UNCLASSIFIED - NO CUI

Defenders deployed, not showing up in console

When deploying Prisma Cloud as part of Big Bang, the defender daemonset is deployed successfully in my k3s cluster but I don't see the defenders show up in the twistlock console. Here is how I have the defenders configured

twistlock:
  enabled: true
  values:
  ...
    defender:
      enabled: true
      dockerSocket: /run/k3s/containerd/containerd.sock
      cri: true
      privileged: false
      selinux: true
    init:
      enabled: true
    monitoring:
      enabled: true

The pods are running fine

image

Running logs on them returns basically nothing

WARN 2025-04-14T16:48:34.156 dump.go:34  Falling back to default log level WARNING

WARN 2025-04-14T16:48:34.156 dump.go:34  Falling back to default log level WARNING

However, if I grab the defender.log file from /var/lib/twistlock/log/ inside the defender pod, I see a bunch of permission denied errors... Here's an excerpt, I'll also attach the entire file

ERRO 2025-02-16T22:05:09.044 controller_filesystem.go:833 Failed to read thread syscall of process opening /usr/bin/bash: open /proc/1948620/task/1948620/syscall: permission denied
ERRO 2025-02-16T22:05:09.044 controller_filesystem.go:833 Failed to read thread syscall of process opening /usr/bin/bash: open /proc/1948620/task/1948620/syscall: permission denied
ERRO 2025-02-16T22:05:21.527 controller_filesystem.go:833 Failed to read thread syscall of process opening /usr/bin/dash: open /proc/1948922/task/1948922/syscall: permission denied
ERRO 2025-02-16T22:05:21.527 controller_filesystem.go:833 Failed to read thread syscall of process opening /usr/bin/dash: open /proc/1948922/task/1948922/syscall: permission denied
ERRO 2025-02-16T22:05:21.529 controller_filesystem.go:833 Failed to read thread syscall of process opening /usr/bin/dash: open /proc/1948923/task/1948923/syscall: permission denied
ERRO 2025-02-16T22:05:21.529 controller_filesystem.go:833 Failed to read thread syscall of process opening /usr/bin/dash: open /proc/1948923/task/1948923/syscall: permission denied
ERRO 2025-02-16T22:05:21.531 controller_filesystem.go:833 Failed to read thread syscall of process opening /usr/bin/dirname: open /proc/1948924/task/1948924/syscall: permission denied
ERRO 2025-02-16T22:05:21.531 controller_filesystem.go:833 Failed to read thread syscall of process opening /usr/bin/dirname: open /proc/1948924/task/1948924/syscall: permission denied
ERRO 2025-02-16T22:05:21.534 controller_filesystem.go:833 Failed to read thread syscall of process opening /usr/bin/locale: open /proc/1948926/task/1948926/syscall: permission denied
ERRO 2025-02-16T22:05:21.534 controller_filesystem.go:833 Failed to read thread syscall of process opening /usr/bin/grep: open /proc/1948927/task/1948927/syscall: permission denied

Seems like maybe it's a Kyverno issue, but I'm not seeing any PolicyViolation events being trigged in Kyverno after the defenders are deployed.

defender.log

Edited by Todd Skinner