> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/32/install/deploy-defender/orchestrator/install-gke.md). # Deploy Defender on Google Kubernetes Engine (GKE) To install Prisma Cloud on [Google Kubernetes Engine (GKE)](https://cloud.google.com/kubernetes-engine/#), follow the standard Kubernetes installation process. Before proceeding, create a ClusterRoleBinding, which grants the necessary permissions for deploying the Defender DaemonSet. For GKE Autopilot, there are additional requirements and considerations. See [Google Kubernetes Engine (GKE) Autopilot](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/compute-edition/32/admin-guide/install/deploy-defender/orchestrator/gke-autopilot.md) for more information. **Permissions for Service Accounts** * The Google Cloud Platform (GCP) service account used to create Prisma Cloud Console resources, such as the Deployment controller and PersistentVolumeClaim, must have at least the **Kubernetes Engine Developer** role. * To create Defender resources (for example, DaemonSet), the service account must have the **Kubernetes cluster-admin** role. It is recommended to create the `ClusterRoleBinding` before handing over the cluster to any user responsible for managing and maintaining Prisma Cloud (typically DevOps teams). To create a `ClusterRoleBinding` for a service account, use the following command: ``` $ kubectl create clusterrolebinding your-dev-user-cluster-admin-binding \ --clusterrole=cluster-admin \ --user=your-dev-user@your-org.iam.gserviceaccount.com ``` This command should be run for any service account applying the Defender DaemonSet YAML or Helm chart, even if the service account already has elevated permissions via the GCP Kubernetes Engine Admin role. Failing to do so will result in an error. For example, the following steps uses a service account named `your-dev-user@your-org.iam.gserviceaccount.com`, which has the **Kubernetes Engine Developer** role. You will also need access to a higher-privileged GCP account with the **Kubernetes Engine Admin** role to create the `ClusterRoleBinding`. ## Prerequisites * A deployed GKE cluster. * A GCP service account with the Kubernetes Engine Developer role. * Access to a GCP account with the Kubernetes Engine Admin role. 1. Run the following command with the service account that has the GCP Kubernetes Engine Admin role: ``` $ kubectl create clusterrolebinding your-dev-user-cluster-admin-binding \ --clusterrole=cluster-admin \ --user=your-dev-user@your-org.iam.gserviceaccount.com ``` 1. Once the `ClusterRoleBinding` is created, use the service account with the Kubernetes Engine Developer role to continue with the standard installation of Prisma Cloud Defenders. * If your GKE cluster uses ARM or multi-architecture nodes, you must edit the daemonset.yaml configuration file to ensure compatibility with your workloads. * If you’re using Anthos Service Mesh on GKE, ensure the **Monitor Istio** option is set to **Off** during Defender deployment. This option is relevant only for Istio Service Mesh, not Anthos. On Prisma Cloud console **Manage > Defenders > Manual Deploy > Orchestrator** and set **Orchestrator Type** to Kubernetes and adjust **Advanced Settings**.
deploy gke ot
## Troubleshooting * If you see the following error while creating the Defender DaemonSet: ``` Error from server (Forbidden): error when creating "daemonset.yaml": clusterroles.rbac.authorization.k8s.io is forbidden: User "your-dev-user@your-org.iam.gserviceaccount.com" cannot create clusterroles.rbac.authorization.k8s.io at the cluster scope: Required "container.clusterRoles.create" permission. Error from server (Forbidden): error when creating "daemonset.yaml": clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "your-dev-user@your-org.iam.gserviceaccount.com" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope: Required "container.clusterRoleBindings.create" permission. ``` This means the service account lacks the necessary permissions. Ensure the correct ClusterRole is assigned by following the steps detailed in the procedure. * If you see the following error: ``` Error from server (Forbidden): error when creating "daemonset.yaml": clusterroles.rbac.authorization.k8s.io "twistlock-view" is forbidden: attempt to grant extra privileges: [{[list] [rbac.authorization.k8s.io] [roles] [] []} {[list] [rbac.authorization.k8s.io] [rolebindings] [] []} {[list] [rbac.authorization.k8s.io] [clusterroles] [] []} {[list] [rbac.authorization.k8s.io] [clusterrolebindings] [] []}] user=&{your-admin-user@your-org.iam.gserviceaccount.com [system:authenticated] map[user-assertion.cloud.google.com:[iVWgsppUtVXaN1xToHtXpQdi5jJy6jv7BlSUZSUNTMjI2N77AaL5zQwZse0rqdu0Bz/35+6CG//82jdATfqfEWxDIRdAYHGvzRweXDZxOvI4EZzhyUVVKHJKL6i6v47VlFsHtSMx63QiVWgsppUtVXaN1xToHtXpQmU3nNtlspQaH3RtqSLwK/MoqW3Cc+VkWmuxyGUCYcW94Ttd6euy8iVWgsppUtVXaN1xToHtXpQWhRRTxlidgQdMzAbcAAbbv2C/uMlWs4VkzII7i9l6EEg==]]} ownerrules=[{[create] [authorization.k8s.io] [selfsubjectaccessreviews selfsubjectrulesreviews] [] []} {[get] [] [] [] [/api /api/* /apis /apis/* /healthz /openapi /openapi/* /swagger-2.0.0.pb-v1 /swagger.json /swaggerapi /swaggerapi/* /version /version/]}] ruleResolutionErrors=[] ``` Ensure the service account has the **Kubernetes cluster-admin** role to avoid permission issues during Defender resource creation. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/admin-guide/32/install/deploy-defender/orchestrator/install-gke.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.