Skip to content

Commit 403ebf7

Browse files
redhatrisesredhatrises
authored
Merge pull request #226 from cs-pvyas/pvyas-falcon-iar-helm
CS Falcon Image Analyzer ( IAR ) Helm
2 parents 39a4f51 + bbddf30 commit 403ebf7

18 files changed

+1029
-0
lines changed

‎.github/workflows/helm-test.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ on:
66
- 'helm-charts/**'
77
- '!helm-charts/falcon-sensor/**'
88
- '!helm-charts/cs-k8s-protection-agent/**'
9+
- '!helm-charts/falcon-image-analyzer/**'
910
- '!helm-charts/falcon-kac/**'
1011

1112
jobs:

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ This repository is a collection of CrowdStrike Helm Charts. The Helm Charts deve
1616
| [Falcon Sensor](helm-charts/falcon-sensor) | Deploys the Falcon Sensor to Kubernetes Nodes or as a Sidecar to a pod. See [the README](helm-charts/falcon-sensor/README.md) for more info. |
1717
| [Falcon Integration Gateway](helm-charts/falcon-integration-gateway) | Deploys the Falcon Integration Gateway. See [the README](helm-charts/falcon-integration-gateway/README.md) for more info. |
1818
| [Falcon Kubernetes Admission Controller](helm-charts/falcon-kac) | Deploy the Falcon Kubernetes Admission Controller. See [the README](helm-charts/falcon-kac/README.md) for more info. |
19+
| [Falcon Image Analyzer](helm-charts/falcon-image-analyzer) | Deploy the Falcon Image Analyzer. See [the README](helm-charts/falcon-image-analyzer/README.md) for more info. |
1920

2021
## Developer Guide
2122
If you are a developer, please read our [Developer's Guide](docs/developer_guide.md).

‎helm-charts/falcon-image-analyzer/.helmignore

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎helm-charts/falcon-image-analyzer/Chart.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v2
2+
name: falcon-image-analyzer
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 1.0.0
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "1.0.0"

