Enable Defender for Containers on GCP (GKE) via portal

This article shows you how to enable Microsoft Defender for Containers on your Google Kubernetes Engine (GKE) clusters through the Azure portal. You can choose to enable all security features at once for comprehensive protection, or selectively deploy specific components based on your requirements.

When to use this guide

Use this guide if you want to:

Set up Defender for Containers on GCP for the first time
Enable all security features for comprehensive protection
Selectively deploy specific components
Fix or add missing components to an existing deployment
Deploy using a controlled, selective approach
Exclude certain clusters from protection

Prerequisites

A connected GCP project. For more information, see Connect your GCP project to Microsoft Defender for Cloud

Network requirements

Validate that the following endpoints for public cloud deployments are configured for outbound access. Configuring them for outbound access helps ensure that the Defender sensor can connect to Microsoft Defender for Cloud to send security data and events.

Note

The Azure domains *.ods.opinsights.azure.com and *.oms.opinsights.azure.com no longer required for outbound access. For more information, see the deprecation announcement.

Azure domain	Azure Government domain	Azure operated by 21Vianet domain	Port
*.cloud.defender.microsoft.com	N/A	N/A	443

You also need to validate the Azure Arc-enabled Kubernetes network requirements.

GCP-specific requirements:

GCP project with appropriate permissions
GKE clusters (version 1.19+)
Container images in Google Container Registry or Artifact Registry
Service account with required IAM roles
Cloud Shell or gcloud CLI configured

Deploy all components

Follow these steps to enable comprehensive protection for all your GKE clusters.

Connect GKE clusters to Azure Arc

After creating the connector:

Go to Microsoft Defender for Cloud > Recommendations.
Look for the recommendation "GKE clusters should be connected to Azure Arc".
Select the recommendation to see affected clusters.

Follow the remediation steps to connect each cluster:

# Connect GKE cluster to Arc
az connectedk8s connect \
    --name <cluster-name> \
    --resource-group <resource-group> \
    --location <location>

Deploy the Defender sensor

Important

Deploying the Defender sensor using Helm: Unlike other options that are autoprovisioned and updated automatically, Helm lets you flexibly deploy the Defender sensor. This approach is especially useful in DevOps and infrastructure-as-code scenarios. With Helm, you can integrate deployment into CI/CD pipelines and control all sensor updates. You can also choose to receive preview and GA versions. For instructions on installing the Defender sensor using Helm, see Install Defender for Containers sensor using Helm.

After connecting your GKE clusters to Azure Arc:

Go to Microsoft Defender for Cloud > Recommendations.
Search for "Arc-enabled Kubernetes clusters should have Defender extension installed".
Select only the clusters where you want the sensor.
Select Fix to deploy the sensor.

Configure container registry scanning

For Google Container Registry (GCR) and Artifact Registry:

Go to your GCP connector settings.
Select Configure next to the Containers plan.
Verify Agentless container vulnerability assessment is enabled.
Images are automatically scanned when you push them to the registry.

Enable audit logging

Enable GKE audit logging for runtime protection:

# Enable audit logs for existing cluster
gcloud container clusters update <cluster-name> \
    --zone <zone> \
    --enable-cloud-logging \
    --logging=SYSTEM,WORKLOAD,API_SERVER

Enable vulnerability scanning only

To enable only registry scanning without runtime protection:

In connector configuration, enable only Agentless container vulnerability assessment.
Disable other components.
Save the configuration.

Configure by cluster type

Standard GKE clusters

No special configuration is required. Follow the default deployment steps.

GKE Autopilot

For Autopilot clusters:

The Defender sensor automatically adjusts resource requests.
No manual configuration is needed for resource limits.

Private GKE clusters

For private clusters:

Ensure the cluster can reach Azure endpoints.

Configure firewall rules if needed:

gcloud compute firewall-rules create allow-azure-defender \
    --allow tcp:443 \
    --source-ranges <cluster-cidr> \
    --target-tags <node-tags>

Configure exclusions

To exclude specific GKE clusters from automatic provisioning:

Go to your GKE cluster in GCP Console.
Add labels to the cluster:
- For Defender sensor: ms_defender_container_exclude_agents = true
- For agentless deployment: ms_defender_container_exclude_agentless = true