Deploy the Prisma Cloud Console on ACS

Use the following procedure to install Prisma Cloud in an ACS Kubernetes cluster.

Microsoft will retire ACS as a standalone service on January 31, 2020.

Prerequisites

• You have deployed an Azure Container Service with Kubernetes cluster.
• You have installed Azure CLI 2.0.22 or later on a Linux system.
• You have downloaded the Prisma Cloud software.

1. Create a persistent volume for your Kubernetes cluster. ACS uses Azure classic disks for the persistent volume. Within the same Resource Group as the ACS instance, create a classic storage group.
2. On a Windows based system use Disk Manager to create an unformatted, 100GB Virtual Hard Disk (VHD).
3. Use Azure Storage Explorer to upload the VHD to the classic storage group.
4. Make sure the disk is 'released' from a 'lease'.
5. On your Linux host with Azure CLI installed, attach to your ACS Kubernetes Master.

   $ az acs kubernetes get-credentials --resource-group pfoxacs --name pfox-acs
   Merged "pfoxacsmgmt" as current context in /Users/paulfox/.kube/config
   
   $ kubectl config use-context pfoxacsmgmt

6. Confirm connectivity to the ACS Kubernetes cluster.

   $ kubectl get nodes
   NAME                    STATUS    ROLES     AGE       VERSION
   k8s-agent-e32fd1a6-0    Ready     agent     4m        v1.7.7
   k8s-agent-e32fd1a6-1    Ready     agent     5m        v1.7.7
   k8s-master-e32fd1a6-0   Ready     master    4m        v1.7.7

7. Create a file named persistent-volume.yaml, and open it for editing.

   apiVersion: v1
   kind: PersistentVolume
   metadata:
     name: twistlock-console
     labels:
       app: twistlock-console
     annotations:
       volume.beta.kubernetes.io/storage-class: default
   spec:
     capacity:
       storage: 100Gi
     accessModes:
       - ReadWriteOnce
     azureDisk:
       diskName: pfox-classic-tl-console.vhd
       diskURI: https://pfoxacs.blob.core.windows.net/twistlock-console/pfox-classic-tl-console.vhd
       cachingMode: ReadWrite
       fsType: ext4
       readOnly: false

   diskName	Name of the persistent disk created in the previous steps.
   labels	Label for the persistent volume.
   diskURI	Azure subscription path to the disk created in the previous steps.

8. Create the persistent volume:

     $ kubectl create -f ./persistent-volume.yaml

9. Generate the Console YAML configuration file:

     $ /linux/twistcli console export kubernetes \
       --persistent-volume-labels app:twistlock-console \
       --storage-class default

   --persistent-volume-labels	app:twistlock-console label defined in the persistent-volume.yaml.
   --storage-class	default must match the storage class of the Azure Disk.

10. Deploy the Prisma Cloud Console in your cluster.

      $ kubectl create -f ./twistlock-console.yaml

11. Wait for the service to come up completely.

      $ kubectl get service -w -n twistlock

12. Configure the console as described in Configure the Prisma Cloud Console.