> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/32/install/deploy-defender/orchestrator/install-cluster-container-defender.md).

# Automatically Install Container Defender in a Cluster

Container orchestrators provide native capabilities for deploying agents, such as Defender, to every node in the cluster. Prisma Cloud leverages these capabilities to install Defender.

The process for deploying Container Defender to a cluster can be found in the dedicated orchestrator-specific [install guides](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/compute-edition/32/admin-guide/install/install.md).

If you wish to automate the defenders deployment process to a cluster, or you don’t have kubectl access to your cluster (or oc access for OpenShift), you can deploy Defender DaemonSets directly from the Console UI.

This Defender install flow doesn’t let you manually configure a cluster name. Cluster names let you [segment your views](/admin-guide/32/technology-overviews/radar.md#cluster-pivot) of the environment. For most cases, this shouldn’t be a problem because if you’re deploying to a managed cluster, then Prisma Cloud retrieves the cluster name directly from the cloud provider. If you must manually specify a name, deploy your Defenders from **Manage > Defenders > Deploy > DaemonSet** or use twistcli.

If your clusters use **ARM architecture or multiple architectures** on Google Kubernetes Engine (GKE) you can’t use the following procedure to automatically deploy the defenders. Instead, use the [manual installation procedure for Kubernetes](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/compute-edition/32/admin-guide/install/deploy-defender/orchestrator/orchestrator.md#install-defender) and edit the `daemonset.yaml` configuration file to [prepare your workloads](https://cloud.google.com/kubernetes-engine/docs/how-to/prepare-arm-workloads-for-deployment#node-affinity-multi-arch-arm).

## Deploy Defender DaemonSet using kubeconfig

**Prerequisites:**

* You’ve created a [kubeconfig credential](/admin-guide/32/authentication/credentials-store/kubernetes-credentials.md) for your cluster so that Prisma Cloud can access it to deploy the Defender DaemonSet.

**Deployment process:**

1. Log into Prisma Cloud Console.
2. Go to **Manage > Defenders > Manage**.
3. Click **DaemonSets**.
4. For each cluster in the table, click **Actions > Deploy**.

   The table shows a count of deployed Defenders and their version number.

## Deploy Defender DaemonSet for GKE

**Prerequisites:**

* You deployed a GKE cluster
* You created a corresponding Service Account key in JSON format. The Service Account should have the following permissions:
  * Editor
  * Compute Storage Admin
  * Kubernetes Engine Admin
  * Service Account Token Creator
* You created a xref:\~/authentication/credentials-store/gcp-credentials.adoc.adoc\[GCP credential] for your cluster so that Prisma Cloud can access it to deploy the Defender DaemonSet:
  1. Log into Prisma Cloud Console.
  2. Go to **Manage > Authentication > Credentials Store**
  3. Click **Add credential** button
  4. Select type **GCP** and credential level, then copy the content of the JSON Service Account key into the Service Account line (take it all including brackets).

To deploy the Defender DaemonSet, use the following procedure.

1. Log into Prisma Cloud Console.
2. Go to **Manage > Defenders > Manage > DaemonSets**.

   When the page is loaded, multiple rows of K8S clusters visible with SA credentials are displayed.

   For GCP organizations with hundreds of projects, using organization level credentials might affect the performance of the page and the time to load the clusters. Therefore, the best approach to reduce the time and to avoid potential timeouts, is to divide the projects within your organization into multiple GCP folders. Then, create a service account and credential for each one of them.
3. Verify that the status is **Success** and the Defender count is 0/0 for all relevant clusters.
4. For each cluster, click **Actions > Deploy**.
5. Refresh the view and verify that for each cluster the version is the correct, the status is **Success**, and the Defender count is equal to the number of cluster nodes.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/admin-guide/32/install/deploy-defender/orchestrator/install-cluster-container-defender.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.