> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/33/install/deploy-defender/orchestrator/install-gke-autopilot.md).

# Google Kubernetes Engine (GKE) Autopilot

You can now install the Prisma Cloud DaemonSet Defender on your GKE Autopilot cluster. GKE Autopilot clusters use [COS](https://cloud.google.com/kubernetes-engine/docs/concepts/using-containerd) (Container-Optimized OS) with Containerd nodes, therefore the DaemonSet must be configured with **Containerd**. Defenders deployed on GKE Autopilot clusters only support the official Prisma Cloud registry, and you cannot use a custom registry. The DaemonSet image must adhere to the following regex to ensure it comes from the official repository:

```
^registry-auth\\.twistlock\\.com/.*/twistlock/defender.*.
```

To ensure a successful deployment, do not modify the volume mounts or capabilities from the YAML generated. Any changes may cause issues with GCP allow list and deployment in GKE Autopilot.

## Prerequisites

GKE Autopilot does not natively support DaemonSet scaling. In case of resource exhaustion or insufficient resources, Defender pods may not start. To mitigate this, consider configuring a **PriorityClass** to prioritize Defender pods. Here are the steps for mitigation:

1. Create a PriorityClass YAML to prioritize the Defender pods:

   ```
   apiVersion: scheduling.k8s.io/v1
   kind: PriorityClass
   metadata:
     name: pcc-defender-ds
   value: 1000000000
   globalDefault: false
   description: "Deploy defender daemonset"
   ```

   Apply it to your cluster:

   ```
   kubectl apply -f pc.yaml
   ```
2. Reference the PriorityClass in the DaemonSet YAML under `/spec/template/spec`:

   ```
   priorityClassName: pcc-defender-ds
   ```

This will prioritize the Defender pods over other workloads in the cluster.

Here are the steps to deploy the Prisma Cloud DaemonSet Defender on a Google Kubernetes Engine (GKE) Autopilot.

## Deploy Google Kubernetes Engine (GKE) Autopilot.

Here are the steps to deploy the Prisma Cloud DaemonSet Defender on a Google Kubernetes Engine (GKE) Autopilot.

1. Review the prerequisites and the procedure in the Google Kubernetes Engine (GKE) and the Install Prisma Cloud on a CRI (non-Docker) cluster sections.
2. Use the following twistcli command to generate the YAML file for the GKE Autopilot deployment.

   ```
      $ <PLATFORM>/twistcli defender export kubernetes \
       --gke-autopilot \
       --container-runtime containerd \
       --cluster-address <console address> \
       --address https://<console address>:443
   ```

   * The `--gke autopilot flag` adds the ’autopilot.gke.io/no-connect: "true"’ \`annotation to the YAML file.
   * The `--container-runtime containerd` flag ensures compatibility with GKE Autopilot clusters by using the Container-Optimized OS with the containerd node image (instead of Docker). This also removes the `/var/lib/containers` mount, which is not required for GKE Autopilot.

If you are on Prisma Cloud console, from **Runtime Security > Manage > Defenders > Deployed Defenders > Manual deploy** ensure that the orchestrator type is **Kubernetes**, select the **Container Runtime type** as Containerd and from **Advanced Settings** enable **GKE Autopilot deployment**.

<figure><img src="/files/SbnDobqBOfGzZBaICblt" alt="deploy gke"><figcaption></figcaption></figure>

1. Create the twistlock namespace on your cluster by running the following command:

   ```
   $ kubectl create namespace twistlock
   ```
2. Deploy the updated YAML or the Helm chart on your GKE Autopilot cluster.
3. Verify that the Defenders are deployed.

After a few minutes, verify that the Defenders are deployed. You should observe the nodes and running containers in the Console, confirming that Prisma Cloud Compute is now protecting your cluster.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/admin-guide/33/install/deploy-defender/orchestrator/install-gke-autopilot.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.