--- title: Setting up Cloud Security on Kubernetes description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: >- Docs > Datadog Security > Cloud Security > Setting up Cloud Security > Deploying Cloud Security on the Agent > Setting up Cloud Security on Kubernetes --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Setting up Cloud Security on Kubernetes Use the following instructions to enable Misconfigurations and Vulnerability Management. {% alert level="info" %} Collecting events using Cloud Security affects your billing. For more information, see [Datadog Pricing](https://www.datadoghq.com/pricing/?product=cloud-security-management#products). {% /alert %} ## Prerequisites{% #prerequisites %} - Latest Datadog Agent version. For installation instructions, see [Getting Started with the Agent](https://docs.datadoghq.com/getting_started/agent.md) or install the Agent from the [Datadog UI](https://app.datadoghq.com/account/settings/agent/latest). **Note**: SBOM collection is not compatible with the image streaming feature in Google Kubernetes Engine (GKE). To disable it, see the [Disable Image streaming](https://cloud.google.com/kubernetes-engine/docs/how-to/image-streaming#disable) section of the GKE docs. ## Installation{% #installation %} {% tab title="Datadog Operator" %} 1. Add the following to the `spec` section of the `datadog-agent.yaml` file: ```yaml # datadog-agent.yaml file apiVersion: datadoghq.com/v2alpha1 kind: DatadogAgent metadata: name: datadog spec: features: # Enables Misconfigurations cspm: enabled: true hostBenchmarks: enabled: true # Enables Software Bill of Materials (SBOM) collection sbom: enabled: true # Enables Container Vulnerability Management containerImage: enabled: true # Enables scanning of application libraries in addition to OS packages (Agent 7.70+) analyzers: ["os", "languages"] # Enables Host Vulnerability Management host: enabled: true # Enables scanning of application libraries in addition to OS packages (Agent 7.70+) analyzers: ["os", "languages"] # Enables runtime package prioritization (Preview, Agent 7.79+) # See Runtime Package Prioritization section below. enrichment: usage: enabled: true ``` 1. Apply the changes and restart the Agent. {% /tab %} {% tab title="Helm" %} 1. Add the following to the `datadog` section of the `datadog-values.yaml` file: ```yaml # datadog-values.yaml file datadog: securityAgent: # Enables Misconfigurations compliance: enabled: true host_benchmarks: enabled: true # Enables Software Bill of Materials (SBOM) collection sbom: # Enables Container Vulnerability Management containerImage: enabled: true # Enables scanning of application libraries in addition to OS packages (Agent 7.70+) analyzers: ["os", "languages"] # Enables Host Vulnerability Management host: enabled: true # Enables scanning of application libraries in addition to OS packages (Agent 7.70+) analyzers: ["os", "languages"] # Enables runtime package prioritization (Preview, Agent 7.79+) # See Runtime Package Prioritization section below. enrichment: usage: enabled: true ``` 1. Restart the Agent. {% /tab %} {% tab title="DaemonSet" %} 1. Add the following environment variables to every Agent container in the `daemonset.yaml` file, including `agent`, `security-agent`, and `system-probe`. These variables enable Misconfigurations, Vulnerability Management, mount-based container image scanning, and runtime package prioritization. ```yaml - name: DD_COMPLIANCE_CONFIG_ENABLED value: "true" - name: DD_COMPLIANCE_CONFIG_HOST_BENCHMARKS_ENABLED value: "true" - name: DD_SBOM_ENABLED value: "true" - name: DD_SBOM_CONTAINER_IMAGE_ENABLED value: "true" - name: DD_SBOM_HOST_ENABLED value: "true" - name: DD_SBOM_CONTAINER_IMAGE_USE_MOUNT value: "true" - name: DD_SBOM_ENRICHMENT_USAGE_ENABLED value: "true" - name: HOST_ROOT value: /host/root ``` If your DaemonSet mounts the host root at a different path, set `HOST_ROOT` to that mount path in each Agent container. 