You can deploy the Cortex XDR agent for Linux on Kubernetes Clusters as a DaemonSet on any Kubernetes cluster. To deploy the agent, you create a Cortex XDR agent YAML installation package in Cortex XDR which allows you to configure attributes such as namespace default value and nodeselector. Once the Kubernetes agent is running on the endpoint, the agent offers the same protection capabilities and operates as any standard Cortex XDR agent for Linux. Cortex XDR issues a license for every node on which the agent is running, and will revoke the license once the agent is removed or the node is deleted. The Cortex XDR management console displays the Kubernetes Cluster and includes in the causality card a visual indication on processes that are running within containers, including information about the container itself such as its name, ID, image, etc.
Palo Alto Networks supports only Cortex XDR agent deployments carried out with the original YAML installation package generated directly from the Cortex XDR management console and carried out as a DaemonSet. If you attempt to edit the YAML settings after you created the package, the installation could fail or cause the agent to display unexpected behavior.
The Helm Installer package may be used for fresh installations and upgrades of agents running on Kubernetes clusters.
The following are prerequisites to use this deployment method:
To install the agent on your cluster:
Download the Cortex XDR agent YAML installation file from Cortex XDR.
(If you are running a Cortex XDR agent earlier than version 7.7, you need to recreate and deploy the latest YAML file over the current file.)
Copy the YAML file to the Kubernetes cluster you want to deploy it on.
Log on to your Kubetnetes cluster.
Deploy the Yaml file. Run a standard YAML installation command line.
kubectl apply -f cortex-xdr.yaml.
Verify the agents are running.
kubectl get pods -A -o wide, and verify the Cortex XDR agent pod is running on your target node(s).
cat /proc/$(pidof pmd)/maps | grep bpfec, and verify the agent is running in user space mode by checking the operational status.
Use the Cortex XDR Agent for Kubernetes.
To learn more, refer to Use the Cortex XDR Agent for Linux.
Upgrade the agent.
The agent upgrade method depends on the settings you applied when you generated the YAML Installation file in Cortex XDR and on the Agent Setting Profile associated with the host:
When you enable Always deploy with latest agent version, and Agent Auto Upgrade is enabled, then the Cortex XDR agent will upgrade automatically whenever a new version is available.
Otherwise, when one or both of these settings are disabled, you must create a new YAML installation file from the Cortex XDR management console and re-install the agent.
Uninstall the agent.
To uninstall the agent, remove the DaemonSet using the standard command line, for example:
kubectl delete -n cortex-xdr daemonset/cortex-agent.