---
title: 'Getting Started with Kubernetes'
---

## Prowler Cloud

### Step 1: Access Prowler Cloud or Prowler Local Server

1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
2. Go to "Configuration" > "Providers"

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)

3. Click "Add Provider"

    ![Add a Provider](/images/prowler-app/add-cloud-provider.png)

4. Select "Kubernetes"

5. Enter your Kubernetes Cluster context from your kubeconfig file and optionally provide a friendly alias

### Step 2: Configure Kubernetes Authentication

For Kubernetes, Prowler Cloud uses a `kubeconfig` file to authenticate. Paste the contents of your `kubeconfig` file into the `Kubeconfig content` field.

<Note>
Kubeconfigs that use `users[].user.exec` authentication are not supported in Prowler Cloud or Prowler Local Server. For security reasons, Prowler Cloud does not run commands declared by uploaded kubeconfigs. Use kubeconfig credentials that do not rely on `exec` authentication, such as the ServiceAccount token flow documented below.
</Note>

By default, the `kubeconfig` file is located at `~/.kube/config`.

![Kubernetes Credentials](/images/kubernetes-credentials.png)

### Step 3: Additional Setup for EKS, GKE, AKS, or External Clusters

If you are adding an **EKS**, **GKE**, **AKS** or external cluster, follow these additional steps to ensure proper authentication:

**Make sure your cluster allows traffic from the Prowler Cloud IP address `52.48.254.174/32`**

1. Apply the necessary Kubernetes resources to your EKS, GKE, AKS or external cluster (you can find the files in the [`kubernetes` directory of the Prowler repository](https://github.com/prowler-cloud/prowler/tree/master/kubernetes)):

    ```console
    kubectl apply -f kubernetes/prowler-sa.yaml
    kubectl apply -f kubernetes/prowler-role.yaml
    kubectl apply -f kubernetes/prowler-rolebinding.yaml
    ```

2. Generate a long-lived token for authentication:

    ```console
    kubectl create token prowler-sa -n prowler-ns --duration=0
    ```

    - **Security Note:** The `--duration=0` option generates a non-expiring token, which may pose a security risk if not managed properly. Choose an appropriate expiration time based on security policies. For a limited-time token, set `--duration=<TIME>` (e.g., `--duration=24h`).
    <Note>
    **Important:** If the token expires, Prowler Cloud can no longer authenticate with the cluster. Generate a new token and **remove and re-add the provider in Prowler Cloud** with the updated `kubeconfig`.
    </Note>
    <Tip>
    **Token Expiration Limits**


    When the Kubernetes cluster has `--service-account-max-token-expiration` configured, any token requested with a duration exceeding the maximum allowed value (including `--duration=0`) is automatically reduced to the cluster's maximum token expiration time. As an alternative solution, create a legacy Secret manually. Although Kubernetes no longer creates these secrets automatically, manual creation and linking to a ServiceAccount is still supported. These tokens do not expire until the secret or ServiceAccount is deleted.

      **Steps:**

      1. Create a `secret-sa.yaml` file (or any preferred name) with the following content:

         ```yaml
         apiVersion: v1
         kind: Secret
         metadata:
           name: prowler-token-long-lived
           namespace: prowler-ns
           annotations:
             kubernetes.io/service-account.name: "prowler-sa"
         type: kubernetes.io/service-account-token
         ```

      2. Apply the secret:

         ```console
         kubectl apply -f secret-sa.yaml
         ```

      3. Retrieve the token (which will be permanent):

         ```console
         kubectl get secret prowler-token-long-lived -n prowler-ns -o jsonpath='{.data.token}' | base64 --decode
         ```
     </Tip>

3. Update your `kubeconfig` to use the ServiceAccount token:

    ```console
    kubectl config set-credentials prowler-sa --token=<SA_TOKEN>
    kubectl config set-context <CONTEXT_NAME> --user=prowler-sa
    ```

    Replace `<SA_TOKEN>` with the generated token and `<CONTEXT_NAME>` with your KubeConfig Context Name of your EKS, GKE or AKS cluster.

4. Add the modified `kubeconfig` in Prowler Cloud and test the connection.

## Prowler CLI

### Non In-Cluster Execution

For execution outside the cluster environment, specify the location of the [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) file using the following argument:

```console
prowler kubernetes --kubeconfig-file /path/to/kubeconfig
```

<Note>
If no `--kubeconfig-file` is provided, Prowler will use the default KubeConfig file location (`~/.kube/config`).

</Note>

<Note>
`prowler` will scan the active Kubernetes context by default. Use the [`--context`](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/kubernetes/context/) flag to specify the context to be scanned.

</Note>

<Note>
By default, `prowler` will scan all namespaces in your active Kubernetes context. Use the [`--namespace`](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/kubernetes/namespace/) flag to specify the namespace(s) to be scanned.

</Note>

### In-Cluster Execution

For in-cluster execution, use the supplied yaml files inside `/kubernetes`:

* [prowler-sa.yaml](https://github.com/prowler-cloud/prowler/blob/master/kubernetes/prowler-sa.yaml)
* [job.yaml](https://github.com/prowler-cloud/prowler/blob/master/kubernetes/job.yaml)
* [prowler-role.yaml](https://github.com/prowler-cloud/prowler/blob/master/kubernetes/prowler-role.yaml)
* [prowler-rolebinding.yaml](https://github.com/prowler-cloud/prowler/blob/master/kubernetes/prowler-rolebinding.yaml)

They can be used to run Prowler as a job within a new Prowler namespace:

```console
kubectl apply -f kubernetes/prowler-sa.yaml
kubectl apply -f kubernetes/job.yaml
kubectl apply -f kubernetes/prowler-role.yaml
kubectl apply -f kubernetes/prowler-rolebinding.yaml
kubectl get pods --namespace prowler-ns --> prowler-XXXXX
kubectl logs prowler-XXXXX --namespace prowler-ns
```

<Note>
By default, `prowler` will scan all namespaces in your active Kubernetes context. Use the [`--namespace`](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/kubernetes/namespace/) flag to specify the namespace(s) to be scanned.

</Note>
<Tip>
**Identifying the cluster in reports**

When running in in-cluster mode, the Kubernetes API does not expose the actual cluster name by default.

To uniquely identify the cluster in logs and reports:

- Use the `--cluster-name` flag to manually set the cluster name:
```bash
prowler -p kubernetes --cluster-name production-cluster
```
- Or set the `CLUSTER_NAME` environment variable:
```yaml
env:
    - name: CLUSTER_NAME
      value: production-cluster
```

</Tip>

<Tip>
To set up a production-ready CronJob that runs Prowler on a schedule and sends findings to Prowler Cloud, see the [Run Kubernetes In-Cluster and Send Findings to Prowler Cloud](/user-guide/cookbooks/kubernetes-in-cluster) cookbook.
</Tip>