Configure Kubernetes Connector resource limits - Administrator Guide - Cortex CLOUD

From the Kubernetes Connect wizard, click Generate to download the K8s-security-profile-panw-DATE.values.yaml file from the first step.

Edit the file to adjust the requests and limits of the workloads.

Use this example as a reference when configuring your file:

konnector-template:
  enabled: true

  # ===========================================================================
  # Core — Cortex Manager (k8sConnector) — full override
  # ===========================================================================
  coreValues:
    resources:
      k8sConnector:
        overrides:
          requests:
            cpu: "300m"
            memory: "256Mi"
          limits:
            cpu: "500m"
            memory: "512Mi"

  # ===========================================================================
  # Monitoring — OpenTelemetry Collector (otel) — full override
  # ===========================================================================
  monitoringValues:
    enabled: true
    resources:
      otel:
        overrides:
          requests:
            cpu: "100m"
            memory: "200Mi"
          limits:
            cpu: "300m"
            memory: "400Mi"

  # ===========================================================================
  # Posture — admission controller, orchestrator, and spawned jobs
  # ===========================================================================
  postureValues:
    enabled: true
    admissionController:
      enabled: true
      failurePolicy: Ignore
    jobOrchestrator:
      scanIntervalHours: 12

    resources:
      # Admission Controller — full override
      admissionController:
        overrides:
          requests:
            cpu: "100m"
            memory: "300Mi"
          limits:
            cpu: "300m"
            memory: "600Mi"

      # Job Orchestrator — CPU request + CPU limit only
      # (memory keeps defaults: requests.memory=75Mi, limits.memory=100Mi)
      jobOrchestrator:
        overrides:
          requests:
            cpu: "50m"      # was 25m
          limits:
            cpu: "100m"     # was 50m

      # Resources for jobs spawned by the orchestrator
      jobResources:
        # Host Scanner — memory limit only
        # (CPU and memory request keep defaults)
        host-scanner:
          overrides:
            limits:
              memory: "8Gi"   # was 4.5Gi

        # Inventory Collector — CPU request + CPU limit only
        # (memory keeps defaults: requests.memory=50Mi, limits.memory=100Mi)
        inventory-collector:
          overrides:
            requests:
              cpu: "50m"     # was 25m
            limits:
              cpu: "100m"    # was 50m

        # Compliance K8s Scanner — full override
        compliance-k8s-scanner:
          overrides:
            requests:
              cpu: "300m"
              memory: "100Mi"
            limits:
              cpu: "750m"
              memory: "200Mi"

        # Scan Result Publisher — full override
        scan-result-publisher:
          overrides:
            requests:
              cpu: "50m"
              memory: "100Mi"
            limits:
              cpu: "100m"
              memory: "750Mi"

        # Node VM Discovery — full override
        node-vm-discovery:
          overrides:
            requests:
              cpu: "30m"
              memory: "100Mi"
            limits:
              cpu: "100m"
              memory: "200Mi"

  # ===========================================================================
  # Realtime Protection — DaemonSet agent — full override (incl. ephemeral storage)
  # ===========================================================================
  realtimeProtectionValues:
    enabled: true
    distribution:
      id: distID
      url: https://distributions-dev.traps.paloaltonetworks.com
    platform:
      bottlerocket: false
      gcos: false
    resources:
      agent:
        overrides:
          requests:
            cpu: "300m"
            memory: "800Mi"
            ephemeral-storage: "6Gi"
          limits:
            memory: "3Gi"
            ephemeral-storage: "12Gi"

Deploy the Kubernetes Connector using Helm:

helm upgrade --install konnector oci://us-central1-docker.pkg.dev/qa2-test-YYY/agent-docker/helm/konnector-launcher \ 
--wait-for-jobs \
--create-namespace \
--namespace panw \
--values K8s-security-profile-panw-DATE.values.yaml \
--set-file konnector-upgrader.rawValuesContent=K8s-security-profile-panw-DATE.values.yaml