> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/kubernetes-security/agentless-kubernetes-security.md). # Agentless Kubernetes security Agentless Kubernetes security is a KSPM collection method that discovers your Kubernetes clusters and collects their inventory and compliance posture without deploying any component inside the cluster. Instead of running the in-cluster Kubernetes Connector, Cortex uses the cloud provider APIs and the cluster's own managed control plane access model to read cluster state with read-only permissions. You enable agentless collection at the cloud account level. When you onboard or edit a supported cloud account, select the Kubernetes Security capability to grant Cortex the scoped, read-only access it needs. Cortex then automatically discovers every supported cluster in that account and begins collecting Kubernetes inventory. There are no per-cluster installers to run and nothing to deploy in the cluster. Newly created clusters are discovered and collected automatically, and a scheduled refresh keeps agentless inventory current. Use agentless collection when you need fast, broad visibility across many clusters, or for clusters where you cannot install in-cluster software. You can combine both methods: use agentless collection for broad coverage and deploy the Kubernetes Connector on the clusters that need deep in-cluster scanning, admission control prevention, and runtime protection. When a cluster is covered by both methods, the Kubernetes Connector takes precedence for collection, and agentless collection stops for that cluster, so you do not get duplicate inventory. Each cluster's collection method is shown by the scan method value on the Kubernetes Clusters page. Agentless KSPM continuously scans existing and newly discovered Kubernetes clusters for deep Kubernetes inventory context, compliance insights, and misconfiguration findings. Vulnerabilities, secrets, malware, untrusted images, and other image-assurance insights are available when the relevant container images are scanned by supported image scanning sources, such as Agentless Disk Scanner, Registry Scanner, CLI scans, or other supported image assurance capabilities, and are correlated back to the Kubernetes workloads using those images. Collected inventory and findings are surfaced in the Unified Asset Inventory (UAI), on the Kubernetes Clusters page, and in the KSPM Graph, alongside your Connector-collected clusters. #### Capabilities not available with agentless collection (these require the Kubernetes Connector) * **Admission control prevention**: Blocking non-compliant resources at kube-apiserver admission time. Prevention requires a webhook in the admission request path inside the cluster. * **Real-time runtime protection**: Detecting and blocking malicious activity as the activity happens. Detection requires a component observing process, network, and file system activity on the Node. * **Node-level (host) CIS Kubernetes Benchmark checks and deep in-cluster scanning**: Evaluating file permissions, mount options, and process arguments on the Node. The evidence for these checks exists only on the Node file system and is not exposed through the Kubernetes API, so no external scanner can collect it. #### Requirements and supported platforms: * Agentless Kubernetes security supports Amazon EKS, Google Cloud GKE, and Microsoft Azure AKS clusters. Clusters on other platforms (self-managed vanilla Kubernetes, OpenShift, and Rancher) require the Kubernetes Connector for KSPM coverage. * A supported cloud account (AWS, Google Cloud, or Azure) onboarded with the Kubernetes Security capability enabled, which grants Cortex read-only access to discover and read your clusters. * EKS clusters must use EKS access entries for authentication. Clusters that use a different authentication mode are not collected. * GKE clusters must run Kubernetes version 1.28 or later and must have the DNS-based control plane endpoint enabled with access from external networks allowed, because Cortex connects to the GKE control plane through that endpoint. GKE clusters that expose only an IP-based control plane endpoint, or whose DNS-based endpoint does not allow external traffic, cannot be reached agentlessly. Use the Kubernetes Connector for those clusters. * AKS clusters must have AKS-managed Microsoft Entra ID integration enabled, because Cortex authenticates to the AKS API server with a Microsoft Entra ID token. Clusters that use legacy Entra ID integration, or that use local accounts only, are not collected. * AKS clusters must expose a publicly reachable API server. Private AKS clusters and clusters restricted by an Azure network security perimeter cannot be reached agentlessly. Use the Kubernetes Connector for those clusters. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/kubernetes-security/agentless-kubernetes-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.