sensor | clusterrole | add resources and verbs

[JonBruchim]

adding resources and verbs for the cluster role for the flow sensor integration

node.cdpRolesEnabled=false output

helm install falcon . --set node.enabled=true --set falcon.cid="11111111111111111111111111111111-11" --set node.image.repository="registry/falcon-node-sensor" --set node.cdpRolesEnabled=false --dry-run

no ClusterRole
no ClusterRoleBinding

node.cdpRolesEnabled not defined (default true) output

helm install falcon . --set node.enabled=true --set falcon.cid="11111111111111111111111111111111-11" --set node.image.repository="registry/falcon-node-sensor" --dry-run

# Source: falcon-sensor/templates/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: falcon-falcon-sensor-access-role
  labels:
    app: falcon-sensor
    app.kubernetes.io/name: falcon-sensor
    app.kubernetes.io/instance: falcon
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: "container_sensor"
    crowdstrike.com/provider: crowdstrike
    helm.sh/chart: falcon-sensor-1.29.1
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  - pods
  - services
  - nodes
  - daemonsets
  - replicasets
  - deployments
  - jobs
  - ingresses
  - cronjobs
  - persistentvolumes
  verbs:
  - get
  - watch
  - list

[cs-alphonse]

• I am not able to comment on content that is not part of the diff
• https://github.com/CrowdStrike/falcon-helm/pull/340/files#diff-8b1b64050a16b4744833a69c1dd56929ef1e6ef30cbc080ce0d4018c94a46f28R11
• https://github.com/CrowdStrike/falcon-helm/pull/340/files#diff-6ce3e7fab19d7aa64a73efef8b41d75116dc829eb636e3e22cfce3984e99d308L11
• app.kubernetes.io/component should be updated to all_sensor.
  • Not in the scope of this PR
    • We should replace kernel_sensor as node_sensor. We never updated the component after introducing support for bpf. Adding @gpontejos

[cs-alphonse]

Checked other resources that we create; all_sensor is applicable, only if we use the same resource name for multiple sensor types. In this case we create resource using the variable "falcon-sensor.fullname" and that is unique per deployment. So we should add

{{ if .Values.container.enabled }}
app.kubernetes.io/component: "container_sensor"
{{ else if (and .Values.node.enabled .Values.node.cdpRolesEnabled)}}
app.kubernetes.io/component: "kernel_sensor"
{{ end }}

[cs-alphonse]

Is secrets required by cdp?

[JonBruchim]

Yes

[redhatrises]

If data protection is not a separate sku, why are we adding this boolean? Permissions should be applied by default.