GitOps lifecycle management - Administrator Guide

GitOps lifecycle management - Administrator Guide - Cortex CLOUD

KSPM-Documentation

Product

Cortex Cloud Application Security > Cortex CLOUD

Creation date

2025-05-11

Last date published

2026-06-11

Update tenant values and configurations

Update values: Overwrite the tenant-values.yaml file with the newly downloaded file from Cortex, commit, and push.
Update chart version: Delete the old konnector-bundle directory, run helm pull to download the new <NEW_VERSION>, commit, and push.
Add inline overrides: Add specific configurations to your helmrelease-patch.yaml (Flux) or application.yaml (ArgoCD) . Inline values have the highest priority and will override both the chart defaults and tenant-values.yaml.

Namespace configuration

The target namespace is controlled by the global.namespace parameter in tenant-values.yaml (default: panw). If changing the namespace, you must update it in three places:

global.namespace in tenant-values.yaml.
The ConfigMap namespace in overlays/.../kustomization.yaml.
The target namespace in helmrelease-patch.yaml (Flux) or spec.destination.namespace in application.yaml (ArgoCD).

Day-to-day operations

Suspend/disable auto-sync:
- Flux: Run flux suspend helmrelease kspm-agent -n panw or set suspend:true in your HelmRelease spec via Git.
- ArgoCD: Run argocd app set kspm-agent --sync-policy none or remove the automated: block from your Application spec via Git.
Manual reconciliation/sync:
- Flux: flux reconcile kustomization kspm-agent<TENANT_ID>.
- ArgoCD: argocd app sync kspm-agent
Uninstall a release:
- Flux: Delete the Flux Kustomization (flux delete kustomization kspm-agent-<TENANT_ID>) to cascade and remove all managed resources.
- ArgoCD: Delete the ArgoCD Application with the cascade flag (argocd app delete kspm-agent --cascade).

Note

For Proof of Concept testing, the repository includes a deploy-gitlab.sh script to deploy a self-hosted GitLab EE server directly on your cluster.