What happened
Google Cloud has announced the Wiz Runtime Sensor add-on for GKE, currently in preview. It covers both Standard and Autopilot clusters. GKE takes over deploying the eBPF-based sensor, injecting credentials from Secret Manager and updating the sensor, and an organisation policy constraint can block creation of clusters that lack it.
Why it matters
Vulnerability scanning looks at images and configuration at rest. It will not tell you that someone is running a reverse shell in a container right now. Runtime detection fills that gap, but small teams often skip it because of the upkeep: installing an agent on every cluster, passing API keys around as Kubernetes Secrets, and worrying about the agent’s CPU and memory use.
According to Google, the add-on removes much of that work. Credentials stay in Secret Manager rather than in cluster namespaces. The sensor’s updates run separately from GKE version upgrades. It uses a fixed memory limit per node. It also supports HTTP and mTLS proxies, which matters if your egress is locked down.
Two cautions. This is a preview, so check the terms and support level before relying on it for production. And Wiz is a separate product with its own licence, so the add-on makes deployment easier but does not make detection free. Nor does it decide who reads the alerts.
What to do this week
- Decide who would receive and act on a runtime alert. A sensor with nobody watching it adds cost and no safety.
- Read the setup documentation, including the prerequisite of granting GKE access to Secret Manager.
- If you already run Wiz or another runtime agent on GKE, compare the current install effort and key handling with the managed option.
- Try it on a non-production cluster first, and measure CPU and memory on your own workloads rather than relying on the announcement.
- If you run several clusters or projects, consider whether an organisation policy requiring the add-on suits you, once the feature is out of preview.
Need a hand?
If you want help choosing runtime security for GKE, testing it safely or setting up alert ownership, our Kubernetes consulting covers exactly this. The first call is free and it is with an engineer, not a salesperson.
Source: Announcing Wiz Runtime Sensor add-on for GKE: Turnkey threat detection for Kubernetes
Related service: Kubernetes Consulting