Onboard the Kubernetes Connector

Connect Kubernetes clusters to Cortex Cloud for monitoring and security.

Follow this wizard to deploy your Kubernetes Connector. The Kubernetes onboarding wizard is designed to facilitate the seamless setup of Kubernetes data into Cortex Cloud. The guided experience requires minimal user input; simply select the capabilities that fit your needs and download the custom installer file. For full control of the setup, you can use the advanced settings. Based on the onboarding settings, Cortex Cloud then creates a custom installer file for running in your Kubernetes environment. This file, once executed in your Kubernetes environment, grants Cortex Cloud the necessary permissions to collect the data. The installer file must be executed in your Kubernetes environment to complete the onboarding process. The connector then appears in Kubernetes Connectors.

1. Navigate to Settings → Data Sources & Integrations.
2. On the Add Data Sources & Integrations page, click Create Integration, search for Kubernetes, then hover over it and click Add Another Instance.
3. In the Kubernetes Connect onboarding wizard, enable the solutions that fit your needs:

   • Posture Management: (Enabled by default) A lightweight posture management solution for continuous discovery, policy enforcement, and proactive scanning of vulnerabilities, secrets, malware, compliance, and misconfigurations.
   • Realtime Protection: A solution that monitors workloads in real time to detect and block malicious activity, instantly preventing attacks as they happen.
4. (Optional) Click Edit to configure advanced settings and then click Apply Changes:

Posture management

Setting	Notes
Scan Cadence (Hours)	Define how often to scan (from every one to 24 hours). Default is 12 hours.
Policy Enforcement by the Admission Controller	Select to allow enforcement policies to be configured, ensuring that only compliant resources are admitted into the cluster.
Registry Scanning (OpenShift Only)	Select this option to scan OpenShift Platform Registry images for vulnerabilities, malware, and exposed secrets. Select the scanning configuration option to enable security checks for your images: All (Default) Scans all container images, including all versions (tags), in all discovered repositories. Latest tag: Scans only images tagged 'latest' in all discovered repositories. Day modified: Scans container images created or modified in the last few days. You can select a range of up to 90 days for the scan. The default is set to 7. Refer to OpenShift container registry for information on the instances that were automatically created by the Kubernetes deployment.

Realtime protection

Notes:

• On clusters running a Kubernetes Connector version earlier than 2.0, the Realtime protection settings are disabled and cannot be edited. To change the settings, remove the existing connector deployment from the cluster and install the latest available Kubernetes connector version.
• This option is not supported for Fargate.
• Enabling Realtime protection installs the agent on your Kubernetes clusters as a DaemonSet.

Setting	Notes
Agent type	Determines which Cortex agent the Kubernetes Connector deploys to your cluster Nodes for real-time protection. Select Cloud optimized agent for runtime and threat detection with a lower resource footprint on each Node. Select XDR agent for full endpoint protection, including active threat prevention and response. Both agent types deploy as a DaemonSet to every Linux Node in the cluster.
Node Selector	Enter node labels to run the agent only on nodes that match those labels. Leave empty to run the agent on all eligible nodes. The node's platform type (for example, Standard, Bottlerocket OS, Google Container-Optimized OS, or OpenShift) is detected automatically.
Endpoint tags	Select endpoint tags with relevant context to assign to agents during installation. You can reference the full list of tags under All endpoints.

1. (Optional) Click Edit Profile to customize the Kubernetes Connector's profile:

Setting	Notes
Profile Name	A profile name is automatically generated, including the date and time of creation. You can manually change the profile name.
Version	Select which version of the Kubernetes Connector to install. Each entry in that version list now shows the correlated XDR (Linux real-time) agent version next to the bundle version.
Cluster Resource Identifier	(Optional) Enter the Kubernetes cluster resource identifier. If you do not specify the resource identifier, the installer will identify the cluster on its own. Note For Fargate, you must provide the cluster resource identifier. The format of the identifier is arn:aws:eks:<region>:<account-id>:cluster/<cluster-name>.
Namespace	Enter the name for the Kubernetes namespace. The default is "panw". To ensure proper data parsing in an AWS Fargate environment, a Fargate Profile must be explicitly configured for the namespace where the connector is installed (typically panw) and for the kube-system namespace if the cluster is fully Fargate-based. Because the system identifies Fargate clusters by scanning for active workloads during deployment, a Fargate profile that contains no running pods will not be recognized as such. Furthermore, since this detection occurs at installation, any transition from EC2 to Fargate requires an agent update to trigger a new scan and ensure the environment is correctly identified and monitored.
Proxy Gateway	Enable this option if network traffic between Cortex Cloud and your Kubernetes cluster must route through a proxy gateway. Enter the following details: Proxy IP: The full IP address and port number for your HTTP proxy server. For example: 192.168.1.1:8080 Authentication: Select None or Basic. Enter the username and password for a proxy user account that has permission to pass traffic to the Kubernetes cluster. Note Basic authentication is only supported in Posture Management. If deploying Realtime Protection, select None .
Auto Upgrade	Enable Auto Upgrade to ensure the Kubernetes Connector and its installed capabilities are automatically updated to a newer version when available. This minimizes manual maintenance and ensures continuous access to the latest features and security patches. Select the Upgrade Strategy: Latest Available Version (GA): Automatically upgrade to the newest version as soon as it is released to gain immediate access to all new features. One release before the latest one (N-1): Maintain a policy to always remain one version behind the latest available release. Note If you install the latest version but select the N-1 strategy, this policy will take effect starting from the next upgrade cycle (it will not immediately downgrade your current installation). If you choose an older version and keep the latest strategy, the latest version will be installed. Select Advanced to customize the upgrade schedule. Define whether to be upgraded immediately or to delay the upgrade by a specified number of days. You can then specify the preferred day and time for the upgrade to be applied.

1. Click Generate, then follow the instructions to complete the deployment.
2. Verify the deployment succeeded when you see Status: Deployed.

   When the Kubernetes Connector is deployed, the initial discovery scan is started, and the connector appears in Data Sources & Integrations → Kubernetes → Kubernetes Connectors.