Install the Cortex® XDR™ Agent for Kubernetes Hosts
Learn how to install the Cortex® XDR™ agent for a Kubernetes host.
You can deploy the Cortex XDR agent for Linux on Kubernetes Clusters as a DaemonSet on any Kubernetes cluster. To deploy the agent, you create a Cortex XDR agent YAML installation package in Cortex XDR which allows you to configure attributes such as namespace default value and nodeselector. Once the Kubernetes agent is running on the endpoint, the agent offers the same protection capabilities and operates as any standard Cortex XDR agent for Linux. Cortex XDR issues a license for every node on which the agent is running, and will revoke the license once the agent is removed or the node is deleted. The Cortex XDR management console displays the Kubernetes Cluster and includes in the causality card a visual indication on processes that are running within containers, including information about the container itself such as its name, ID, image, etc.
Palo Alto Networks supports only Cortex XDR agent deployments carried out with the original YAML installation package generated directly from the Cortex XDR management console and carried out as a DaemonSet. If you attempt to edit the YAML settings after you created the package, the installation could fail or cause the agent to display unexpected behavior.
The following are prerequisites to use this deployment method:
To install the agent on your cluster:
- Download the Cortex XDR agent YAML installation file from Cortex XDR.If you are running a Cortex XDR agent earlier the version 7.7, you need to recreate and deploy the latest YAML file over the current file.
- Copy the YAML file to the Kubernetes cluster you want to deploy it on.
- Log on to your Kubetnetes cluster.
- Deploy the Yaml file. Run a standard YAML installation command line.For example,kubectl apply -f cortex-xdr.yaml.
- Verify the agents are running.Runkubectl get pods -A -owide, and verify the Cortex XDR agent pod is running on your target node(s).Runcat /proc/$(pidof pmd)/maps | grep bpfec, and verify the agent is running in user space mode by checking the operational status.
- Use the Cortex XDR Agent for Kubernetes.
- Upgrade the agent.
- When you enableAlways deploy with latest agent version, andAgent Auto Upgradeis enabled, then the Cortex XDR agent will upgrade automatically whenever a new version is available.
- Otherwise, when one or both of these settings are disabled, you must create a new YAML installation file from the Cortex XDR management console and re-install the agent.
- Uninstall the agent.To uninstall the agent, remove the DaemonSet using the standard command line, for example:kubectl delete -n cortex-xdr daemonset/cortex-agent.
Recommended For You
Recommended videos not found.