Prisma Cloud's Defender install script causes Diego Cell to be unhealthy

Products

• VMware Tanzu Application Service for VMs

Issue/Introduction

Prisma Cloud for Tanzu is a 3rd party tile and it is not officially supported by VMWare. The tile install a defender job inside Diego Cells. Just like any other jobs running inside diego once it fails to start it will make the whole diego cell into a failing state. 

Here is a sample log where defender job fails to start
 

Error: 'diego_cell/40f65b2d-fc74-47b5-87a6-5305e1d700e2 (0)' is not running after update. Review logs for failed jobs: defender
...
Task 7694784 error

To get more info as to why defender is fails. We bosh ssh into the deigo cell goto /var/vcap/sys/log/defender and review the logs. 
 

Downloading defender install scriptbash: line 1: $'\302\240': command not foundcurl: option -k : is unknowncurl: try 'curl --help' or 'curl --manual' for more informationSun Feb 5 22:16:04 UTC 2023 Starting defender

The error above indicates that the configured install script on defender Tile is not valid. 

Environment

Product Version: 2.13

Resolution

In the example above the error "option -k : is unknown" was seen instead of "option -k: is unknown" (note the extra whitespace character after -k).  The issue was resolved by replacing the extra hidden characters with a standard space character.

Sometimes we copy commands from terminal to the tile configuration and this would cause extra hidden characters that would appear as a space by the naked eye and would be hard to determine why script is invalid. One way to determine this is using tools such as notepad++ and configuring it to view hidden characters . 

After supplying a valid install script command on the defender tile, re run the deployment.