Create a Free Azure Kubernetes Service and Assess Security By Tenable Cloud Security

You might got an error as show above. Here is the output if this command works well:

Hang tight while we grab the latest from your chart repositories... ...Successfully got an update from the "tenable" chart repository Update Complete. ⎈Happy Helming!⎈ Release "tenable-cloud-security-kubernetes-cluster" has been upgraded. Happy Helming! NAME: tenable-cloud-security-kubernetes-cluster LAST DEPLOYED: Wed Oct 29 02:34:53 2025 NAMESPACE: tenable-cloud-security-kubernetes-cluster STATUS: deployed REVISION: 3 TEST SUITE: None PS /home/netsec> 

It might because I deployed a sample app into Kubernetes. Not sure why it works later. 

Agentless Scan

For each of these components, Tenable detects:

• General information (for example, OS type/version)
• What software is installed
• Is the software/OS kernel vulnerable to attack
• If so, which vulnerabilities apply
• Is the OS out-of-date or EOL (and therefore needs to be upgraded)

https://docs.ermetic.com/docs/agentless-workload-scanning

connect an Azure AKS Cluster in Tenable Cloud Security to get full visibility and risk assessment for all cloud identities and resources associated with the cluster, including information about permissions, subscription usage, and security configurations.

Until you complete the integration, objects and configurations associated with the cluster will not be analyzed or available for investigation in Tenable. A sync status is displayed for each Kubernetes cluster in the relevant inventory view, indicating whether Tenable can connect to the Kubernetes API, and helping you troubleshoot potential connection issues.

Step 1: Grant Tenable permissions in one of the following ways, depending on which authentication/authorization method you use to configure your clusters:

• AAD with Azure RBAC:
  • Assign built-in role bindings to the Tenable Cloud Security App
  • Add a custom Tenable role to your cluster/subscription
• AAD with Kubernetes RBAC:
  • Create a ClusterRole and ClusterRoleBinding for Tenable

• Local account authentication. This method is only supported using the Connect Cluster via Helm Chart.

Note: Make sure enable AAD with Azure RBAC for your Kubernetes service. 

Step 2: If you use Azure RBAC  (AAD with Azure RBAC) for your Kubernetes cluster authorization, you will need to do the following to grant Tenable permissions to the cluster:

• Assign built-in Kubernetes-related role bindings to Tenable.

  These roles are assigned when you Connect an Azure Subscription to Tenable, but, depending on if/when you connected your subscription/s, may not have been assigned yet.

• Add a custom Tenable role.

  The role bindings mentioned in the preceding bullet are limited in scope, and do not provide IAM visibility within Tenable Cloud Security. To gain full functionality, you will also need to add a custom role, to grant Tenable additional, read-only access permissions to see most objects in your namespace.

Step3 :   Assign Built-in Role Bindings to Tenable

• If you already connected the Azure subscription where the cluster resides to Tenable, and just need to add Kubernetes-related permissions to a cluster, follow the procedure below.
• If you did not yet connect the Azure subscription where the cluster resides, follow the procedure documented in Connect an Azure Subscription.

To assign role bindings:

1. In the Azure portal, navigate to the Subscriptions page, and then click on the relevant subscription.

2. Click Access control (IAM), and then click Add role assignment.

3. On the Add role assignment page, search for and select one of the following roles, and then click Next:

   You can only add one role at a time, so you will need to perform these steps twice, once for each role.

   • Azure Kubernetes Service Cluster User Role
   • Azure Kubernetes Service RBAC Reader

4. Under Assign access to, leave the default selection as User, group, or service principal.

5. Under Members, click +Select members.

6. Search for and select Tenable Cloud Security Connector App, and then click Select.

7. Click Next, review the new role, and then click Review + assign.

8. Repeat steps 1 through 7 to add the other role, depending on which role you already chose in step 3.

Step4 :   Add a Custom Tenable Role

If you use Azure RBAC for your Kubernetes cluster authorization, and want to gain IAM visibility within Tenable not provided by the role bindings that you added to the Tenable App, add the following custom role JSON to your subscription. Refer to Azure documentation for more information about custom roles.

To add the Tenable role:

1. In the Azure portal, navigate to the Subscriptions page, and then click on the relevant subscription.
2. Click Access control (IAM), and then click Add > Add custom role.
3. Navigate to the JSON tab and click Edit.
4. Paste the following role to replace the contents of the JSON:

{ "properties": { "roleName": "Ermetic Azure Kubernetes Service Reader", "description": "Allows read-only access to see most objects in a namespace.", "assignableScopes": [ "/subscriptions/{subscription Id}" ], "permissions": [ { "actions": [ "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action" ], "notActions": [], "dataActions": [ "Microsoft.ContainerService/managedClusters/*/read" ], "notDataActions": [] } ] } } 

5. Click Save and then click Review + create.
6. Review the new custom role, and then click Create.
7. Return to the Access control (IAM) page and then click Add > Add role assignment.
8. Search for and select Ermetic Azure Kubernetes Service Reader, and then click Next.
9. Under Assign access to, leave the default selection as User, group, or service principal.
10. Under Members, click +Select members.
11. Search for and select Ermetic App, and then click Select.
12. Click Next, review the new role assignment, and then click Review + assign.

Step5 : Allow Network Access to Tenable (Optional)

By default, it is open to Internet without limitation. 

For Tenable to access the cluster, the cluster endpoint needs to be publicly accessible, and the relevant Tenable IP addresses need to be allowed.

To allow network access:

1. In the Azure Portal, navigate to Kubernetes services.

2. Click on the relevant Cluster name.

3. Under Settings, click on Networking.

4. Under Security, click the checkbox to Set authorized IP ranges.

   Although Tenable can access the cluster when this setting is disabled, it does not follow security best practice to do so. Instead, this setting should be enabled, and the authorized network should be restricted to specific IP addresses, including those associated with Tenable.

5. In the Specify IP ranges field that appears, add all Tenable IP addresses associated with your Tenable region.

6. Click Apply.

(Notes) Tenable Cloud Core Service IP addresses for United States

Deploy a quickstart application

Create a basic web application

Deploy the Azure Store sample application to your cluster to get started with Azure Kubernetes Service. You will get a chance to review the YAML file to see all of the application details before deploying it and you will be able to see the component resources once that deployment complete

Deployed:

Namespaces

Access the service:

You also can check each VM instance and VM Scale set's finding. 

Containers - Container Registries