Run a PowerShell script on Azure AKS nodes,

user_10221795 0
Viewed 508

I have a PowerShell script that I want to run on some Azure AKS nodes (running Windows) to deploy a security tool. There is no daemon set for this by the software vendor. How would I get it done?

Thanks a million Abdel

azure-aks kubernetes azure powershell windows
2 Answers

Similar question has been asked here. User philipwelz has written:

Hey,

although there could be ways to do this, i would recommend that you dont. The reason is that your AKS setup should not allow execute scripts inside container directly on AKS nodes. This would imply a huge security issue IMO.

I suggest to find a way the execute your script directly on your nodes, for example with PowerShell remoting or any way that suits you.

BR,
Philip

This user is right. You should avoid executing scripts on your AKS nodes. In your situation if you want to deploy Prisma cloud you need to go with the following doc. You are right that install scripts work only on Linux:

Install scripts work on Linux hosts only.

But, for the Windows and Mac software you have specific yaml files:

For macOS and Windows hosts, use twistcli to generate Defender DaemonSet YAML configuration files, and then deploy it with kubectl, as described in the following procedure.

The entire procedure is described in detail in the document I have quoted. Pay attention to step 3 and step 4. As you can see, there is no need to run any powershell script:

STEP 3:

   The following command connects to Console (specified in  [--address](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_kubernetes.html#)) as user <ADMIN> (specified in  [--user](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_kubernetes.html#)), and generates a Defender DaemonSet YAML config file according to the configuration options passed to  [twistcli](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_kubernetes.html#). The  [--cluster-address](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_kubernetes.html#)  option specifies the address Defender uses to connect to Console.
   
   $ <PLATFORM>/twistcli defender export kubernetes \
     --user <ADMIN_USER> \
     --address <PRISMA_CLOUD_COMPUTE_CONSOLE_URL> \
     --cluster-address <PRISMA_CLOUD_COMPUTE_HOSTNAME>
   
   -   <PLATFORM> can be linux, osx, or windows.
       
   -   <ADMIN_USER> is the name of a Prisma Cloud user with the System Admin role.

and then STEP 4:

kubectl create -f ./defender.yaml
user_154075420

I think that the above answer is not completely correct.

The twistcli command, does not export daemonset for Windows Nodes. The "PLATFORM" option, is for choosing the OS of the computer that the command will run.

After testing, I have made the conclusion that there is no Docker Image for Prisma Cloud for Windows Kubernetes Nodes, as it is deployed as a service at Windows OS, and not Container (as in Linux). Wrapping up, the Daemonset is not working at the Windows Hosts

I believe the only solution is this -> Windows

This is the Powershell script that Wytrzymały Wiktor has mentioned. Unfortunately this cannot be automated easily, as you have to deploy an Azure VM per AKS Cluster (at the same network), and RDP to the AKS Windows Node and run the script.

If anyone has another suggestion or solution, feel free to share.

user_176769480
Related