> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/onboard-the-kubernetes-connector-1.md). # Onboard the Kubernetes Connector Follow this wizard to deploy your Kubernetes Connector. The Kubernetes onboarding wizard is designed to facilitate the seamless setup of Kubernetes data into Cortex Cloud. The guided experience requires minimal user input; simply select the capabilities that fit your needs and download the custom installer file. For full control of the setup, you can use the advanced settings. Based on the onboarding settings, Cortex Cloud then creates a custom installer file for running in your Kubernetes environment. This file, once executed in your Kubernetes environment, grants Cortex Cloud the necessary permissions to collect the data. The installer file must be executed in your Kubernetes environment to complete the onboarding process. The connector then appears in **Kubernetes Connectors**. 1. Navigate to **Settings** → **Data Sources & Integrations**. 2. On the **Add Data Sources & Integrations** page, click **Create Integration**, search for **Kubernetes**, then hover over it and click **Add Another Instance**. 3. In the **Kubernetes Connect** onboarding wizard, enable the solutions that fit your needs: * **Posture Management:** (Enabled by default) A lightweight posture management solution for continuous discovery, policy enforcement, and proactive scanning of vulnerabilities, secrets, malware, compliance, and misconfigurations. * **Realtime Protection:** A solution that monitors workloads in real time to detect and block malicious activity, instantly preventing attacks as they happen. 4. (Optional) Click **Edit** to configure advanced settings and then click **Apply Changes**: * Posture Management: | Setting | Notes | | -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | **Scan Cadence (Hours)** | Define how often to scan (from every one to 24 hours). Default is 12 hours. | | **Policy Enforcement by the Admission Controller** | Select to allow enforcement policies to be configured, ensuring that only compliant resources are admitted into the cluster. | \| **Registry Scanning (OpenShift Only)** | Select this option to scan OpenShift Platform Registry images for vulnerabilities, malware, and exposed secrets. Select the scanning configuration option to enable security checks for your images: * **All** (Default) Scans all container images, including all versions (tags), in all discovered repositories. * **Latest tag**: Scans only images tagged 'latest' in all discovered repositories. * **Day modified**: Scans container images created or modified in the last few days. You can select a range of up to 90 days for the scan. The default is set to 7. Refer to [OpenShift container registry](/kubernetes-security/onboard-the-kubernetes-connector/openshift-container-registry.md) for information on the instances that were automatically created by the Kubernetes deployment. | * Realtime Protection:

Note

This option is not supported for Fargate.

Note

Enabling Realtime Protection installs the agent on your Kubernetes clusters as a DaemonSet.

| Setting | Notes | | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | **Node Selector** | Enter node labels to have the agent run on nodes that match the node labels. | | **Run on all nodes (Including Master)**/**Run only on master node** | Select one of the options. | | **Endpoint tags** | Select endpoint tags with relevant context to assign to agents during installation. You can reference the full list of tags under **All endpoints**. | | **Deployment Platform** |

Select the Kubernetes deployment platform:

| 5. (Optional) Click **Edit Profile** to customize the Kubernetes Connector's profile: | Setting | Notes | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Profile Name** | A profile name is automatically generated, including the date and time of creation. You can manually change the profile name. | | **Version** | Select which version of the Kubernetes Connector to install. | | **Cluster Resource Identifier** |

(Optional) Enter the Kubernetes cluster resource identifier. If you do not specify the resource identifier, the installer will identify the cluster on its own.

Note

For Fargate, you must provide the cluster resource identifier.

The format of the identifier is arn:aws:eks:\:\:cluster/\.

| | **Namespace** |

Enter the name for the Kubernetes namespace. The default is "panw".

To ensure proper data parsing in an AWS Fargate environment, a Fargate Profile must be explicitly configured for the namespace where the connector is installed (typically panw) and for the kube-system namespace if the cluster is fully Fargate-based. Because the system identifies Fargate clusters by scanning for active workloads during deployment, a Fargate profile that contains no running pods will not be recognized as such. Furthermore, since this detection occurs at installation, any transition from EC2 to Fargate requires an agent update to trigger a new scan and ensure the environment is correctly identified and monitored.

| | **Proxy Gateway** |

Enable this option if network traffic between Cortex Cloud and your Kubernetes cluster must route through a proxy gateway. Enter the following details:

| | **Auto Upgrade** |

Enable Auto Upgrade to ensure the Kubernetes Connector and its installed capabilities are automatically updated to a newer version when available. This minimizes manual maintenance and ensures continuous access to the latest features and security patches.

Select the Upgrade Strategy:

Select Advanced to customize the upgrade schedule. Define whether to be upgraded immediately or to delay the upgrade by a specified number of days. You can then specify the preferred day and time for the upgrade to be applied.

