Cluster Sensor 1.7.0 

August 03, 2026 

Qualys Cluster Sensor 1.7.0 expands Azure AKS support with Azure Workload Identity authentication, replacing traditional Kubernetes RBAC with Azure Entra ID identities for centralized identity and access control. This release also introduces read-only root filesystem support for enhanced container security hardening, along with performance improvements and bug fixes.

Support for Azure Service Account instead of K8s

Previously, the Qualys Cluster Sensor deployed on Azure Kubernetes Service (AKS) authenticated and authorized against the Kubernetes API server using traditional Kubernetes RBAC, which required a ServiceAccount, a Role or ClusterRole, and a RoleBinding or ClusterRoleBinding. While functional, this approach doesn't leverage Azure-native identity, limits centralized access governance across Azure resources, and requires the separate management of Kubernetes-specific identities.

To address customers who have adopted cloud-native identity for authenticating to the Kubernetes API, the Cluster Sensor now supports Azure Entra ID (formerly Azure AD) identities via Azure Workload Identity, using Azure Kubernetes RBAC in place of traditional Kubernetes RBAC.

This feature is supported only on Azure AKS (Azure Kubernetes Service) clusters.

Parameter	Description	Default value
global.clusterInfoArgs.useCloudProviderRbac	Set to true to enable Azure Service Account authentication instead of Kubernetes RBAC.	false
clusterSensor.azureWorkloadIdentity.clientId	The Client ID of the Azure Workload Identity to be used for authentication.	----

Support for Read-Only Root Filesystem 

The Cluster Sensor now supports running with a read-only root filesystem, allowing you to further harden your deployments in line with Kubernetes security best practices. Enabling this setting prevents any process within the sensor container from writing to, modifying, or persisting files on the container's root filesystem at runtime - reducing the attack surface in the event of a container compromise and helping customers meet internal and regulatory compliance requirements.

Parameter	Description	Default value	Required	Notes
clusterSensor.readOnlyRootFilesystem	Set the container's root filesystem as read-only	false	No	Requires clusterSensor.persistentStorage.enabled=true to ensure the sensor has a writable path for data and logs.

Example configuration

yaml
clusterSensor:
  persistentStorage:
    enabled: true
  readOnlyRootFilesystem: true