Deploy Defenders as DaemonSets

Kubernetes lets you set up a cluster with the container runtime of your choice. Prisma Cloud supports Docker Engine, CRI-O, and cri-containerd.

When generating the YAML file or Helm chat to deploy the Defender DaemonSet, you can select the Container Runtime type on Prisma Cloud console from Manage > Defenders > Defenders: Deployed > Manual deploy.

Since Defenders need to have a view of other containers, this option is necessary to guide the communication.

If you use containerd on GKE, and you install Defender without selecting the CRI-O Container Runtime type, everything will appear to work properly, but you’ll have no images or container scan reports in Monitor > Vulnerability and Monitor > Compliance pages and you’ll have no runtime models in Monitor > Runtime. This happens because the Google Container Optimized Operating system (GCOOS) nodes have Docker Engine installed, but Kubernetes doesn’t use it. Defender thinks everything is OK because all of the integrations succeed, but the underlying runtime is actually different.

If you’re deploying Defender DaemonSets with twistcli, use the following flag with one of the container runtime types:

• --container-runtime docker
• --container-runtime crio
• --container-runtime containerd

When generating YAML from Console or twistcli, there is a simple change to the yaml file as seen below.

In this abbreviated version DEFENDER_TYPE:daemonset will use the Docker interface.

To change the default containerd data directory from /var/lib/containerd to a custom directory (for example: /var/lib/kubelet/containerd), modify the volumeMounts and volumes sections. Here is an example:

To change the default containerd data directory from /var/lib/containerd to a custom directory (for example: /var/lib/kubelet/containerd), modify the volumeMounts and volumes sections. Here is an example:

In this abbreviated version DEFENDER_TYPE:cri will use the CRI.

Similar to the Defenders, to customize the containerd data directory, modify the paths in the volumeMounts and volumes sections accordingly.