Troubleshooting

Table of Contents

Resolve missing Kubernetes IP-tags in the Tag Mapping State view by checking permissions, network access, and label filters.

Where Can I Use This?	What Do I Need?
Prisma AIRS - AI Runtime Security	Tag distribution configured in Strata Cloud Manager for a public Kubernetes cluster Edit access to the EKS, GKE, AKS cluster

If a cluster's tags do not appear in the Tag Mapping State view, check the following in order:

Terraform banner: Confirm there is no "apply the new Terraform" warning banner in SCM. Re-apply if prompted. After re-applying, the banner can take up to 24 hours to clear. Cluster monitoring starts within 15 minutes regardless.
Public endpoint: Confirm the cluster has a public API server endpoint. Private clusters are not supported.
IP allowlist: If the API server endpoint is IP-restricted, confirm that both of the Palo Alto Networks IPs for your tenant region are allowlisted (see Prerequisites).
EKS: Confirm the authentication mode is API or API_AND_CONFIG_MAP, and that the access entry with AmazonEKSAdminViewPolicy exists on that specific cluster.
AKS: Confirm Microsoft Entra ID is enabled, and that the custom role (Azure RBAC) or ClusterRole (Kubernetes RBAC) is applied correctly.
GKE: Confirm roles/container.viewer is granted at the project level to the correct service account.
Labels mode: Confirm tag key-value pairs match exactly (case-sensitive) what is set on the cluster in the cloud portal.
Wait: Allow approximately 15 minutes after any permission change before rechecking.