Install Windows Agent on AKS or EKS Clusters using Helm Chart

Overview

You can install the Windows agent on an Azure Kubernetes Service (AKS) or Amazon Elastic Kubernetes Service (EKS) cluster with a Helm chart. The Helm chart enables you to automatically deploy a Kubernetes pod containing the agent onto every node in your cluster.

note

The Windows agent running on AKS and EKS clusters currently does not support host vulnerability assessment.

Prerequisites

Ensure your AKS or EKS clusers meet the following prerequisites:

• An AKS or EKS cluster with Windows Server nodes that meet the system requirements specified in Supported Kubernetes Environments.

• Lacework Windows agent version 1.5 or later for AKS.

• Lacework Windows agent version 1.4 or later for EKS.

• Ensure that the agent has access to tags in your AWS account. For more information, see Configure Access to Tags in AWS.

  Note: The agent can automatically access tags in Microsoft Azure. Hence, no special configuration is required for Microsoft Azure.

• Install the following on your machine:

  • Docker
  • Helm
  • kubectl command-line tool
  • For AKS, install:
    • Azure CLI
  • For EKS, install:
    • AWS CLI
    • eksctl command-line tool

Supported Kubernetes Environments

Environment	Environment Name / Version
Kubernetes	Version 1.23, 1.24
Kubernetes orchestrator	Azure Kubernetes Service (AKS) Amazon Elastic Kubernetes Service (EKS)
Supported Windows OS for Nodes	Windows Server 2022 Windows Server 2019 Important: The Windows Server nodes must have Windows installed on the C:\ drive. Ensure that container and host OS versions are the same. For more information, see Windows Container Version Compatibility.
Container runtime	containerd version 1.6 or later
Container isolation mode	Process isolation mode Note: Hyper-V isolation mode is not supported.
Helm	Version 3.8x, 3.9.x, 3.10.x

Install the Windows Agent with a Helm Chart

Follow these steps to install the agent with a Helm chart:

1. Add the Lacework Helm Charts repository:

   helm repo add lacework https://lacework.github.io/helm-charts/

2. Do one of the following:

   • If you are using AKS, run the az login command to use the Azure CLI with your Azure account.

   • If you are using EKS, run the aws configure command to use the AWS CLI with your AWS account.

     Ensure that you have connected to the AWS region that contains your EKS cluster.

3. Run the following Helm commands to install the agent:

   If you are using a tenant located in North America, run the following command:

   helm upgrade --install lw-agent lacework/lacework-agent-windows \
             --set windowsAgent.agentConfig.accessToken=LACEWORK_AGENT_TOKEN \
             --set windowsAgent.agentConfig.kubernetesCluster=CLUSTER_NAME \            

   If you are using a tenant located outside of North America, run the following command:

   helm upgrade --install lw-agent lacework/lacework-agent-windows \
             --set windowsAgent.agentConfig.accessToken=LACEWORK_AGENT_TOKEN \
             --set windowsAgent.agentConfig.serverUrl=LACEWORK_SERVER_URL \
             --set windowsAgent.agentConfig.kubernetesCluster=CLUSTER_NAME \            

   Where:

   • LACEWORK_AGENT_TOKEN is your agent access token. For more information, see Agent Access Token.
   • LACEWORK_SERVER_URL is your Lacework agent server URL. For more information, see serverurl Property.
   • CLUSTER_NAME is the name of your cluster.

4. Run the following command to verify that the pods for the Windows agent have the Running status.

   kubectl get pods

5. Confirm the Windows agent is installed successfully.

   kubectl logs POD_NAME | grep 'MSI Installation successful'

   Where POD_NAME is the name of your agent POD.

After you install the agent, it takes 10 to 15 minutes for agent data to appear in the Lacework Console under Agents. You can also view your cluster in the Lacework Console under Workloads > Kubernetes.

Uninstall the Agent with a Helm Chart

To uninstall the agent with a Helm chart:

1. Open a Terminal and navigate to the helm_chart directory that contains the Helm chart.

2. Do the following:

   • If you are using AKS, run the az login command to use the Azure CLI with your Azure account.

   • If you are using EKS, run the aws configure command to use the AWS CLI with your AWS account.

     Ensure that you have connected to the AWS region that contains your EKS cluster.

3. Use Helm to uninstall the agent.

   helm uninstall lw-agent 

4. Verify that the pods for the Windows agent have been terminated.

   kubectl get pods