From f5630ea72449ae66ef94fde51906ea1a0668fc49 Mon Sep 17 00:00:00 2001 From: pvyas Date: Tue, 6 Feb 2024 09:40:20 -0500 Subject: [PATCH] falcon-image-analyzer update Readme --- helm-charts/falcon-image-analyzer/Chart.yaml | 4 +- helm-charts/falcon-image-analyzer/README.md | 88 +++++++++++++++++++- 2 files changed, 86 insertions(+), 6 deletions(-) diff --git a/helm-charts/falcon-image-analyzer/Chart.yaml b/helm-charts/falcon-image-analyzer/Chart.yaml index 4a4cb559..28c5e62a 100644 --- a/helm-charts/falcon-image-analyzer/Chart.yaml +++ b/helm-charts/falcon-image-analyzer/Chart.yaml @@ -15,10 +15,10 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 1.1.0 +version: 1.1.1 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "1.1.0" +appVersion: "1.1.1" diff --git a/helm-charts/falcon-image-analyzer/README.md b/helm-charts/falcon-image-analyzer/README.md index 7894eea1..d8b1eb3a 100644 --- a/helm-charts/falcon-image-analyzer/README.md +++ b/helm-charts/falcon-image-analyzer/README.md @@ -15,6 +15,10 @@ The Falcon Image Analyzer Helm chart has been tested to deploy on the following * SUSE Rancher K3s * Red Hat OpenShift Kubernetes +## New updates in curent release +- Removed the `crowdstrikeConfig.agentRunmode` variable from values. +- added `privateRegistries.credentials` variable in values. Details below. + ## Dependencies 1. Requires a x86_64 Kubernetes cluster @@ -60,6 +64,12 @@ The following tables list the Falcon sensor configurable parameters and their de | `crowdstrikeConfig.agentRuntime` | The underlying runtime of the OS. docker/containerd/podman/crio. ONLY TO BE USED with `daemonset.enabled` = `true` | None | | `crowdstrikeConfig.agentRuntimeSocket` | The unix socket path for the runtime socket. For example: `unix///var/run/docker.sock`. ONLY TO BE USED with ONLY TO BE USED with `daemonset.enabled` = `true` | None | + +Note : +- +- Please set either `daemonset.enabled` OR `deployment.enabled` +- For deployment the replica count is set to **1** always. this is because IAR is not a load balanced service i.e. increasing replicas will not divide the work but rather duplicate creating unncessary resource consumption. + ## Installing on Kubernetes cluster nodes @@ -87,20 +97,42 @@ kubectl label ns --overwrite my-existing-namespace pod-security.kubernetes.io/wa ### IAM Roles ( EKS or Partially Managed using EC2 Instances) - For the IAR to detect cloud as AWS it should be able to retrieve sts token to assume role to retrieve ECR Tokens. - There are 2 options for that . If your EKS cluster us using the kiam or kube2iam admission controller, add annotations + There are 2 options for that . If your EKS cluster us using the **kiam** or **kube2iam** admission controller, add annotations for the IAR service account in the values.yaml as stated below, before installing. Make sure the roles have trust-relationship to allow the serviceaccount in the `falcon-image-analyzer` namespace ``` serviceAccount: # Annotations to add to the service account annotations: - iam.amazonaws.com/role: role-name-with-s2sassume-role-permission + iam.amazonaws.com/role: role-name-with-s2sassume-role-permission -> NOTE That is role name ONLY Not the full ARN +``` + +Make sure the above role `role-name-with-s2sassume-role-permission` in **AWS** has the as policy with ECR all permissions as IAR will need to pull images and assume ECR Tokens +``` +{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "VisualEditor0", + "Effect": "Allow", + "Action": [ + "ecr:*" + ], + "Resource": "*" + } + ] +} ``` +The above role is important so that IAR can read/pull/list from all ECR registries if any workload is launched with an image from any ECR. +Modify the resource part of the role above to restrict to specific registry or AWS Account. Keep the actions as atleast get* and gist*. +Consult the AWS IAM Role Guide/Wizard for syntax and avoid typos. +Make sure the trust-relationship of the has principal role of `kiam` or `kube2iam` service with `s2s:assumeRole` permissions. - For the EKS Cluster using the OIDC providers add the annotation as below.Make sure the roles have trust-relationship to allow the serviceaccount in the `falcon-image-analyzer` namespace + ``` serviceAccount: # Annotations to add to the service account @@ -108,6 +140,47 @@ serviceAccount: eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/my-role ``` +Make sure the above role `arn:aws:iam::111122223333:role/my-role` in **AWS** has the as policy with ECR all permissions as IAR will need to pull images and assume ECR Tokens +``` +{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "VisualEditor0", + "Effect": "Allow", + "Action": [ + "ecr:*" + ], + "Resource": "*" + } + ] +} +``` + +and a trust-relationship as +``` +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Federated": "EKS-OIDC-ARN" + }, + "Action": "sts:AssumeRoleWithWebIdentity", + "Condition": { + "StringEquals": { + "EKS-OIDC-ARN:aud": "sts.amazonaws.com", + "EKS-OIDC-ARN:sub": "system:serviceaccount:falcon-image-analyzer:imageanalyzer-falcon-image-analyzer" + } + } + } + ] +} +``` + +Here `falcon-image-analyzer` is the namespace of IAR and `imageanalyzer-falcon-image-analyzer` is the name of the iar Service Account + ### Authentication for Private Registries - If you are using ECR or cloud based Private Registries then assigning the IAM role to the iar service-account in `falcon-image-analyzer` namespace should be enough @@ -125,8 +198,15 @@ for e.g. a docker-registry secret can be created as below --docker-username=read-only \ --docker-password=my-super-secret-pass \ --docker-email=johndoe@example.com -n my-app-ns + + kubectl create secret docker-registry regcred2 \ +--docker-server=my2ndregistry-artifactory.jfrog.io \ +--docker-username=2nd-read-only \ +--docker-password=2nd-my-super-secret-pass \ +--docker-email=johndoe@example.com -n my-app-ns + ``` -use the above secret as `"my-app-ns:regcred"` +use the above secret as `"my-app-ns:regcred,my-app-ns:regcred2"` ### Install CrowdStrike Falcon Helm chart on Kubernetes nodes @@ -134,7 +214,7 @@ Before you install IAR, set the Helm chart variables and add them to the `values ``` helm upgrade --install -f path-to-my-values.yaml \ - --create-namespace -n falcon-image-analyzer imageanalyzer falcon-helm crowdstrike/falcon-image-analyzer + --create-namespace -n falcon-image-analyzer imageanalyzer crowdstrike/falcon-image-analyzer ```