Add the falcon-kac chart to helm-charts

helm-charts/falcon-kac/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

helm-charts/falcon-kac/Chart.yaml

@@ -0,0 +1,44 @@
+apiVersion: v2
+name: falcon-kac
+description: A Helm chart to deploy CrowdStrike Falcon Kubernetes Admission Controller.
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.8.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+appVersion: 0.8.0
+
+keywords:
+  - CrowdStrike
+  - Falcon
+  - EDR
+  - kubernetes
+  - security
+  - monitoring
+  - alerting
+
+home: https://crowdstrike.com
+
+sources:
+  - https://artifactory.cicd.dc/artifactory/eng-xdr-crp-helm-dev-virtual
+
+maintainers:
+  - name: CrowdStrike Deployment Engineering
+    email: integrations@crowdstrike.com
+
+icon: https://raw.githubusercontent.com/CrowdStrike/falcon-helm/main/images/crowdstrike-logo.svg
+kubeVersion: ">1.21.0-0"

helm-charts/falcon-kac/README.md

@@ -0,0 +1,175 @@
+# CrowdStrike Falcon Kubernetes Admission Controller Helm Chart
+The Falcon Kubernetes Admission Controller (KAC) is a custom plugin that you can deploy to your Kubernetes cluster to monitor and review Kubernetes objects when they are created. It’s deployed to a worker node in a cluster, and when enabled, it listens to post-authenticated API requests from the control plane.
+
+Admission control policies tell the Falcon KAC what to do when it observes an Indicator of Misconfiguration (IOM) on a Kubernetes object. You can customize policies to apply to different areas of the cluster by namespace or object label. You can configure the action that the Falcon KAC takes when it encounters a misconfiguration. It can take no action, generate an alert, or prevent the object from being deployed.
+
+Together, the Falcon KAC and the admission control policies provide continuous visibility and protection across your Kubernetes cluster.
+
+
+# Getting Started
+To install and deploy the Falcon Kubernetes Admission Controller, your cluster environment must meet these requirements:
+
+- Helm 3.x is installed and available in PATH
+- Helm 3.x is supported by your Kubernetes distribution
+- Your cluster is running on a supported x86_64 Kubernetes environment
+
+The Falcon Kubernetes Admission Controller has been deployed and tested on these Kubernetes distributions:
+
+- Amazon Elastic Kubernetes Service (EKS)
+- Google Kubernetes Engine (GKE)
+- Microsoft Azure Kubernetes Service (AKS)
+- Red Hat OpenShift Container Platform 4.6 and later
+
+Depending on your network environment, you might need to allow TLS traffic on port 443 between your network and our cloud's network addresses:
+
+| CrowdStrike cloud | Network address                                                          |
+|-------------------|--------------------------------------------------------------------------|
+| US-1              | ts01-b.cloudsink.net<br/>lfodown01-b.cloudsink.net                       |
+| US-2              | ts01-gyr-maverick.cloudsink.net<br/>lfodown01-gyr-maverick.cloudsink.net |
+| EU-1              | ts01-lanner-lion.cloudsink.net<br/>lfodown01-lanner-lion.cloudsink.net   |
+| US-GOV-1          | ts01-laggar-gcw.cloudsink.net<br/>lfodown01-laggar-gcw.cloudsink.net     |
+
+# Falcon Kubernetes Admission Controller Architecture Overview 
+The Falcon KAC runs as a pair of containers in a pod on the worker node. It listens to the Kubernetes API to monitor Kubernetes objects. When a new object is created, the Falcon KAC evaluates the new object against the admission control policy to identify IOMs. The admission control policy tells the Falcon KAC how to respond to new objects: do nothing, create an alert in the Falcon console, or prevent the object from being deployed.
+The Falcon KAC comprises two containers:
+
+- **Kubernetes Client (falcon-client)**  
+This is the validating webhook that is responsible for listening to events from the Kubernetes API and forwarding them to the admission control process.
+- **Admission controller (falcon-ac)**  
+This is the controller process that is responsible for admission control policy management, cloud communication, and event handling.
+
+The Falcon KAC does not monitor these namespaces:
+- falcon-kac
+- kube-system
+- kube-public
+
+# Install Falcon Kubernetes Admission Controller
+
+
+- Add the Crowdstrike Falcon Helm Repository:  
+  ```
+  helm repo add crowdstrike https://crowdstrike.github.io/falcon-helm
+  ```
+- Update the Falcon Helm Repository Cache
+   ```
+   helm repo update
+   ```
+- Set a variable for the Falcon KAC image:  
+   ```
+   export KAC_IMAGE_NAME=<registry_name>/<repo_name>/falcon-kac<br/><br/> 
+   ``` 
+- Set a variable for the Falcon KAC image tag:    
+   ```
+   export KAC_IMAGE_TAG=<KAC_version>.container.x86_64.Release.
+   <cloud_region>
+   ```
+   Example: The Falcon KAC image tag has this format falcon-kac:0.13-99.container.x86_64.Release.US1