| 6. Click **Generate**. 7. To complete the onboarding of the Kubernetes Connector, you must download the Helm chart values `values.yaml` and run it in your Kubernetes environment: `helm repo add cortex https://paloaltonetworks.github.io/cortex-cloud --force-update` 8. Install the Helm charts in your Kubernetes environment: `helm upgrade --install konnector cortex/konnector --wait-for-jobs --create-namespace --namespace panw --values ````.values.yaml` 9. Verify the deployment succeeded when you see **Status: Deployed**. When the Kubernetes Connector is deployed, the initial discovery scan is started, and the connector appears in **Data Sources & Integrations** → **Kubernetes** → **Kubernetes Connectors**. **What's new in Kubernetes Connector?** This topic describes the changes, additions, known issues, and fixes for each version of the Kubernetes Connector. If Auto Upgrade is enabled in your Kubernetes Connector, you will automatically enjoy the latest released features without having to manually upgrade to the new version. **Kubernetes Connector releases** Cortex Cloud supports the following current Kubernetes Connector versions. Click the link to view the new features, addressed issues, and known issues per release. | Release version | Release notes | Release date | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------- | | 1.3 | [Kubernetes Connector version 1.3](/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/kubernetes/whats-new-in-kubernetes-connector.md#kubernetes-connector-version-13) | Nov 9, 2025 | | 1.2 | [Kubernetes Connector version 1.2](/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/kubernetes/whats-new-in-kubernetes-connector.md#kubernetes-connector-version-12) | July 20, 2025 |
Kubernetes Connector version 1.3 New features The following section describes the new features introduced in Kubernetes Connector version 1.3. | Feature | Description | | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Unified Kubernetes Onboarding | Streamlined Kubernetes onboarding process in a single, easy-to-use wizard. Now you can discover all available security capabilities based on your license, configure everything in one flow, and deploy your entire solution with one consolidated installer. | | Kubernetes Connector | Supports AKS, EKS, GKE, managed OpenShift, self-managed Kubernetes vanilla clusters, and self-managed OpenShift with a Kubernetes Native installation method of Helm Installer. For more details, see [Supported Kubernetes distributions](/kubernetes-security/supported-kubernetes-distributions.md). | | KSPM Dashboard | A visual overview of your Kubernetes security posture. It includes inventory insights, protection coverage, most vulnerable clusters, malware and secrets detected, and more. | | Compliance standards | Enjoy out-of-the-box CIS compliance standards for Kubernetes environments (CIS EKS, CIS GKE, CIS AKS, CIS OpenShift, and CIS Kubernetes). | | Secrets, malware, and vulnerabilities | Generate secret, malware, and vulnerabilities posture issues by declaring policies on Kubernetes clusters | Known limitations The following table describes known limitations in the Kubernetes Connector release. | Feature | Description | | ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Connector onboarding and cluster identifier |

The Kubernetes Connector automatically calculates the Kubernetes cluster cloud identifier by using the metadata service (for EKS and GKE) and cluster resources (for AKS).

|
Kubernetes Connector version 1.2 New features The following section describes the new features introduced in Kubernetes Connector version 1.2. | Feature | Description | | ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | Kubernetes Connector Onboarding | Supports AKS, EKS, GKE, managed OpenShift, and self-managed Kubernetes Vanilla clusters, with a Kubernetes Native installation method of Helm Installer. | | KSPM Dashboard | A visual overview of your Kubernetes security posture. It includes inventory insights, protection coverage, riskiest clusters, and more. | | Compliance standards | Enjoy out-of-the-box CIS compliance standards for Kubernetes environments (CIS EKS, CIS GKE, CIS AKS, CIS OpenShift, and CIS Kubernetes). | | Secrets, malware, and vulnerabilities | Generate secret, malware, and vulnerabilities posture issues by declaring policies on Kubernetes clusters | | AWS WAF Detection | Detect the presence of AWS WAF protecting Internet-exposed assets | Known limitations The following table describes known limitations in the Kubernetes Connector release. | Feature | Description | | ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Connector onboarding and cluster identifier |

The Kubernetes Connector automatically calculates the Kubernetes cluster cloud identifier by using the metadata service (for EKS and GKE) and cluster resources (for AKS).

|
**Supported Kubernetes distributions** The following are the supported Kubernetes platform versions for the Kubernetes connector (Posture Management). The table shows the latest version that is supported. We support n-3 versions of each supported Kubernetes environment. | Kubernetes environment | Notes | | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Managed clusters | | | Managed OpenShift | Managed Openshift clusters, including ROSA (Red Hat OpenShift on AWS), are supported. | | Self-Managed |

We support every CNCF-certified Kubernetes solution. We've tested our solution on:

| The following are the Kubernetes platforms that are supported with Cortex XDR agents (Real-time protection). This table shows the Kubernetes platform versions that have been compatibility tested. The table shows the latest version that has been tested. All versions that are not EOL, up to the latest version are supported. | Linux Kubernetes Platform | Version | | | --------------------------------------------------------- | ---------------------------------------------------------------------------------- | - | | Unmanaged Kubernetes (k8s) | 1.30 | | | Amazon Elastic Kubernetes Service (EKS) | 1.33 | | | |

BottleRocket OS x86\_64

User mode agent only

| | |

BottleRocket OS aarch64

User mode agent only

| | | | Microsoft Azure Kubernetes Service (AKS) | 1.33 | | | | CBL-mariner 2 x86\_64 | | | Google Kubernetes Engine (GKE) | 1.33 | | | |

Google Container-Optimized OS (COS)^(\*) x86\_64

User mode agent only

| | | Google Kubernetes Engine (GKE) Autopilot | | | | Oracle Kubernetes Engine (OKE) | 1.33 | | | Red Hat Openshift Container Platform (OCP) | 4.16 | | | |

RHCOS^(\*) x86\_64

User mode agent only

| | | SUSE Rancher Kubernetes Engine 2 (RKE2) | 1.28 | | | Talos | 1.8.3 | | {% hint style="info" %} ### Note In Google Container-Optimized OS release 100 and earlier, where the FANOTIFY EXEC flag is not supported, the Kernel configuration may be partial for the user mode agent to properly function. In such cases, the agent will fallback to asynchronous mode. In RHCOS version 4.12 and earlier, the Kernel configuration may be partial for the user mode agent to properly function. In such cases, the agent will fallback to asynchronous mode. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/onboard-the-kubernetes-connector-1.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.