Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

falcon-sensor helm incorrect clusterrole permissions #375

Open
maxm18 opened this issue Mar 7, 2025 · 0 comments · May be fixed by #376
Open

falcon-sensor helm incorrect clusterrole permissions #375

maxm18 opened this issue Mar 7, 2025 · 0 comments · May be fixed by #376

Comments

@maxm18
Copy link

maxm18 commented Mar 7, 2025

Hello, you have recently updated falcon-sensor clusterrole. Resources were not arranged under proper kubernetes API groups in that role and our pipelines started failing because of that when trying to install falcon-sensor. Please fix the role asap

helm-charts/falcon-sensor/templates/clusterrole.yaml

the role should be like this

{{- if or .Values.container.enabled .Values.node.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "falcon-sensor.fullname" . }}-access-role
  labels:
    app: {{ include "falcon-sensor.name" . }}
    app.kubernetes.io/name: {{ include "falcon-sensor.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    {{- if .Values.container.enabled }}
    app.kubernetes.io/component: "container_sensor"
    {{ else if .Values.node.enabled }}
    app.kubernetes.io/component: "kernel_sensor"
    {{ end -}}
    crowdstrike.com/provider: crowdstrike
    helm.sh/chart: {{ include "falcon-sensor.chart" . }}
rules:
- apiGroups:
  - ""
  resources:
  - namespaces
  - secrets
  verbs:
  - get
{{- if .Values.node.enabled }}
- apiGroups:
  - ""
  resources:
  - pods
  - services
  - nodes
  - persistentvolumes
  verbs:
  - get
  - watch
  - list
- apiGroups:
  - apps
  resources:
  - daemonsets
  - replicasets
  - deployments
  verbs:
  - get
  - watch
  - list
- apiGroups:
  - batch
  resources:
  - jobs
  - cronjobs
  verbs:
  - get
  - watch
  - list
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - get
  - watch
  - list
  {{- end }}
{{- end }}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant