> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/kubernetes-security/onboard-the-kubernetes-connector.md). # Onboard the Kubernetes Connector Follow this wizard to deploy your Kubernetes Connector. The Kubernetes onboarding wizard is designed to facilitate the seamless setup of Kubernetes data into Cortex Cloud. The guided experience requires minimal user input; simply select the capabilities that fit your needs and download the custom installer file. For full control of the setup, you can use the advanced settings. Based on the onboarding settings, Cortex Cloud then creates a custom installer file for running in your Kubernetes environment. This file, once executed in your Kubernetes environment, grants Cortex Cloud the necessary permissions to collect the data. The installer file must be executed in your Kubernetes environment to complete the onboarding process. The connector then appears in **Kubernetes Connectors**. 1. Navigate to **Settings** → **Data Sources & Integrations**. 2. On the **Add Data Sources & Integrations** page, click **Create Integration**, search for **Kubernetes**, then hover over it and click **Add Another Instance**. 3. In the **Kubernetes Connect** onboarding wizard, enable the solutions that fit your needs: * **Posture Management:** (Enabled by default) A lightweight posture management solution for continuous discovery, policy enforcement, and proactive scanning of vulnerabilities, secrets, malware, compliance, and misconfigurations. * **Realtime Protection:** A solution that monitors workloads in real time to detect and block malicious activity, instantly preventing attacks as they happen. 4. (Optional) Click **Edit** to configure advanced settings and then click **Apply Changes**: ### **Posture management** | Setting | Notes | | -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Scan Cadence (Hours)** | Define how often to scan (from every one to 24 hours). Default is 12 hours. | | **Policy Enforcement by the Admission Controller** | Select to allow enforcement policies to be configured, ensuring that only compliant resources are admitted into the cluster. | | **Registry Scanning (OpenShift Only)** |

Select this option to scan OpenShift Platform Registry images for vulnerabilities, malware, and exposed secrets.

Select the scanning configuration option to enable security checks for your images:

Refer to OpenShift container registry for information on the instances that were automatically created by the Kubernetes deployment.

| ### Realtime protection {% hint style="info" %} **Notes**: * On clusters running a Kubernetes Connector version earlier than 2.0, the Realtime protection settings are disabled and cannot be edited. To change the settings, remove the existing connector deployment from the cluster and install the latest available Kubernetes connector version. * This option is not supported for Fargate. * Enabling Realtime protection installs the agent on your Kubernetes clusters as a DaemonSet. {% endhint %} | Setting | Notes | | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

Agent type

| Determines which Cortex agent the Kubernetes Connector deploys to your cluster Nodes for real-time protection. Select **Cloud optimized agent** for runtime and threat detection with a lower resource footprint on each Node. Select **XDR agent** for full endpoint protection, including active threat prevention and response. Both agent types deploy as a DaemonSet to every Linux Node in the cluster. | | **Node Selector** | Enter node labels to run the agent only on nodes that match those labels. Leave empty to run the agent on all eligible nodes. The node's platform type (for example, Standard, Bottlerocket OS, Google Container-Optimized OS, or OpenShift) is detected automatically. | | **Endpoint tags** | Select endpoint tags with relevant context to assign to agents during installation. You can reference the full list of tags under **All endpoints**. | 5. (Optional) Click **Edit Profile** to customize the Kubernetes Connector's profile: | Setting | Notes | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Profile Name** | A profile name is automatically generated, including the date and time of creation. You can manually change the profile name. | | **Version** |

Select which version of the Kubernetes Connector to install.

Each entry in that version list now shows the correlated XDR (Linux real-time) agent version next to the bundle version.

| | **Cluster Resource Identifier** |

(Optional) Enter the Kubernetes cluster resource identifier. If you do not specify the resource identifier, the installer will identify the cluster on its own.

Note

For Fargate, you must provide the cluster resource identifier.

The format of the identifier is arn:aws:eks:\:\:cluster/\.

| | **Namespace** |

Enter the name for the Kubernetes namespace. The default is "panw".

To ensure proper data parsing in an AWS Fargate environment, a Fargate Profile must be explicitly configured for the namespace where the connector is installed (typically panw) and for the kube-system namespace if the cluster is fully Fargate-based. Because the system identifies Fargate clusters by scanning for active workloads during deployment, a Fargate profile that contains no running pods will not be recognized as such. Furthermore, since this detection occurs at installation, any transition from EC2 to Fargate requires an agent update to trigger a new scan and ensure the environment is correctly identified and monitored.

| | **Proxy Gateway** |

Enable this option if network traffic between Cortex Cloud and your Kubernetes cluster must route through a proxy gateway. Enter the following details:

| | **Auto Upgrade** |

Enable Auto Upgrade to ensure the Kubernetes Connector and its installed capabilities are automatically updated to a newer version when available. This minimizes manual maintenance and ensures continuous access to the latest features and security patches.

Select the Upgrade Strategy:

Select Advanced to customize the upgrade schedule. Define whether to be upgraded immediately or to delay the upgrade by a specified number of days. You can then specify the preferred day and time for the upgrade to be applied.

| 6. Click **Generate**, then follow the instructions to complete the deployment. 7. Verify the deployment succeeded when you see **Status: Deployed**. When the Kubernetes Connector is deployed, the initial discovery scan is started, and the connector appears in **Data Sources & Integrations** → **Kubernetes** → **Kubernetes Connectors**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/kubernetes-security/onboard-the-kubernetes-connector.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.