‎helm-charts/falcon-image-analyzer/README.md

+107
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# CrowdStrike Falcon Image Analyzer Helm Chart
2+
3+
[Falcon](https://www.crowdstrike.com/) is the [CrowdStrike](https://www.crowdstrike.com/)
4+
platform purpose-built to stop breaches via a unified set of cloud-delivered
5+
technologies that prevent all types of attacks — including malware and much
6+
more.
7+
8+
## Kubernetes cluster compatability
9+
10+
The Falcon Image Analyzer Helm chart has been tested to deploy on the following Kubernetes distributions:
11+
12+
* Amazon Elastic Kubernetes Service (EKS) - EKS and EKS Fargate
13+
* Azure Kubernetes Service (AKS)
14+
* Google Kubernetes Engine (GKE)
15+
* SUSE Rancher K3s
16+
* Red Hat OpenShift Kubernetes
17+
18+
## Dependencies
19+
20+
1. Requires a x86_64 Kubernetes cluster
21+
1. Before deploying the Helm chart, you should have the `falcon-imageanalyzer` container image in your own container registry, or use CrowdStrike's registry before installing the Helm chart. See the [Deployment Considerations](#deployment-considerations) for more.
22+
1. Helm 3.x is installed and supported by the Kubernetes vendor.
23+
24+
## Installation
25+
26+
### Add the CrowdStrike Falcon Helm repository
27+
28+
```
29+
helm repo add crowdstrike https://crowdstrike.github.io/falcon-helm
30+
```
31+
32+
### Update the local Helm repository cache
33+
34+
```
35+
helm repo update
36+
```
37+
38+
## Falcon configuration options
39+
40+
The following tables list the Falcon sensor configurable parameters and their default values.
41+
42+
| Parameter | Description | Default |
43+
|:---------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------|:----------------------------------------------------------------------------------|
44+
| `daemonset.enabled` | Set to `true` if running in Watcher Mode i.e. `crowdstrikeConfig.agentRunmode` is `socket` | false |
45+
| `deployment.enabled` | Set to `true` if running in Watcher Mode i.e. `crowdstrikeConfig.agentRunmode` is `watcher` | false |
46+
| `image.repo` | IAR image repo name | `registry.crowdstrike.com/falcon-imageanalyzer/us-1/release/falcon-imageanalyzer` |
47+
| `image.tag` | Image tag version | None |
48+
| `azure.enabled` | Set to `true` if cluster is Azure AKS or self-managed on Azure nodes. | false |
49+
| `azure.azureConfig` | Azure config file path | `/etc/kubernetes/azure.json` |
50+
| `gcp.enabled` | Set to `true` if cluster is Gogle GKE or self-managed on Google Cloud GCP nodes. | false |
51+
| `crowdstrikeConfig.clusterName` | Cluster name | None |
52+
| `crowdstrikeConfig.enableDebug` | Set to `true` for debug level log verbosity. | false |
53+
| `crowdstrikeConfig.clientID` | CrowdStrike Falcon OAuth API Client ID | None |
54+
| `crowdstrikeConfig.clientSecret` | CrowdStrike Falcon OAuth API Client secret | None |
55+
| `crowdstrikeConfig.cid` | Customer ID (CID) | None |
56+
| `crowdstrikeConfig.dockerAPIToken` | Crowdstrike Artifactory Image Pull Token for pulling IAR image directly from `registry.crowdstrike.com` | None |
57+
| `crowdstrikeConfig.existingSecret` | Existing secret ref name of the customer Kubernetes cluster | None |
58+
| `crowdstrikeConfig.agentRunmode` | Agent run mode `watcher` or `socket` for Kubernetes. Set this along with `deployment.enabled` and `daemonset.enabled` respectively | None |
59+
| `crowdstrikeConfig.agentRegion` | Region of the CrowdStrike API to connect to us-1/us-2/eu-1 | None |
60+
| `crowdstrikeConfig.agentRuntime` | The underlying runtime of the OS. docker/containerd/podman/crio. ONLY TO BE USED with `crowdstrikeConfig.agentRunmode` = `socket` | None |
61+
| `crowdstrikeConfig.agentRuntimeSocket` | The unix socket path for the runtime socket. For example: `unix///var/run/docker.sock`. ONLY TO BE USED with `crowdstrikeConfig.agentRunmode` = `socket` | None |
62+
63+
## Installing on Kubernetes cluster nodes
64+
65+
### Deployment considerations
66+
67+
For a successful deployment, you will want to ensure that:
68+
1. By default, the Helm chart installs in the `default` namespace. Best practices for deploying to Kubernetes is to create a new namespace. This can be done by adding `--create-namespace -n falcon-image-analyzer` to your `helm install` command. The namespace can be any name that you wish to use.
69+
1. You must be a cluster administrator to deploy Helm charts to the cluster.
70+
1. CrowdStrike's Helm chart is a project, not a product, and released to the community as a way to automate sensor deployment to Kubernetes clusters. The upstream repository for this project is [https://github.com/CrowdStrike/falcon-helm](https://github.com/CrowdStrike/falcon-helm).
71+
72+
### Pod Security Standards
73+
74+
Starting with Kubernetes 1.25, Pod Security Standards will be enforced. Setting the appropriate Pod Security Standards policy needs to be performed by adding a label to the namespace. Run the following command, and replace `my-existing-namespace` with the namespace that you have installed the falcon sensors, for example: `falcon-image-analyzer`.
75+
```
76+
kubectl label --overwrite ns my-existing-namespace \
77+
pod-security.kubernetes.io/enforce=privileged
78+
```
79+
80+
If you want to silence the warning and change the auditing level for the Pod Security Standard, add the following labels:
81+
```
82+
kubectl label ns --overwrite my-existing-namespace pod-security.kubernetes.io/audit=privileged
83+
kubectl label ns --overwrite my-existing-namespace pod-security.kubernetes.io/warn=privileged
84+
```
85+
86+
### Install CrowdStrike Falcon Helm chart on Kubernetes nodes
87+
88+
Before you install IAR, set the Helm chart variables and add them to the `values.yaml` file. Then, run the following to install IAR:
89+
90+
```
91+
helm upgrade --install -f path-to-my-values.yaml \
92+
--create-namespace -n falcon-image-analyzer imageanalyzer falcon-helm crowdstrike/falcon-image-analyzer
93+
```
94+
95+
96+
For more details, see the [falcon-helm](https://github.com/CrowdStrike/falcon-helm) repository.
97+
98+
```
99+
helm show values crowdstrike/falcon-sensor
100+
```
101+
102+
## Uninstall Helm chart
103+
104+
To uninstall, run the following command:
105+
```
106+
helm uninstall imageanalyzer -n falcon-image-analyzer && kubectl delete namespace falcon-image-analyzer
107+
```