1. Set `hostPID: true` in the pod spec and add the following `securityContext` to the `agent` container. These settings are required for mount-based container image scanning with `DD_SBOM_CONTAINER_IMAGE_USE_MOUNT=true`. ```yaml # Source: datadog/templates/daemonset.yaml apiVersion: apps/v1 kind: DaemonSet [...] spec: [...] template: [...] spec: hostPID: true containers: [...] - name: agent [...] securityContext: capabilities: add: - SYS_ADMIN readOnlyRootFilesystem: true appArmorProfile: type: Unconfined ``` 1. Restart the Agent. {% /tab %} **Note**: `enrichment.usage.enabled: true` requires Datadog Agent **7.79.0 or later**. See the Runtime Package Prioritization section for requirements. **Note**: The `languages` analyzer requires Datadog Agent **7.70 or later**. When enabled, it detects vulnerabilities in application libraries managed by the package managers below, in addition to OS packages. When the `analyzers` field is omitted, Datadog only scans OS packages for container images. ### Supported application library package managers{% #supported-application-library-package-managers %} The `languages` analyzer covers the following package ecosystems: | Ecosystem | Package manager/format | | ------------------- | ------------------------------------------------------------------------------- | | Ruby | Bundler, GemSpec | | Rust | Cargo, Rust binary | | PHP | Composer | | Java | Jar, Maven (pom.xml), Gradle lock, Sbt lock | | JavaScript | npm (package-lock.json), Yarn, pnpm, Node package | | .NET | NuGet, .NET Core, PackagesProps | | Python | Python package (egg), pip, Pipenv, Poetry, uv, Conda package, Conda environment | | Go | Go binary, Go modules | | C/C++ | Conan lock | | Swift / Objective-C | CocoaPods, Swift | | Dart | PubSpec lock | | Elixir | Mix lock | | Julia | Julia | ## Runtime Package Prioritization (Preview){% #runtime-package-prioritization-preview %} Runtime package prioritization identifies which packages in a container image are used at runtime, so you can prioritize vulnerabilities in code that runs over vulnerabilities in packages that are installed but never executed. When enabled, the Agent uses eBPF to observe file access on your workloads and adds these signals to vulnerability findings for that image: | Signal | What it tells you | | ------------------------ | ------------------------------------------------------------------------------------------- | | Package is running | The package's files were observed being accessed by a running process. | | Accessed by root process | The package was accessed by a process running as root (UID 0). | | SUID binary present | The package contains a binary with the SUID bit set, which can enable privilege escalation. | *Package is running* feeds the **Reachability** dimension of the [Runtime Prioritization Engine](https://docs.datadoghq.com/security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine.md). To query these signals directly, see [Filter findings by runtime signals](https://docs.datadoghq.com/security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine.md#filter-findings-by-runtime-signals). **Requirements**: - Datadog Agent **7.79.0 or later**. On Kubernetes, use **7.81.0 or later** for the most complete signal coverage. - Linux only (eBPF dependency). See [Workload Protection setup](https://docs.datadoghq.com/security/workload_protection/setup.md) for supported distributions and kernel versions. Runtime signals apply to packages installed by an operating system package manager (`apt`, `yum`, or `apk`) in container image vulnerability findings. {% tab title="Datadog Operator" %} Add the `enrichment` block to the `sbom` section of your `datadog-agent.yaml` file: ```yaml spec: features: sbom: enabled: true containerImage: enabled: true # Enables runtime package prioritization (Preview, Agent 7.79+) enrichment: usage: enabled: true ``` Apply the changes and restart the Agent. {% /tab %} {% tab title="Helm" %} Add the `enrichment` block to the `sbom` section of your `datadog-values.yaml` file: ```yaml datadog: sbom: containerImage: enabled: true # Enables runtime package prioritization (Preview, Agent 7.79+) enrichment: usage: enabled: true ``` Restart the Agent. {% /tab %} {% tab title="DaemonSet" %} Set `hostPID: true` in the pod spec, and add the following environment variables to every Agent container in your `daemonset.yaml` file, including `agent`, `security-agent`, and `system-probe`: ```yaml # Pod spec hostPID: true # Add to each Agent container's env section. - name: DD_SBOM_ENABLED value: "true" - name: DD_SBOM_CONTAINER_IMAGE_ENABLED value: "true" - name: DD_SBOM_ENRICHMENT_USAGE_ENABLED value: "true" ``` Restart the Agent. {% /tab %} To verify the setup, filter vulnerability findings by [runtime signals](https://docs.datadoghq.com/security/cloud_security_management/triage_and_prioritize/runtime_prioritization_engine.md#filter-findings-by-runtime-signals).