Step 1: Connect the Cluster

1. Create the venafi namespace:

   kubectl create namespace venafi

2. Create a Kubernetes Secret with your credentials:

   kubectl create secret generic discovery-agent-credentials \
     --namespace=venafi \
     --from-file=clientID=clientid.txt
     --from-file=privatekey.pem=discovery-agent-private-key.pem

3. Create a discovery-agent.values.yaml file with the cluster name and your TSG ID, using double quotes so that it's interpreted as a string:

   config:
     clusterName: my-cluster-name
     clusterDescription: "My cluster description"
     tsgID: "0000000000"
     claimableCerts: false

   Set claimableCerts based on how you want to handle discovered certificates:

   • false (default): Discovered certificates are automatically claimed by the tenant that created the Built-In Account, even if it is a child tenant.
   • true: Certificates remain unclaimed, making them available for other tenants to claim.
4. (Optional) To use a custom CA bundle, create a ConfigMap with your trusted certificates:

   kubectl --namespace venafi create configmap ca-cert \
     --from-file=ca-cert.crt=<file-name>

   Add the following to your discovery-agent.values.yaml to mount the trust bundle into the Agent pod:

   volumes:
   - name: ca-cert
     configMap:
       name: ca-cert
   volumeMounts:
   - name: ca-cert
     mountPath: /etc/ssl/certs/ca-cert.crt
     subPath: ca-cert.crt
     readOnly: true

5. (Optional) If your cluster requires a proxy, add the following to your discovery-agent.values.yaml and update them for your environment:

   http_proxy: "http://proxy.example.com:8080"
   https_proxy: "https://proxy.example.com:8443"
   no_proxy: "127.0.0.1,localhost,kubernetes.default.svc,kubernetes.default.svc.cluster.local"

   Add <tsgID>.ngts.paloaltonetworks.com to your egress proxy allowlist, for example 1234567891.ngts.paloaltonetworks.com.
6. Install Discovery Agent and wait for it to be ready:

   helm upgrade discovery-agent \
     oci://registry.ngts.paloaltonetworks.com/charts/discovery-agent \
     --install \
     --namespace "venafi" \
     --values discovery-agent.values.yaml

Step 2: Verify the Cluster Connection

1. In Next-Gen Trust Security, click Insights > Kubernetes Clusters and confirm that your cluster appears.
2. In Next-Gen Trust Security, click Insights > Certificates and confirm that any discovered certificates appear.
3. Check the Discovery Agent logs to confirm a successful connection:

   kubectl logs -n venafi -l app.kubernetes.io/instance=discovery-agent

   A successful connection produces output similar to the following:

   {"msg":"Starting","version":"v1.10.0","logger":"Run"}
   {"msg":"Starting DataGatherer","name":"k8s/discovery"}
   {"msg":"Starting DataGatherer","name":"k8s/secrets"}
   {"msg":"Starting DataGatherer","name":"k8s/deployments"}
   {"msg":"Starting DataGatherer","name":"k8s/pods"}
   {"msg":"Successfully gathered","count":6,"name":"k8s/secrets"}
   {"msg":"Successfully gathered","count":6,"name":"k8s/deployments"}
   {"msg":"Successfully gathered","count":13,"name":"k8s/pods"}
   {"msg":"uploading data readings to NGTS","cluster_name":"my-cluster-name","data_readings_count":8}
   {"msg":"Data sent successfully","logger":"postData"}

Related Links

• Discover Certificates in Kubernetes Clusters
• Kubernetes Clusters Page
• Kubernetes Cluster Details
• Kubernetes Components in Next-Gen Trust Security