<!-- Use this template as a starting point for deprecations. --> ### Deprecation Summary <!-- This should contain a brief description of the feature or functionality that is deprecated. The description should clearly state the potential impact of the deprecation to end users. It is recommended that you link to the documentation. The description of the deprecation should state what actions the user should take to rectify the behavior. If the deprecation is scheduled for an upcoming release, the content should remain in the deprecations documentation page until it has been completed. For example, if a deprecation is announced in 14.9 and scheduled to be completed in 15.0, the same content would be included in the documentation for 14.9, 14.10, and 15.0. --> The Container Network Security and Container Host Security Categories are being deprecated within GitLab. For details on our plans to remove these items, please reference our [removal epic](https://gitlab.com/groups/gitlab-org/-/epics/7477). ### Why is this being deprecated? The Container Network and Host Security categories focus primarily on the Infrastructure Security persona. This persona is not well supported within GitLab today and there are several barriers to adoption that have prevented this feature from being heavily utilized: 1. GitLab's pricing and packaging model is on a per-user basis, whereas comparable products in the industry offer consumption-based pricing (per cluster, per CPU, per container, per node, etc.) 1. Use of these features require users to connect their production clusters to GitLab. 1. Most Infrastructure Security teams do not use other features in GitLab today. This means that there is a high bar of feature functionality that must be met to provide enough value to convince them to switch to using GitLab over the other products that they use currently. Additionally, there are other areas of interest that GitLab intends to invest in instead. These areas have a strong user base within GitLab today. GitLab believes that greater value can be delivered to users today by refocusing our investments in these areas. 1. [Security Orchestration](https://about.gitlab.com/direction/protect/security_orchestration/) 1. [Container Scanning](https://about.gitlab.com/direction/protect/container-scanning) 1. [Software Supply Chain Security](https://sam-sssc-direction.about.gitlab-review.app/direction/supply-chain/) ### Proposal - The following GitLab-maintained helm charts and integrations will be deprecated - AppArmor - Cilium - Falco - FluentD - Pod Security Policies - The following areas of functionality in the GitLab UI will be deprecated - The entire **Security & Compliance > Threat Monitoring** page including both the Alert Dashboard and the Statistics tab - The Network Policy type in the **Security & Compliance > Policies** page. - All APIs related to the Container Network and Host Security categories will be deprecated ### Breaking Change <!-- Does this MR contain a breaking change? If yes: - Add the ~"breaking change" label to this issue. - Add instructions for how users can update their workflow. --> This will introduce a breaking change for users once the features are removed in the GitLab %15.0 release. As an alternative, users are encouraged to evaluate the capabilities of [AppArmor](https://gitlab.com/apparmor/apparmor), [Cilium](https://github.com/cilium/cilium), [Falco](https://github.com/falcosecurity/falco), [FluentD](https://github.com/fluent/fluentd), and [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) for potential use directly in their Kubernetes clusters. If partners or individual users desire to manage rules for these technologies through GitLab, they are encouraged to add their own helm charts into their version of our [Cluster Management Project Template](https://docs.gitlab.com/ee/user/clusters/management_project_template.html). These helm charts can then be deployed in production by calling the correct `kubectl` commands [via GitLab's Secure CI/CD Tunnel](https://docs.gitlab.com/ee/user/clusters/agent/repository.html#run-kubectl-commands-using-the-cicd-tunnel). ### Affected Topology <!-- Who is affected by this deprecation, Self-managed users, SaaS users, or both? This is especially important when nearing the annual major release where breaking changes and removals are typically introduced. These changes might be seen on GitLab.com before the official release date. --> This change impacts both SaaS and Self-managed users. ### Affected Tier <!-- Which tier is this feature available in? * Free * Premium * Ultimate --> Some functionality is available in ~"GitLab Free" while other functionality is available in ~"GitLab Ultimate" ### Deprecation Milestone <!-- In which milestone will this deprecation be announced ? --> %14.8 ### Planned Removal Milestone <!-- In which milestone will the feature or functionality be removed and announced? --> %15.0 ### Links <!-- Add links to any relevant documentation or code that will provide additional details or clarity regarding the planned change. This issue is the main SSOT for the deprecations and removals process. Be sure to link all issues and MRs related to this deprecation/removal to this issue. This can include removal issues that were created ahead of time, and the MRs doing the actual deprecation/removal work. --> <!-- Label reminders - you should have one of each of the following labels. Use the following resources to find the appropriate labels: - https://gitlab.com/gitlab-org/gitlab/-/labels - https://about.gitlab.com/handbook/product/categories/features/ --> <!-- Populate the Section, Group, and Category --> <!-- Choose the Pricing Tier(s) --> <!-- Identifies that this Issue is related to deprecating a feature --> <!-- Add the ~"breaking change" label to this issue if necessary --> <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION --> *This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.* <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION -->