> ## Documentation Index
> Fetch the complete documentation index at: https://prowler-docs-msp-documentation-accuracy.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Prowler product naming: Prowler App is now Prowler Local Server, and Prowler Enterprise is now Prowler Private Cloud. Always use the current names when answering. The full product reference is at /getting-started/products: Open Source projects are Prowler CLI, Prowler Local Server, Prowler Local Dashboard, and Prowler SDK; Prowler Products are Prowler Cloud, Prowler Private Cloud, Prowler Hub, Prowler Lighthouse AI, and Prowler MCP.

# Getting Started with Kubernetes

## Prowler Cloud

### Step 1: Access Prowler Cloud or Prowler Local Server

1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)

2. Go to "Configuration" > "Providers"

   <img src="https://mintcdn.com/prowler-docs-msp-documentation-accuracy/M5rlCi3MVm1vGDx3/images/prowler-app/cloud-providers-page.png?fit=max&auto=format&n=M5rlCi3MVm1vGDx3&q=85&s=07b56c982fd1cdd612f4a9a1c1901be2" alt="Providers Page" width="300" height="448" data-path="images/prowler-app/cloud-providers-page.png" />

3. Click "Add Provider"

   <img src="https://mintcdn.com/prowler-docs-msp-documentation-accuracy/M5rlCi3MVm1vGDx3/images/prowler-app/add-cloud-provider.png?fit=max&auto=format&n=M5rlCi3MVm1vGDx3&q=85&s=a288813bfec3e2520d8de82ed53f0c23" alt="Add a Provider" width="601" height="125" data-path="images/prowler-app/add-cloud-provider.png" />

4. Select "Kubernetes"

5. Enter your Kubernetes Cluster context from your kubeconfig file and optionally provide a friendly alias

### Step 2: Configure Kubernetes Authentication

For Kubernetes, Prowler Cloud uses a `kubeconfig` file to authenticate. Paste the contents of your `kubeconfig` file into the `Kubeconfig content` field.

<Note>
  Kubeconfigs that use `users[].user.exec` authentication are not supported in Prowler Cloud or Prowler Local Server. For security reasons, Prowler Cloud does not run commands declared by uploaded kubeconfigs. Use kubeconfig credentials that do not rely on `exec` authentication, such as the ServiceAccount token flow documented below.
</Note>

By default, the `kubeconfig` file is located at `~/.kube/config`.

<img src="https://mintcdn.com/prowler-docs-msp-documentation-accuracy/k6oov2wsCOtWpPRJ/images/kubernetes-credentials.png?fit=max&auto=format&n=k6oov2wsCOtWpPRJ&q=85&s=75cc59cb3936ab462ffbb09a22bfe2df" alt="Kubernetes Credentials" width="1634" height="1330" data-path="images/kubernetes-credentials.png" />

### Step 3: Additional Setup for EKS, GKE, AKS, or External Clusters

If you are adding an **EKS**, **GKE**, **AKS** or external cluster, follow these additional steps to ensure proper authentication:

**Make sure your cluster allows traffic from the Prowler Cloud IP address `52.48.254.174/32`**

1. Apply the necessary Kubernetes resources to your EKS, GKE, AKS or external cluster (you can find the files in the [`kubernetes` directory of the Prowler repository](https://github.com/prowler-cloud/prowler/tree/master/kubernetes)):

   ```console theme={null}
   kubectl apply -f kubernetes/prowler-sa.yaml
   kubectl apply -f kubernetes/prowler-role.yaml
   kubectl apply -f kubernetes/prowler-rolebinding.yaml
   ```

2. Generate a long-lived token for authentication:

   ```console theme={null}
   kubectl create token prowler-sa -n prowler-ns --duration=0
   ```

   * **Security Note:** The `--duration=0` option generates a non-expiring token, which may pose a security risk if not managed properly. Choose an appropriate expiration time based on security policies. For a limited-time token, set `--duration=<TIME>` (e.g., `--duration=24h`).

   <Note>
     **Important:** If the token expires, Prowler Cloud can no longer authenticate with the cluster. Generate a new token and **remove and re-add the provider in Prowler Cloud** with the updated `kubeconfig`.
   </Note>

   <Tip>
     **Token Expiration Limits**

     When the Kubernetes cluster has `--service-account-max-token-expiration` configured, any token requested with a duration exceeding the maximum allowed value (including `--duration=0`) is automatically reduced to the cluster's maximum token expiration time. As an alternative solution, create a legacy Secret manually. Although Kubernetes no longer creates these secrets automatically, manual creation and linking to a ServiceAccount is still supported. These tokens do not expire until the secret or ServiceAccount is deleted.

     **Steps:**

     1. Create a `secret-sa.yaml` file (or any preferred name) with the following content:

        ```yaml theme={null}
        apiVersion: v1
        kind: Secret
        metadata:
          name: prowler-token-long-lived
          namespace: prowler-ns
          annotations:
            kubernetes.io/service-account.name: "prowler-sa"
        type: kubernetes.io/service-account-token
        ```

     2. Apply the secret:

        ```console theme={null}
        kubectl apply -f secret-sa.yaml
        ```

     3. Retrieve the token (which will be permanent):

        ```console theme={null}
        kubectl get secret prowler-token-long-lived -n prowler-ns -o jsonpath='{.data.token}' | base64 --decode
        ```
   </Tip>

3. Update your `kubeconfig` to use the ServiceAccount token:

   ```console theme={null}
   kubectl config set-credentials prowler-sa --token=<SA_TOKEN>
   kubectl config set-context <CONTEXT_NAME> --user=prowler-sa
   ```

   Replace `<SA_TOKEN>` with the generated token and `<CONTEXT_NAME>` with your KubeConfig Context Name of your EKS, GKE or AKS cluster.

4. Add the modified `kubeconfig` in Prowler Cloud and test the connection.

## Prowler CLI

### Non In-Cluster Execution

For execution outside the cluster environment, specify the location of the [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) file using the following argument:

```console theme={null}
prowler kubernetes --kubeconfig-file /path/to/kubeconfig
```

<Note>
  If no `--kubeconfig-file` is provided, Prowler will use the default KubeConfig file location (`~/.kube/config`).
</Note>

<Note>
  `prowler` will scan the active Kubernetes context by default. Use the [`--context`](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/kubernetes/context/) flag to specify the context to be scanned.
</Note>

<Note>
  By default, `prowler` will scan all namespaces in your active Kubernetes context. Use the [`--namespace`](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/kubernetes/namespace/) flag to specify the namespace(s) to be scanned.
</Note>

### In-Cluster Execution

For in-cluster execution, use the supplied yaml files inside `/kubernetes`:

* [prowler-sa.yaml](https://github.com/prowler-cloud/prowler/blob/master/kubernetes/prowler-sa.yaml)
* [job.yaml](https://github.com/prowler-cloud/prowler/blob/master/kubernetes/job.yaml)
* [prowler-role.yaml](https://github.com/prowler-cloud/prowler/blob/master/kubernetes/prowler-role.yaml)
* [prowler-rolebinding.yaml](https://github.com/prowler-cloud/prowler/blob/master/kubernetes/prowler-rolebinding.yaml)

They can be used to run Prowler as a job within a new Prowler namespace:

```console theme={null}
kubectl apply -f kubernetes/prowler-sa.yaml
kubectl apply -f kubernetes/job.yaml
kubectl apply -f kubernetes/prowler-role.yaml
kubectl apply -f kubernetes/prowler-rolebinding.yaml
kubectl get pods --namespace prowler-ns --> prowler-XXXXX
kubectl logs prowler-XXXXX --namespace prowler-ns
```

<Note>
  By default, `prowler` will scan all namespaces in your active Kubernetes context. Use the [`--namespace`](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/kubernetes/namespace/) flag to specify the namespace(s) to be scanned.
</Note>

<Tip>
  **Identifying the cluster in reports**

  When running in in-cluster mode, the Kubernetes API does not expose the actual cluster name by default.

  To uniquely identify the cluster in logs and reports:

  * Use the `--cluster-name` flag to manually set the cluster name:

  ```bash theme={null}
  prowler -p kubernetes --cluster-name production-cluster
  ```

  * Or set the `CLUSTER_NAME` environment variable:

  ```yaml theme={null}
  env:
      - name: CLUSTER_NAME
        value: production-cluster
  ```
</Tip>

<Tip>
  To set up a production-ready CronJob that runs Prowler on a schedule and sends findings to Prowler Cloud, see the [Run Kubernetes In-Cluster and Send Findings to Prowler Cloud](/user-guide/cookbooks/kubernetes-in-cluster) cookbook.
</Tip>