Wiz Launches Native Runtime Protection Add-on for Google Kubernetes Engine
Google Cloud and Wiz introduce a preview integration that automates sensor deployment and credential management for GKE clusters.
Key points
- The Wiz Runtime Sensor add-on is now available in Preview for GKE Standard and Autopilot clusters.
- Deployment requires only a single flag or console click, eliminating manual Helm chart orchestration.
- Credentials are managed via GKE native integrations, removing the need for manual token distribution.
Google Cloud and Wiz announced a new integration today that brings native runtime protection to Google Kubernetes Engine clusters. The Wiz Runtime Sensor add-on is currently available in Preview for both GKE Standard and GKE Autopilot environments. This release aims to simplify the deployment of kernel-level threat detection by handling installation and updates through the GKE control plane.
According to the joint announcement, the integration automates the lifecycle management of the security sensor. Users can enable the feature on existing clusters or during cluster creation using a single command-line flag or through the Google Cloud Console. This approach removes the administrative burden of manually orchestrating third-party manifests across large fleets of Kubernetes nodes.
Simplifying Runtime Security Operations
Historically, security teams faced significant friction when deploying runtime agents across distributed clusters. Manual orchestration of Helm charts created ongoing administrative overhead for platform engineering staff. Additionally, distributing and rotating registry tokens and API keys across individual namespaces introduced credential sprawl and increased security risk.
The new add-on addresses these operational hurdles by leveraging GKE’s native infrastructure. It utilizes Secret Manager integration and Workload Identity Federation to vault API keys and pull tokens off-cluster. According to Wiz, secret rotations in Secret Manager automatically resynchronize with the sensor without requiring cluster restarts or pod redeployments. This eliminates the need for manual credential management during routine maintenance cycles.
Governance and Performance Considerations
Platform security leads can enforce runtime protection policies across entire organizations using Google Cloud Organization Policies. Unprotected cluster creation attempts are automatically blocked by these policies before workloads go live. This ensures that newly provisioned clusters receive runtime coverage immediately, addressing governance blind spots that often occur when teams spin up resources without security oversight.
The sensor operates in kernel space using eBPF to monitor system calls, active processes, and network sockets. It enforces fixed per-node resource limits to safeguard workload performance during heavy traffic spikes. Detection rules and threat definitions update independently of GKE cluster patch versions or node pool recreations. The sensor monitors for high-risk behaviors such as reverse shells, binary executions from temporary directories, image drift, and privilege escalation attempts.
What should you do?
Security professionals using Google Kubernetes Engine should evaluate the preview integration for their production environments. Teams should review their current credential management strategies to identify opportunities for automation. Organizations should verify that their Organization Policies align with the new capability to enforce mandatory runtime protection. Users should monitor the sensor’s resource consumption to ensure it meets their performance requirements.
What to do and how to stay safe: Wiz
- Evaluate the preview integration on non-production GKE clusters to assess performance impact and detection accuracy.
- Review current credential distribution methods for Kubernetes workloads to identify opportunities for automation.
- Configure Organization Policies to mandate the use of runtime protection sensors on all new cluster deployments.
- Monitor eBPF sensor resource limits to ensure they align with your organization’s workload performance requirements.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is the Wiz Runtime Sensor add-on available for all GKE cluster types?
The add-on is available in Preview for both GKE Standard and GKE Autopilot clusters, according to the announcement.
How does the integration handle credential management?
It leverages GKE’s native Secret Manager integration and Workload Identity Federation to vault API keys and pull tokens off-cluster.
What types of threats does the sensor detect?
The sensor monitors for high-risk behaviors including reverse shells, binary executions from /tmp, image drift, and privilege escalation attempts.