‎helm-charts/falcon-image-analyzer/ci/cid-values.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
crowdstrikeConfig:
2+
clusterName: "test-cluster12.test"
3+
clientID: "abcdefABCDEF0123456789abcdefABCD"
4+
clientSecret: "abcdefABCDEF0123456789abcdefABCDEF012345"
5+
cid: "1234567890ABCDEF1234567890ABCDEF-12"

‎helm-charts/falcon-image-analyzer/templates/NOTES.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
The Crowdstrike Image Analyzer Agent is now deployed to your cluster under the {{ .Release.Namespace }} namespace as {{ include "falcon-image-analyzer.fullname" . }}. You can now check if the agent is running by running the following command:
2+
3+
"kubectl -n {{ .Release.Namespace}} get pods"

‎helm-charts/falcon-image-analyzer/templates/_helpers.tpl

+167
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "falcon-image-analyzer.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "falcon-image-analyzer.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "falcon-image-analyzer.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "falcon-image-analyzer.labels" -}}
37+
helm.sh/chart: {{ include "falcon-image-analyzer.chart" . }}
38+
{{ include "falcon-image-analyzer.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "falcon-image-analyzer.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "falcon-image-analyzer.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "falcon-image-analyzer.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "falcon-image-analyzer.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}
63+
64+
{{- define "falcon-image-analyzer.securityContext" -}}
65+
{{- if eq .Values.crowdstrikeConfig.agentRunmode "socket" -}}
66+
privileged: {{ .Values.securityContext.privileged | default true }}
67+
allowPrivilegeEscalation: {{ .Values.securityContext.allowPrivilegeEscalation | default true }}
68+
runAsUser: {{ .Values.securityContext.runAsUser | default 0 }}
69+
runAsGroup: {{ .Values.securityContext.runAsGroup | default 0 }}
70+
{{- end }}
71+
{{- end }}
72+
73+
{{- define "falcon-image-analyzer.volumeMounts" -}}
74+
{{- if lt (len .Values.volumeMounts) 2 -}}
75+
{{- .Values.volumeMounts | toYaml }}
76+
{{- if eq .Values.crowdstrikeConfig.agentRunmode "socket" }}
77+
- name: var-run
78+
mountPath: {{ trimPrefix "unix://" (include "falcon-image-analyzer.agentRuntimeSocket" . ) }}
79+
{{- if eq .Values.crowdstrikeConfig.agentRuntime "crio" }}
80+
- name: storage
81+
mountPath: /run/containers/storage
82+
- name: containers
83+
mountPath: /var/lib/containers
84+
- name: fuse-overlay
85+
mountPath: /usr/bin/fuse-overlayfs
86+
- name: crio-conf
87+
mountPath: /etc/containers
88+
{{- end }}
89+
{{- end }}
90+
{{- else -}}
91+
{{- .Values.volumeMounts | toYaml }}
92+
{{- end }}
93+
{{- end }}
94+
95+
{{- define "falcon-image-analyzer.volumes" -}}
96+
{{- if lt (len .Values.volumes) 2 -}}
97+
{{- .Values.volumes | toYaml }}
98+
{{- if eq .Values.crowdstrikeConfig.agentRunmode "socket" }}
99+
- name: var-run
100+
hostPath:
101+
path: {{ trimPrefix "unix://" (include "falcon-image-analyzer.agentRuntimeSocket" . ) }}
102+
type: Socket
103+
{{- if eq .Values.crowdstrikeConfig.agentRuntime "crio" }}
104+
- name: storage
105+
hostPath:
106+
path: /run/containers/storage
107+
type: Directory
108+
- name: containers
109+
hostPath:
110+
path: /var/lib/containers
111+
type: Directory
112+
- name: crio-conf
113+
hostPath:
114+
path: /etc/containers
115+
type: Directory
116+
- name: fuse-overlay
117+
hostPath:
118+
path: /usr/bin/fuse-overlayfs
119+
type: File
120+
{{- end }}
121+
{{- end }}
122+
{{- else -}}
