> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/install/deploy-defender/orchestrator/install-cluster-container-defender.md). # Automatically Install Container Defender in a Cluster Container orchestrators provide native capabilities for deploying agents, such as Defender, to every node in the cluster. Prisma Cloud leverages these capabilities to install Defender. The process for deploying Container Defender to a cluster can be found in the dedicated orchestrator-specific [install guides](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/compute-edition/34/admin-guide/install/install.md). If you wish to automate the defenders deployment process to a cluster, or you don’t have kubectl access to your cluster (or oc access for OpenShift), you can deploy Defender DaemonSets directly from the Console UI. This Defender install flow doesn’t let you manually configure a cluster name. Cluster names let you [segment your views](/admin-guide/technology-overviews/radar.md#cluster-pivot) of the environment. For most cases, this shouldn’t be a problem because if you’re deploying to a managed cluster, then Prisma Cloud retrieves the cluster name directly from the cloud provider. If you must manually specify a name, deploy your Defenders from **Manage > Defenders > Deploy > DaemonSet** or use twistcli. If your clusters use **ARM architecture or multiple architectures** on Google Kubernetes Engine (GKE) you can’t use the following procedure to automatically deploy the defenders. Instead, use the [manual installation procedure for Kubernetes](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/compute-edition/34/admin-guide/install/deploy-defender/orchestrator/orchestrator.md#install-defender) and edit the `daemonset.yaml` configuration file to [prepare your workloads](https://cloud.google.com/kubernetes-engine/docs/how-to/prepare-arm-workloads-for-deployment#node-affinity-multi-arch-arm). ## Deploy Defender DaemonSet using kubeconfig **Prerequisites:** * You’ve created a [kubeconfig credential](/admin-guide/authentication/credentials-store/kubernetes-credentials.md) for your cluster so that Prisma Cloud can access it to deploy the Defender DaemonSet. **Deployment process:** 1. Log into Prisma Cloud Console. 2. Go to **Manage > Defenders > Manage**. 3. Click **DaemonSets**. 4. For each cluster in the table, click **Actions > Deploy**. The table shows a count of deployed Defenders and their version number. ## Deploy Defender DaemonSet for GKE **Prerequisites:** * You deployed a GKE cluster * You created a corresponding Service Account key in JSON format. The Service Account should have the following permissions: * Editor * Compute Storage Admin * Kubernetes Engine Admin * Service Account Token Creator * You created a xref:\~/authentication/credentials-store/gcp-credentials.adoc.adoc\[GCP credential] for your cluster so that Prisma Cloud can access it to deploy the Defender DaemonSet: 1. Log into Prisma Cloud Console. 2. Go to **Manage > Authentication > Credentials Store** 3. Click **Add credential** button 4. Select type **GCP** and credential level, then copy the content of the JSON Service Account key into the Service Account line (take it all including brackets). To deploy the Defender DaemonSet, use the following procedure. 1. Log into Prisma Cloud Console. 2. Go to **Manage > Defenders > Manage > DaemonSets**. When the page is loaded, multiple rows of K8S clusters visible with SA credentials are displayed. For GCP organizations with hundreds of projects, using organization level credentials might affect the performance of the page and the time to load the clusters. Therefore, the best approach to reduce the time and to avoid potential timeouts, is to divide the projects within your organization into multiple GCP folders. Then, create a service account and credential for each one of them. 3. Verify that the status is **Success** and the Defender count is 0/0 for all relevant clusters. 4. For each cluster, click **Actions > Deploy**. 5. Refresh the view and verify that for each cluster the version is the correct, the status is **Success**, and the Defender count is equal to the number of cluster nodes. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.prismacloud.io/admin-guide/install/deploy-defender/orchestrator/install-cluster-container-defender.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.