Pivotal Container Service

Pivotal Container Service (PKS) lets you deploy Kubernetes clusters on demand. Use our standard Kubernetes install procedure to deploy Prisma Cloud to PKS. The only difference between PKS and standard Kubernetes is the location of the Docker socket. A single line change in the Prisma Cloud configuration file lets you specify the path to the Docker socket in PKS. From there, follow the normal Kubernetes install procedure.

Preflight checklist

To ensure that your installation goes smoothly, work through the following checklist and validate that all requirements are met.

General

  • You have a valid Prisma Cloud license key and access token.

Cluster

  • You have provisioned a PKS cluster that meets the minimum system requirements.
  • Prisma Cloud Defender requires elevated privileges. Ensure that the following permissions are set in your PKS cluster:
    • Set Privileged Containers to true (enabled).
    • Set DenyEscalatingExec to false (disabled). After Prisma Cloud is installed, you can utilize it to deny other privileged containers from starting and deny escalation of privileges.
  • The nodes in your cluster can reach Prisma Cloud’s cloud registry (registry-auth.twistlock.com).

Permissions

  • You can create and delete namespaces in your cluster.
  • You can Run
    kubectl create
    commands.

Firewalls and external IP addresses

Validate that the following ports are open:
Prisma Cloud Console
:
  • Incoming: 8081, 8083, 8084
  • Outgoing: 443, 53
Prisma Cloud Defenders
:
  • Incoming: None
  • Outgoing: 8084

Install Prisma Cloud

Prepare your PKS environment, then use the standard procedure for installing Prisma Cloud on Kubernetes.

Download the Prisma Cloud software

Download the Prisma Cloud software to your cluster’s controller node.
  1. Go to Releases, and copy the link to current recommended release.
  2. Download the release tarball to your cluster controller.
    $ wget <LINK_TO_CURRENT_RECOMMENDED_RELEASE_LINK>
  3. Unpack the Prisma Cloud release tarball.
    $ mkdir twistlock $ tar xvzf twistlock_<VERSION>.tar.gz -C twistlock/
  4. Open
    twistlock/twistlock.cfg
    and set the path to the Docker socket.
    DOCKER_SOCKET=${DOCKER_SOCKET:-/var/vcap/data/sys/run/docker/docker.sock}
  5. In twistlock.cfg, set RUN CONSOLE AS ROOT to true.
    RUN_CONSOLE_AS_ROOT=${RUN_CONSOLE_AS_ROOT:-true}

Install Prisma Cloud

Proceed with the instructions for installing Prisma Cloud on Kubernetes.

Recommended For You