KAC >=1.2.0 not adding cluster name automatically to EKS clusters

[buzzsurfr]

The KAC helm chart does not discover the cluster name automatically as documented.

This is specific to the KPA functionality which was added to the KAC helm chart starting with version 1.2.0.

The helm chart takes in value clusterName as a property as such:

falcon-helm/helm-charts/falcon-kac/values.yaml

Lines 84 to 92 in 6731e7b

	# Falcon KAC can usually discover the clusterName automatically so setting clusterName here is normally
	# not necessary, but in some cases the clusterName cannot be discovered by the KAC, e.g. for self-hosted
	# kubernetes clusters such as MicroK8s. In those case, the clusterName can be manually set here.
	# The clusterName is displayed as hostname for KAC in the Host Management UI.
	# Note: if the clusterName is detected by the KAC, this value will be overwritten
	# for the falcon-kac that will be displayed in the Host Management UI.
	# Important Note: if the clusterName is detected by the agent, this value will be overwritten
	clusterName: ""

The helm chart will create a ConfigMap named falcon-kac-meta with the cluster's name from the property, but ONLY if the property was provided. However, this ConfigMap does NOT get created if clusterName is not set. (See next code block) Upon deploying the helm chart, we observed that the KAC did NOT add a ConfigMap named falcon-kac-meta and the cluster was not given a name in the console.

falcon-helm/helm-charts/falcon-kac/templates/configmap.yaml

Lines 15 to 26 in 6731e7b

	{{- if .Values.clusterName }}
	---
	apiVersion: v1
	kind: ConfigMap
	metadata:
	name: falcon-kac-meta
	namespace: {{ .Release.Namespace }}
	labels:
	{{- include "falcon-kac.labels" . | nindent 4 }}
	data:
	ClusterName: {{ .Values.clusterName }}
	{{- end -}}

Given that the KAC is not open source (or I couldn't find it) and that the KAC logs in the pods do not indicate the lack of a cluster name, the presumption is that the helm chart should either require the cluster name or the controller's pod should generate logs on whether a cluster name is found.

Workaround

Once the falcon-kac-meta ConfigMap is patched with the cluster name and the KAC Deployment is restarted, the value shows up in the CrowdStrike console and populates the resources within the cluster.