcers to a fixed release.

Understanding Enforcer Versions

Depending on where the Enforcer version is viewed, it may appear as either:

• A release name, such as U44 SP3
• A numeric build or image tag, such as 2022.4.874.32

For example, U44 SP3 and 2022.4.874.32 refer to the same Enforcer release. The full release-to-build mapping is included below.

Issue 1: Network Protection Connectivity Issues

Affected Configuration

This issue may occur when:

• Network Protection is enabled.
• Enforcers are being upgraded from U41, U42, or U43.
• The upgrade target is an affected U44 release earlier than U44 SP3.
  

The affected U44 releases are:

Potential Symptoms

Affected environments may experience:

• DNS resolution failures
• Application or service connectivity failures
• Health check failures
• General network connectivity issues within protected workloads

Resolution

Upgrade the Enforcer to one of the following:

For customers remaining on the U44 release train, U44 SP3 or later is required.

Upgrade Recommendation

Before upgrading:

1. Disable Network Protection.
2. Complete the Enforcer upgrade.
3. Confirm the Enforcer pods are running and healthy.
4. Re-enable Network Protection.
5. Confirm DNS resolution, application connectivity, and health checks are operating normally.

Issue 2: Secure AI Memory Utilization

Affected Configuration

This issue may occur when Secure AI is enabled on Enforcers running U42 through U44 SP3. This includes the following release ranges:

Potential Symptoms

Affected environments may experience:

• Increased Enforcer memory utilization
• Enforcer pods remaining in the Terminating state
• Delayed or incomplete pod termination
• Resource pressure on the Kubernetes node

Resolution

Upgrade the Enforcer to one of the following:

For customers remaining on the U44 release train, U44 SP4 or later is required.
If an immediate upgrade is not possible, consider temporarily disabling Secure AI until a fixed Enforcer version can be deployed.

Environments Affected by Both Issues

Customers using both Network Protection and Secure AI should upgrade to:

• U44 SP4 - 2022.4.874.34
• U45 or later

U44 SP4 contains the required fixes for both issues.

Enforcer Release and Build Mapping

Use the following table to compare the product release shown in the Aqua interface with the numeric Enforcer build or image tag.

Recommended Action

Aqua recommends upgrading to U45 or later, where supported, to receive the latest security, stability, and vulnerability fixes.

Customers who need to remain on U44 should use the following minimum versions:

Before deploying U45 or a later Enforcer release, confirm that the Aqua Platform has been upgraded to a compatible release.

Contact Aqua Support if assistance is needed to confirm the currently deployed Enforcer version, validate platform compatibility, or plan the upgrade.

Additional Resources

[1] https://docs.aquasec.com/v2022.4/release-information/