123+
{{- .Values.volumes | toYaml }}
124+
{{- end }}
125+
{{- end }}
126+
127+
{{- define "falcon-image-analyzer.agentRuntimeSocket" -}}
128+
{{- if eq .Values.crowdstrikeConfig.agentRunmode "socket" }}
129+
{{- if not .Values.crowdstrikeConfig.agentRuntimeSocket }}
130+
{{- if eq .Values.crowdstrikeConfig.agentRuntime "docker" }}
131+
{{- printf "%s" "unix:///run/docker.sock" }}
132+
{{- else if eq .Values.crowdstrikeConfig.agentRuntime "containerd" -}}
133+
{{- printf "%s" "unix:///run/containerd/containerd.sock" }}
134+
{{- else if eq .Values.crowdstrikeConfig.agentRuntime "crio" -}}
135+
{{- printf "%s" "unix:///run/crio/crio.sock" }}
136+
{{- else if eq .Values.crowdstrikeConfig.agentRuntime "podman" -}}
137+
{{- printf "%s" "unix:///run/podman/podman.sock" }}
138+
{{- end }}
139+
{{- else -}}
140+
{{- .Values.crowdstrikeConfig.agentRuntimeSocket }}
141+
{{- end }}
142+
{{- end }}
143+
{{- end }}
144+
145+
{{- define "falcon-image-analyzer.imagePullSecret" }}
146+
{{- with .Values.crowdstrikeConfig }}
147+
{{- if eq .agentRegion "us-gov-1" }}
148+
{{- printf "{\"auths\":{\"registry.laggar.gcw.crowdstrike.com\":{\"username\":\"fc-%s\",\"password\":\"%s\",\"email\":\"image-assessment@crowdstrike.com\",\"auth\":\"%s\"}}}" (first (regexSplit "-" (lower .cid) -1)) .dockerAPIToken (printf "fc-%s:%s" (first (regexSplit "-" (lower .cid) -1)) .dockerAPIToken | b64enc) | b64enc }}
149+
{{- else if eq .agentRegion "us-gov-2" }}
150+
{{- printf "{\"auths\":{\"registry.us-gov-2.crowdstrike.mil\":{\"username\":\"fc-%s\",\"password\":\"%s\",\"email\":\"image-assessment@crowdstrike.com\",\"auth\":\"%s\"}}}" (first (regexSplit "-" (lower .cid) -1)) .dockerAPIToken (printf "fc-%s:%s" (first (regexSplit "-" (lower .cid) -1)) .dockerAPIToken | b64enc) | b64enc }}
151+
{{- else }}
152+
{{- printf "{\"auths\":{\"registry.crowdstrike.com\":{\"username\":\"fc-%s\",\"password\":\"%s\",\"email\":\"image-assessment@crowdstrike.com\",\"auth\":\"%s\"}}}" (first (regexSplit "-" (lower .cid) -1)) .dockerAPIToken (printf "fc-%s:%s" (first (regexSplit "-" (lower .cid) -1)) .dockerAPIToken | b64enc) | b64enc }}
153+
{{- end }}
154+
{{- end }}
155+
{{- end }}
156+
157+
{{- define "falcon-image-analyzer.image" -}}
158+
{{- if .Values.image.digest -}}
159+
{{- if contains "sha256:" .Values.image.digest -}}
160+
{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}}
161+
{{- else -}}
162+
{{- printf "%s@%s:%s" .Values.image.repository "sha256" .Values.image.digest -}}
163+
{{- end -}}
164+
{{- else -}}
165+
{{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
166+
{{- end -}}
167+
{{- end -}}

‎helm-charts/falcon-image-analyzer/templates/cluster-role-read-access-binding.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: {{ include "falcon-image-analyzer.fullname" . }}
5+
labels:
6+
{{- include "falcon-image-analyzer.labels" . | nindent 4 }}
7+
subjects:
8+
- kind: ServiceAccount
9+
name: {{ .Values.serviceAccount.name | default ( include "falcon-image-analyzer.fullname" . ) }}
10+
namespace: {{ .Release.Namespace }}
11+
roleRef:
12+
apiGroup: rbac.authorization.k8s.io
13+
kind: ClusterRole
14+
name: {{ include "falcon-image-analyzer.fullname" . }}

‎helm-charts/falcon-image-analyzer/templates/cluster-role-read-access.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ include "falcon-image-analyzer.fullname" . }}
5+
labels:
6+
{{- include "falcon-image-analyzer.labels" . | nindent 4 }}
7+
rules:
8+
- apiGroups:
9+
- ""
10+
resources:
11+
- pods
12+
- secrets
13+
- namespaces
14+
verbs:
15+
- get
16+
- watch
17+
- list

0 commit comments

Comments
 (0)