KSPM limitations and system components - Administrator Guide

Refer to KSPM components and limitations for essential details on system architecture, resource requirements, and operational constraints when setting up your environment.

Note

The CPU and memory limits can be adjusted to align with your resource needs. For configuration steps, refer to Configure Kubernetes Connector resource limits.

KSPM system components

Core components (continuously running):

Component name	Description	Type	Priority Class**	Replicas	CPU (Req/Limit)	Memory (Req/Limit)
cortex-manager	This is the system's central engine that continuously monitors and aligns the cluster. It ensures the actual state of your deployment always matches your requested settings by automatically correcting any discrepancies.	Deployment	cortex-critical	1	50m / 100m	100Mi / 200Mi
cortex-admission	The cortex-admission acts as the system validator. It reviews every request to ensure it meets safety and configuration standards before allowing it to proceed.	Deployment	cortex-critical	3	50m / 100m	150Mi / 200Mi
cortex-monitoring	The cortex-monitoring component provides visibility into the health and performance of the system. It tracks metrics, logs, and health checks, acting as an early warning system that alerts operators of bottlenecks or failures.	Deployment	cortex-high	1	30m / 100m	100Mi / 200Mi

Scheduled components:

Component name	Description	Type	Priority Class	Schedule/Trigger	CPU (Req/Limit)	Memory (Req/Limit)
cortex-syncer	The cortex-syncer ensures that information stays consistent across different environments (like the cloud and your local cluster) by constantly updating and matching records.	CronJob	cortex-high	Every hour	50m / 150m	50Mi / 200 Mi
cortex-job-orchestrator	It handles the scheduling and sequencing of background jobs, ensuring they run in the right order and at the right time without overlapping.	CronJob	cortex-high	Daily (configurable)	25m / 50m	75Mi / 100Mi
cortex-node-vm-discovery	It automatically scans the environment to identify and catalog all Virtual Machines (VMs) and nodes that need to be managed or protected.	Job*	cortex-high	Ephemeral	15m / 50m	50Mi / 100Mi
cortex-inventory-collector	It gathers a detailed inventory or list of all hardware and software components currently running in the cluster so you always know what you have.	Job*	cortex-high	Ephemeral	25m / 50m	50Mi / 100Mi
cortex-compliance-node-scanner	It checks individual nodes against industry security standards to ensure the underlying servers are configured safely and legally.	Job*	cortex-high	Ephemeral	25m / 100m	50Mi / 100Mi
cortex-compliance-k8s-scanner * This component is obsolete in version 2.1 and later.	Specifically examines your Kubernetes settings (such as namespaces and RBAC) to ensure your cluster configuration meets strict security policies.	Job*	cortex-high	Ephemeral	200m / 500m	50Mi / 100Mi
cortex-host-scanner	It performs deep scans of the host operating system to find vulnerabilities, misconfigurations, or hidden security threats.	Job*	cortex-high	Ephemeral	300m / 1000m	50Mi / 13Gi
cortex-scan-result-publisher	It collects the raw data from all the other scanners, cleans it up, and sends it to your dashboard so you can actually read the results.	Job*	cortex-high	Ephemeral	30m / 50m	50Mi / 500Mi

*Spawned as ephemeral processes by the job-orchestrator.

Optional components:

Component name	Description	Type	Priority Class	Scaling behavior	CPU (Req/Limit)	Memory (Req/Limit)
cortex-realtime	The cortex-realtime is the system's high-speed streaming engine. It provides instantaneous data processing and analysis, allowing the cluster to react to security events or configuration changes the moment they occur. Refer to the Realtime Protection section in Onboard the Kubernetes Connector	DaemonSet	cortex-critical	1 pod per node	200m / 1500m	600Mi / 2Gi

Component name

Description

Type

Priority Class

Scaling behavior

CPU (Req/Limit)

Memory (Req/Limit)

cortex-realtime

The cortex-realtime is the system's high-speed streaming engine. It provides instantaneous data processing and analysis, allowing the cluster to react to security events or configuration changes the moment they occur.

Refer to the Realtime Protection section in Onboard the Kubernetes Connector

DaemonSet

cortex-critical

1 pod per node

200m / 1500m

600Mi / 2Gi

** A PriorityClass is a non-namespaced Kubernetes resource that defines an importance level for pods. This influences their scheduling order and determines if they can evict (preempt) lower-priority pods during resource scarcity to ensure security continuity.

The following PriorityClasses are defined for the Kubernetes Connector:

cortex-critical (Value: 1,000,010,000): Highest priority for mission-critical security components, including cortex-manager, cortex-admission-controller, and cortex-realtime.
cortex-high (Value: 100,000,000): High priority for all other KSPM workloads, ensuring they are prioritized over standard, non-essential application traffic.