Deploy Defender on Google Kubernetes Engine (GKE)

To install Prisma Cloud on Google Kubernetes Engine (GKE), follow the standard Kubernetes installation process. Before proceeding, create a ClusterRoleBinding, which grants the necessary permissions for deploying the Defender DaemonSet.

For GKE Autopilot, there are additional requirements and considerations. See Google Kubernetes Engine (GKE) Autopilot for more information.

Permissions for Service Accounts

• The Google Cloud Platform (GCP) service account used to create Prisma Cloud Console resources, such as the Deployment controller and PersistentVolumeClaim, must have at least the Kubernetes Engine Developer role.
• To create Defender resources (for example, DaemonSet), the service account must have the Kubernetes cluster-admin role.

It is recommended to create the ClusterRoleBinding before handing over the cluster to any user responsible for managing and maintaining Prisma Cloud (typically DevOps teams).

To create a ClusterRoleBinding for a service account, use the following command:

$ kubectl create clusterrolebinding your-dev-user-cluster-admin-binding \
    --clusterrole=cluster-admin \
    --user=[e-mail]

This command should be run for any service account applying the Defender DaemonSet YAML or Helm chart, even if the service account already has elevated permissions via the GCP Kubernetes Engine Admin role. Failing to do so will result in an error.

For example, the following steps uses a service account named [e-mail], which has the Kubernetes Engine Developer role. You will also need access to a higher-privileged GCP account with the Kubernetes Engine Admin role to create the ClusterRoleBinding.

Prerequisites

• A deployed GKE cluster.
• A GCP service account with the Kubernetes Engine Developer role.
• Access to a GCP account with the Kubernetes Engine Admin role.

1. Run the following command with the service account that has the GCP Kubernetes Engine Admin role:

$ kubectl create clusterrolebinding your-dev-user-cluster-admin-binding \
    --clusterrole=cluster-admin \
    --user=[e-mail]

1. Once the ClusterRoleBinding is created, use the service account with the Kubernetes Engine Developer role to continue with the standard installation of Prisma Cloud Defenders.

   • If your GKE cluster uses ARM or multi-architecture nodes, you must edit the daemonset.yaml configuration file to ensure compatibility with your workloads.
   • If you’re using Anthos Service Mesh on GKE, ensure the Monitor Istio option is set to Off during Defender deployment. This option is relevant only for Istio Service Mesh, not Anthos. On Prisma Cloud console Manage > Defenders > Manual Deploy > Orchestrator and set Orchestrator Type to Kubernetes and adjust Advanced Settings.

     

Troubleshooting

• If you see the following error while creating the Defender DaemonSet:

  Error from server (Forbidden): error when creating "daemonset.yaml": clusterroles.rbac.authorization.k8s.io is forbidden: User "[e-mail]" cannot create clusterroles.rbac.authorization.k8s.io at the cluster scope: Required "container.clusterRoles.create" permission.
  
  Error from server (Forbidden): error when creating "daemonset.yaml": clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "[e-mail]" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope: Required "container.clusterRoleBindings.create" permission.

  This means the service account lacks the necessary permissions. Ensure the correct ClusterRole is assigned by following the steps detailed in the procedure.
• If you see the following error:

  Error from server (Forbidden): error when creating "daemonset.yaml": clusterroles.rbac.authorization.k8s.io "twistlock-view" is forbidden: attempt to grant extra privileges: [{[list] [rbac.authorization.k8s.io] [roles] [] []} {[list] [rbac.authorization.k8s.io] [rolebindings] [] []} {[list] [rbac.authorization.k8s.io] [clusterroles] [] []} {[list] [rbac.authorization.k8s.io] [clusterrolebindings] [] []}] user=&{[e-mail]  [system:authenticated] map[user-assertion.cloud.google.com:[iVWgsppUtVXaN1xToHtXpQdi5jJy6jv7BlSUZSUNTMjI2N77AaL5zQwZse0rqdu0Bz/35+6CG//82jdATfqfEWxDIRdAYHGvzRweXDZxOvI4EZzhyUVVKHJKL6i6v47VlFsHtSMx63QiVWgsppUtVXaN1xToHtXpQmU3nNtlspQaH3RtqSLwK/MoqW3Cc+VkWmuxyGUCYcW94Ttd6euy8iVWgsppUtVXaN1xToHtXpQWhRRTxlidgQdMzAbcAAbbv2C/uMlWs4VkzII7i9l6EEg==]]} ownerrules=[{[create] [authorization.k8s.io] [selfsubjectaccessreviews selfsubjectrulesreviews] [] []} {[get] [] [] [] [/api /api/* /apis /apis/* /healthz /openapi /openapi/* /swagger-2.0.0.pb-v1 /swagger.json /swaggerapi /swaggerapi/* /version /version/]}] ruleResolutionErrors=[]

  Ensure the service account has the Kubernetes cluster-admin role to avoid permission issues during Defender resource creation.