Azure Container Service (ACS) with Kubernetes
Table of Contents
Self.Hosted 31.xx
Expand all | Collapse all
-
- Getting started
- System Requirements
- Cluster Context
-
- Prisma Cloud Container Images
- Kubernetes
- Deploy the Prisma Cloud Console on Amazon ECS
- Console on Fargate
- Onebox
- Alibaba Cloud Container Service for Kubernetes (ACK)
- Azure Container Service (ACS) with Kubernetes
- Azure Kubernetes Service (AKS)
- Amazon Elastic Kubernetes Service (EKS)
- IBM Kubernetes Service (IKS)
- OpenShift v4
-
- Defender Types
- Manage your Defenders
- Redeploy Defenders
- Uninstall Defenders
-
- Deploy Orchestrator Defenders on Amazon ECS
- Automatically Install Container Defender in a Cluster
- Deploy Prisma Cloud Defender from the GCP Marketplace
- Deploy Defenders as DaemonSets
- VMware Tanzu Application Service (TAS) Defender
- Deploy Defender on Google Kubernetes Engine (GKE)
- Google Kubernetes Engine (GKE) Autopilot
- Deploy Defender on OpenShift v4
-
- Agentless Scanning Modes
-
- Onboard AWS Accounts for Agentless Scanning
- Onboard Azure Accounts for Agentless Scanning
- Configure Agentless Scanning for Azure
- Onboard GCP Accounts for Agentless Scanning
- Configure Agentless Scanning for GCP
- Onboard Oracle Cloud Infrastructure (OCI) Accounts for Agentless Scanning
- Configure Agentless Scanning for Oracle Cloud Infrastructure (OCI)
- Agentless Scanning Results
-
- Rule ordering and pattern matching
- Backup and Restore
- Custom feeds
- Configuring Prisma Cloud proxy settings
- Prisma Cloud Compute certificates
- Configure scanning
- User certificate validity period
- Enable HTTP access to Console
- Set different paths for Defender and Console (with DaemonSets)
- Authenticate to Console with Certificates
- Configure custom certs from a predefined directory
- Customize terminal output
- Collections
- Tags
- Logon settings
- Reconfigure Prisma Cloud
- Subject Alternative Names
- WildFire Settings
- Log Scrubbing
- Clustered-DB
- Permissions by feature
-
- Logging into Prisma Cloud
- Integrating with an IdP
- Integrate with Active Directory
- Integrate with OpenLDAP
- Integrate Prisma Cloud with Open ID Connect
- Integrate with Okta via SAML 2.0 federation
- Integrate Google G Suite via SAML 2.0 federation
- Integrate with Azure Active Directory via SAML 2.0 federation
- Integrate with PingFederate via SAML 2.0 federation
- Integrate with Windows Server 2016 & 2012r2 Active Directory Federation Services (ADFS) via SAML 2.0 federation
- Integrate Prisma Cloud with GitHub
- Integrate Prisma Cloud with OpenShift
- Non-default UPN suffixes
- Compute user roles
- Assign roles
-
- Prisma Cloud Vulnerability Feed
- Scanning Procedure
- Vulnerability Management Policies
- Vulnerability Scan Reports
- Scan Images for Custom Vulnerabilities
- Base images
- Vulnerability Explorer
- CVSS scoring
- CVE Viewer
-
- Configure Registry Scans
- Scan Images in Alibaba Cloud Container Registry
- Scan Images in Amazon Elastic Container Registry (ECR)
- Scan images in Azure Container Registry (ACR)
- Scan Images in Docker Registry v2 (including Docker Hub)
- Scan Images in GitLab Container Registry
- Scan images in Google Artifact Registry
- Scan Images in Google Container Registry (GCR)
- Scan Images in Harbor Registry
- Scan Images in IBM Cloud Container Registry
- Scan Images in JFrog Artifactory Docker Registry
- Scan Images in Sonatype Nexus Registry
- Scan images in OpenShift integrated Docker registry
- Scan Images in CoreOS Quay Registry
- Trigger Registry Scans with Webhooks
- Configure VM image scanning
- Configure code repository scanning
- Malware scanning
- Windows container image scanning
- Serverless Functions Scanning
- VMware Tanzu Blobstore Scanning
- Scan App-Embedded workloads
- Troubleshoot Vulnerability Detection
-
- Compliance Explorer
- Enforce compliance checks
- CIS Benchmarks
- Prisma Cloud Labs compliance checks
- Serverless functions compliance checks
- Windows compliance checks
- DISA STIG compliance checks
- Custom compliance checks
- Trusted images
- Host scanning
- VM image scanning
- App-Embedded scanning
- Detect secrets
- OSS license management
-
- Alert Mechanism
- AWS Security Hub
- Cortex XDR alerts
- Cortex XSOAR alerts
- Email alerts
- Google Cloud Pub/Sub
- Google Cloud Security Command Center
- IBM Cloud Security Advisor
- JIRA Alerts
- PagerDuty alerts
- ServiceNow alerts for Security Incident Response
- ServiceNow alerts for Vulnerability Response
- Slack Alerts
- Splunk Alerts
- Webhook alerts
- API
Azure Container Service (ACS) with Kubernetes
Use the following procedure to install Prisma Cloud in an ACS Kubernetes cluster.
Microsoft will retire ACS as a standalone service on January 31, 2020.
Prerequisites
- You have deployed an Azure Container Service with Kubernetes cluster.
- You have installed Azure CLI 2.0.22 or later on a Linux system.
- You have downloaded the Prisma Cloud software.
- Create a persistent volume for your Kubernetes cluster. ACS uses Azure classic disks for the persistent volume. Within the same Resource Group as the ACS instance, create a classic storage group.
- On a Windows based system use Disk Manager to create an unformatted, 100GB Virtual Hard Disk (VHD).
- Use Azure Storage Explorer to upload the VHD to the classic storage group.
- Make sure the disk is 'released' from a 'lease'.
- On your Linux host with Azure CLI installed, attach to your ACS Kubernetes Master.$ az acs kubernetes get-credentials --resource-group pfoxacs --name pfox-acs Merged "pfoxacsmgmt" as current context in /Users/paulfox/.kube/config$ kubectl config use-context pfoxacsmgmtConfirm connectivity to the ACS Kubernetes cluster.$ kubectl get nodes NAME STATUS ROLES AGE VERSION k8s-agent-e32fd1a6-0 Ready agent 4m v1.7.7 k8s-agent-e32fd1a6-1 Ready agent 5m v1.7.7 k8s-master-e32fd1a6-0 Ready master 4m v1.7.7Create a file named persistent-volume.yaml, and open it for editing.apiVersion: v1 kind: PersistentVolume metadata: name: twistlock-console labels: app: twistlock-console annotations: volume.beta.kubernetes.io/storage-class: default spec: capacity: storage: 100Gi accessModes: - ReadWriteOnce azureDisk: diskName: pfox-classic-tl-console.vhd diskURI: https://pfoxacs.blob.core.windows.net/twistlock-console/pfox-classic-tl-console.vhd cachingMode: ReadWrite fsType: ext4 readOnly: falseCreate the persistent volume:$ kubectl create -f ./persistent-volume.yamlGenerate the Console YAML configuration file:$ /linux/twistcli console export kubernetes \ --persistent-volume-labels app:twistlock-console \ --storage-class default
- app:twistlock-console label defined in the persistent-volume.yaml.
- default must match the storage class of the Azure Disk.
Deploy the Prisma Cloud Console in your cluster.$ kubectl create -f ./twistlock-console.yamlWait for the service to come up completely.$ kubectl get service -w -n twistlockContinue with the rest of the install here.Recommended For You