Manually upgrade Defender DaemonSets

Manually upgrade Defender DaemonSets in your environment.

Manually upgrade Defender DaemonSets with twistcli (Kubernetes)

Delete the Defender DaemonSet, then rerun the original install procedure.
Prerequisites:
You know all the parameters passed to twistcli when you initially deployed the Defender DaemonSet. You’ll need them to recreate a working configuration file for your environment.
  1. Delete the Defender DaemonSet.
    $ kubectl -n twistlock delete ds twistlock-defender-ds $ kubectl -n twistlock delete sa twistlock-service $ kubectl -n twistlock delete secret twistlock-secrets
    Code copied to clipboard
    Unable to copy due to lack of browser support.
  2. Retrive Console’s API address (PRISMA_CLOUD_COMPUTE_CONSOLE_URL).
    1. Sign into Prisma Cloud.
    2. Go to
      Compute > Manage > System > Utilities
      .
    3. Copy the URL under
      Path to Console
      .
  3. Retrieve Console’s hostname (PRISMA_CLOUD_COMPUTE_HOSTNAME).
    The hostname can be derived from the URL by removing the protocol scheme and path. It is simply the host part of the URL. You can also retrieve the hostname directly.
    1. Go to
      Compute > Manage > Defenders > Deploy > Defenders > Orchestrator
    2. Copy the hostname from
      Step 3
      (
      The name that Defender will use to connect to this Console
      )
  4. Generate a defender.yaml file, where:
    The following command connects to Console (specified in --address) as user <ADMIN> (specified in --user), and generates a Defender DaemonSet YAML config file according to the configuration options passed to twistcli. The --cluster-address option specifies the address Defender uses to connect to Console.
    $ <PLATFORM>/twistcli defender export kubernetes \ --user <ADMIN_USER> \ --address https://yourconsole.example.com:8083 \ --cluster-address twistlock-console
    Code copied to clipboard
    Unable to copy due to lack of browser support.
    • <PLATFORM> can be linux, osx, or windows.
    • <ADMIN_USER> is the name of a Prisma Cloud user with the System Admin role.
  5. Deploy the Defender DaemonSet.
    $ kubectl create -f defender.yaml
    Code copied to clipboard
    Unable to copy due to lack of browser support.
  6. In Prisma Cloud, go to
    Compute > Manage > Defenders > Manage > DaemonSets
    to see a list of deployed Defenders.

Manually upgrade Defender DaemonSets with twistcli (OpenShift)

Delete the Defender DaemonSet, then rerun the original install procedure.
Prerequisites:
You know all the parameters passed to twistcli when you initially deployed the Defender DaemonSet. You’ll need them to recreate a working configuration file for your environment.
  1. Delete the Defender DaemonSet.
    $ oc -n twistlock delete ds twistlock-defender-ds $ oc -n twistlock delete sa twistlock-service $ oc -n twistlock delete secret twistlock-secrets
    Code copied to clipboard
    Unable to copy due to lack of browser support.
  2. Retrive Console’s API address (PRISMA_CLOUD_COMPUTE_CONSOLE_URL).
    1. Sign into Prisma Cloud.
    2. Go to
      Compute > Manage > System > Utilities
      .
    3. Copy the URL under
      Path to Console
      .
  3. Retrieve Console’s hostname (PRISMA_CLOUD_COMPUTE_HOSTNAME).
    The hostname can be derived from the URL by removing the protocol scheme and path. It is simply the host part of the URL. You can also retrieve the hostname directly.
    1. Go to
      Compute > Manage > Defenders > Deploy > Defenders > Orchestrator
    2. Copy the hostname from
      Step 3
      (
      The name that Defender will use to connect to this Console
      )
  4. Generate a defender.yaml file, where:
    The following command connects to Console (specified in --address) as user <ADMIN> (specified in --user), and generates a Defender DaemonSet YAML config file according to the configuration options passed to twistcli. The --cluster-address option specifies the address Defender uses to connect to Console.
    $ <PLATFORM>/twistcli defender export openshift \ --user <ADMIN_USER> \ --address https://yourconsole.example.com:8083 \ --cluster-address twistlock-console \ --selinux-enabled
    Code copied to clipboard
    Unable to copy due to lack of browser support.
    • <PLATFORM> can be linux, osx, or windows.
    • <ADMIN_USER> is the name of a Prisma Cloud user with the System Admin role.
  5. Deploy the Defender DaemonSet.
    $ oc create -f defender.yaml
    Code copied to clipboard
    Unable to copy due to lack of browser support.
  6. In Prisma Cloud, go to
    Compute > Manage > Defenders > Manage > DaemonSets
    to see a list of deployed Defenders.

Manually upgrade Defender DaemonSets from Console

Upgrade the Defender DaemonSets directly from the Console UI.
If you can’t access your cluster with kubectl or oc, then you can upgrade Defender DaemonSets directly from the Console UI.
Prerequisites:
You’ve created a kubeconfig credential for your cluster so that Prisma Cloud can access it to upgrade the Defender DaemonSet.
  1. Log into Prisma Cloud Console.
  2. Go to
    Manage > Defenders > Manage
    .
  3. Click
    DaemonSets
    .
  4. For each cluster in the table, click
    Actions > Upgrade
    .
    The table shows a count of deployed Defenders and their new version number.

Recommended For You