Skip to content

Commit d1178a4

Browse files
gpontejosgpontejos
authored
Merge pull request #344 from mcrowson/shra-1.2
SHRA-1.2 release
2 parents 698a358 + 378d36c commit d1178a4

File tree

3 files changed

+11
-9
lines changed

3 files changed

+11
-9
lines changed

‎helm-charts/falcon-self-hosted-registry-assessment/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,10 @@ type: application
1515
# This is the chart version. This version number should be incremented each time you make changes
1616
# to the chart and its templates, including the app version.
1717
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18-
version: 1.1.0
18+
version: 1.2.0
1919

2020
# This is the version number of the application being deployed. This version number should be
2121
# incremented each time you make changes to the application. Versions are not expected to
2222
# follow Semantic Versioning. They should reflect the version the application is using.
2323
# It is recommended to use it with quotes.
24-
appVersion: "1.1.0"
24+
appVersion: "1.2.0"

‎helm-charts/falcon-self-hosted-registry-assessment/README.md

+7-5
Original file line numberDiff line numberDiff line change
@@ -470,8 +470,10 @@ Be sure to specify the correct `type` field for your registry so SHRA knows how
470470
Copy this registry configuration to your `values_override.yaml` file and provide the required information.
471471

472472
Notes:
473-
* To access ECR, the host needs to have direct access to the ECR registry.
474-
* Leave the default empty strings for `credentials.aws_iam_role` and `credentials.aws_external_id`. These are placeholders for possible future support of role assumption.
473+
* To access ECR, the host needs either direct access or the ability to assume an IAM role with appropriate permissions for the ECR registry.
474+
* If role assumption is needed to retrieve ECR tokens, supply both `credentials.aws_iam_role` and `credentials.aws_external_id`.
475+
Ensure the roles have a trust-relationship configured to allow the service account access to the resources in the SHRA namespace (the default namespace used in these setup instructions is `falcon-self-hosted-registry-assessment`).
476+
For additional information on IAM Roles, refer to the [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html).
475477

476478
```yaml
477479
- type: ecr
@@ -1092,7 +1094,6 @@ To increase or decrease the number of Executor Pods, edit the `executor.replicaC
10921094
|:-----------------------------|------------:|:----------------------------------------------------------------------------------------------------------------------------|:------------|
10931095
| `executor.replicaCount` | | The number of Executor Pods. This value can be increased for greater concurrency if CPU is the bottleneck. | 1 |
10941096

1095-
10961097
<!-- markdown-link-check-disable -->
10971098
### Allow traffic to CrowdStrike servers
10981099

@@ -1321,7 +1322,6 @@ Now that your SHRA logs are ingested by LogScale, you can configure scheduled se
13211322
1. Follow our NG-SEIM instuctions to [Schedule your search](https://falcon.crowdstrike.com/documentation/page/a4275adf/scheduled-searches-for-edr). You'll be notified when any issues arise that you need to correct regarding registry connections.
13221323

13231324

1324-
13251325
## Install the SHRA Helm Chart
13261326

13271327
Before you install, follow the configuration steps above to prepare your accounts and create a `values_override.yaml` file with your customizations.
@@ -1459,7 +1459,9 @@ The Chart's `values.yaml` file includes more comments and descriptions in-line f
14591459
| `registryConfigs.*.credentials.username` | required without `kubernetesSecretName` | The username used to authenticate to the registry. | "" |
14601460
| `registryConfigs.*.credentials.password` | required without `kubernetesSecretName` | The password used to authenticate to the registry. | "" |
14611461
| `registryConfigs.*.credentials.kubernetesSecretName` | required with `kubernetesSecretNamespace` | The Kubernetes secret name that contains registry credentials. [secret type](https://kubernetes.io/docs/concepts/configuration/secret/#secret-types) must be a [kubernetes.io/dockercfg](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_create/kubectl_create_secret_docker-registry/) or a kubernetes.io/dockerconfigjson type secret. | "" |
1462-
| `registryConfigs.*.credentials.kubernetesSecretNamespace` | required with `kubernetesSecretName` | The namespace containing the Kubernetes secret with credentials. | "" |
1462+
| `registryConfigs.*.credentials.kubernetesSecretNamespace` | required with `kubernetesSecretName` | The namespace containing the Kubernetes secret with credentials. | "" |
1463+
| `registryConfigs.[*].credentials.aws_iam_role` | | Specify the assumed role, if any, when connectin to ECR. | |
1464+
| `registryConfigs.[*].credentials.aws_external_id` | | Specify the External ID for the connecting to the assumed role specified in `registryConfigs.[*].credentials.aws_iam_role` for the associated registry config. | |
14631465
| `registryConfigs.*.port` | | The port for connecting to the registry. Unless you specify a value here, SHRA uses port 80 for http and 443 for https. | "" |
14641466
| `registryConfigs.*.allowedRepositories` | | A comma separated list of repositories to assess. No regex or wildcard support. If this value is not set, all repositories within the registry are assessed. | "" |
14651467
| `registryConfigs.*.host` | | The host for connecting to the registry. | "" |

‎helm-charts/falcon-self-hosted-registry-assessment/values.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ executor:
1212
# Overrides the image tag. In general, tags should not be used (including semver tags or `latest`).
1313
# This variable is provided for those who have yet to move off of using tags. The sha256 digest
1414
# should be used in place of tags for increased security and image immutability.
15-
tag: "0.9.0"
15+
tag: "1.2.0"
1616
# Setting a digest will override any tag and should be used instead of tags.
1717
#
1818
# Example digest variable configuration:
@@ -100,7 +100,7 @@ jobController:
100100
repository: "jobcontroller"
101101
# Overrides the image tag. In general, tags should not be used (including semver tags or `latest`). This variable is provided for those
102102
# who have yet to move off of using tags. The sha256 digest should be used in place of tags for increased security and image immutability.
103-
tag: "0.17.0"
103+
tag: "1.2.0"
104104
# Setting a digest will override any tag and should be used instead of tags.
105105
#
106106
# Example digest variable configuration:

0 commit comments

Comments
 (0)