topic Re: Instructions and Best Practices guide for setting up Prisma cloud for Azure Container Registry and Azure Kubernetes Service in Prisma Cloud Discussions

Instructions and Best Practices guide for setting up Prisma cloud for Azure Container Registry and Azure Kubernetes Service

clakshmikanthan — Thu, 25 Jan 2024 06:49:08 GMT

Looking for Instructions and Best Practices guide for setting up Prisma cloud for Azure Container Registry and Azure Kubernetes Service

Re: Instructions and Best Practices guide for setting up Prisma cloud for Azure Container Registry and Azure Kubernetes Service

SNimmagadda — Thu, 25 Jan 2024 16:58:00 GMT

HI @clakshmikanthan

Here is the Doc To Configure Azure Container Registry - https://docs.prismacloud.io/en/classic/compute-admin-guide/vulnerability-management/registry-scanning/scan-acr

Additional Docs to Configure Prisma Cloud on AKS Cluster https://docs.prismacloud.io/en/compute-edition/32/admin-guide/install/deploy-console/console-on-aks

https://docs.prismacloud.io/en/compute-edition/32/admin-guide/install/deploy-defender/orchestrator/orchestrator

Please let us know if you need additional help.

Re: Instructions and Best Practices guide for setting up Prisma cloud for Azure Container Registry and Azure Kubernetes Service

clakshmikanthan — Mon, 29 Jan 2024 05:59:10 GMT

@SNimmagadda wrote:

HI @clakshmikanthan

Here is the Doc To Configure Azure Container Registry - https://docs.prismacloud.io/en/classic/compute-admin-guide/vulnerability-management/registry-scanning/scan-acr

Additional Docs to Configure Prisma Cloud on AKS Cluster https://docs.prismacloud.io/en/compute-edition/32/admin-guide/install/deploy-console/console-on-aks

https://docs.prismacloud.io/en/compute-edition/32/admin-guide/install/deploy-defender/orchestrator/orchestrator

Please let us know if you need additional help.

Thank You Very much. Appreciate your support.
I have a question. I understand by integrating Prisma Cloud with Azure Container Registry, Vulnerability scanning of container images uploaded to ACR will automatically happen and the report will be generated.
What about the prisma cloud defenders in AKS. Will it also scan any image deployed in AKS automatically? Once the Daemon set is installed in AKS what additional steps we have to do ? what benefit will it give?
2. Is there a best practice guidelines on using and configuring Prisma wrt AKS and Azure container registry.

Re: Instructions and Best Practices guide for setting up Prisma cloud for Azure Container Registry and Azure Kubernetes Service

SNimmagadda — Mon, 29 Jan 2024 15:59:43 GMT

HI @clakshmikanthan Thanks for reaching out.

After deploying a Defender to a Cluster, it can immediately protect and monitor your containers and host. No additional steps are required to rebuild your containers with an agent inside.

Here is The Defender Architecture to refer https://docs.prismacloud.io/en/compute-edition/32/admin-guide/technology-overviews/defender-architecture

Please refer to the below Doc on how the Defender works after it is installed.

https://docs.prismacloud.io/en/compute-edition/32/admin-guide/install/deploy-defender/defender-types

Please let us know if this helps.

Re: Instructions and Best Practices guide for setting up Prisma cloud for Azure Container Registry and Azure Kubernetes Service

clakshmikanthan — Tue, 30 Jan 2024 05:22:40 GMT

Hi,

You have referred docs from compute edition. I understand compute edition is self-managed where you run prisma-cloud console as a docker container within your cluster. We are planning to use Prisma-cloud enterprise edition where we will be using prisma-cloud console provided by the enterprise edition and deploy defender in AKS to send details to prisma-cloud in SAAS. So my question is after I deploy defender in my AKS cluster as daemonset, it automatically communicates to SAAS prisma-cloud console right? I don't need any additional configuration either in AKS or in Prisma-cloud console right? Also our AKS is a private cluster. So how to make the daemonset communicate to prisma-cloud console. Is it via HTTP Proxy?

Re: Instructions and Best Practices guide for setting up Prisma cloud for Azure Container Registry and Azure Kubernetes Service

SNimmagadda — Tue, 30 Jan 2024 15:52:36 GMT

Hi @clakshmikanthan

If you have Created below Prerequisites for Console-defender Communication. deploying the defender in AKS Cluster will communicate to Console.

https://docs.prismacloud.io/en/classic/compute-admin-guide/welcome/nat-gateway-ip-addresses

https://docs.prismacloud.io/en/classic/cspm-admin-guide/get-started-with-prisma-cloud/enable-access-prisma-cloud-console

Prisma® Cloud uses NAT gateway IP addresses. To ensure that you can access Prisma Cloud and the API for any integrations that you enabled between Prisma Cloud and your incidence response workflows, or your agentless deployment or the Prisma Cloud Defenders to communicate with the Prisma Cloud Compute Console, review the list and update the IP addresses in your allow lists

https://docs.prismacloud.io/en/classic/cspm-admin-guide/get-started-with-prisma-cloud/enable-access-prisma-cloud-console#idcb6d3cd4-d1bf-450a-b0ec-41c23a4d4280

In Prisma Cloud Enterprise Edition (SaaS platform for Compute), the Defender websocket connects to Console on port 443 (not configurable).

If egress connections through Proxy Require authentication. Here is the doc to configure web proxy in HTTP Proxy

https://docs.prismacloud.io/en/classic/compute-admin-guide/configure/proxy

Please let me know if this helps.