+- Set a Falcon CID variable:  
+   ```
+   export FALCON_CID=<your_CID_with_checksum>
+   ```
+**Tip**: To find your CID with checksum, go to the CrowdStrike Sensor download page. At the top of the page, locate your CID checksum, and then click **Copy your Customer ID checksum to the clipboard**.
+
+## Install Falcon KAC Helm chart
+
+- Install the Falcon KAC Helm chart to a new namespace:  
+  ```
+   helm install falcon-kac crowdstrike/falcon-kac \
+    -n falcon-kac --create-namespace \
+    --set falcon.cid=$FALCON_CID \
+    --set image.repository=$KAC_IMAGE_NAME \
+    --set image.tag=$KAC_IMAGE_TAG
+  ```  
+  **Tip**: Use the --set flag to pass individual values to the values file when running helm install. For a complete list and description of configurable parameters, run  
+  ```
+  helm show values crowdstrike/falcon-kac
+  ```
+- Optional: Install the Falcon KAC Helm from a private registry that requires authentication:If your registry requires authentication, you must create a Kubernetes secret that can fetch the image from the registry.
+  - Log into your Docker registry.
+  - Fetch the base64 encoded pull secret:
+    ```
+     cat ~/.docker/config.json | base64 -w 0
+    ```
+  - Save the base64 string as a variable for the pull secret:
+    ```
+     export IMAGE_PULL_TOKEN=<base64_encoded_string>
+    ```
+
+  ```
+   helm install falcon-kac crowdstrike/falcon-kac \
+      -n falcon-kac --create-namespace \
+      --set falcon.cid=$FALCON_CID \
+      --set image.repository=$KAC_IMAGE_NAME \
+      --set image.tag=$KAC_IMAGE_TAG \
+      --set image.registryConfigJSON=$IMAGE_PULL_TOKEN
+    ```
+
+- Verify that the Falcon KAC deployment is ready and the corresponding pod has a Running status:
+
+  ```
+   kubectl get deployments,pods -n falcon-kac
+   NAME         READY   UP-TO-DATE   AVAILABLE   AGE
+   falcon-kac   1/1     1            1           7d2h
+
+   NAME                          READY   STATUS    RESTARTS         AGE
+   falcon-kac-7cc7dd57fc-pvzzf   2/2     Running   0                7d2h
+  ```
+- Verify that the Falcon KAC has an AID: 
+  ```
+   kubectl exec deployment/falcon-kac -n falcon-kac -c falcon-ac -- falconctl -g --aid
+  ```
+  **Tip**: An AID is assigned to the Falcon KAC when it communicates with the Falcon cloud. If the Falcon KAC has an AID that is not all zeros, it is installed and running properly.
+
+## Update Falcon KAC
+When a new container image is available, you can update your Falcon KAC by passing the new container image to the Helm chart. Falcon KAC does not support auto-update. You must manually update the Falcon KAC on your cluster.
+- Set a new variable for the Falcon KAC container image tag:
+  ```
+  export KAC_IMAGE_TAG=<KAC_version>.container.x86_64.Release.<cloud_region>
+  ```
+
+- Update your Helm chart with the new container image:
+  ``` 
+    helm upgrade --install falcon-kac $KAC_HELM_REPO \
+       -n falcon-kac --create-namespace \
+       --set falcon.cid=$FALCON_CID \
+       --set image.repository=$KAC_IMAGE_NAME \
+       --set image.tag=$KAC_IMAGE_TAG
+  ```
+  **Note**: Your deployment will update only when you change the inputs for helm upgrade, for example by changing the image reference. 
+
+- Verify that the new version of the Falcon KAC is running on the falcon-kac pods:  
+  ```
+  kubectl get pods -n falcon-kac -o jsonpath='{range .items[*]}{"\n"}{.metadata.name}{":\t"}{range .spec.containers[*]}{.image}{", "}{end}{end}'
+  ```
+
+   The output looks similar to the example below and shows that version  
+   falcon-kac:3.0.0-572.container.x86_64.Release.US is running on both Falcon KAC pods.
+   ```
+   falcon-kac-5bd6986f6f-x86vw: falcon-kac:3.0.0-572.container.x86_64.Release.US, falcon-kac:3.0.0-572.container.x86_64.Release.US,
+   ```
+
+## Uninstall Falcon KAC
+- Uninstall the admission controller from the falcon-kac namespace:
+  ```
+  helm uninstall falcon-kac -n falcon-kac
+  ```
+  <br/>
+- Delete the namespace:
+  ```
+  kubectl delete ns falcon-kac
+  ```
+# Falcon Configuration Options
+
+The following tables lists the Falcon KAC  configurable parameters and their default values.
+
+| Parameter                   | Description                                           | Default               |
+|:----------------------------|:------------------------------------------------------|:----------------------|
+| `falcon.cid`                | CrowdStrike Customer ID (CID)                         | None       (Required) |
+| `falcon.apd`                | App Proxy Disable (APD)                               | None                  |
+| `falcon.aph`                | App Proxy Hostname (APH)                              | None                  |
+| `falcon.app`                | App Proxy Port (APP)                                  | None                  |
+| `falcon.trace`              | Set trace level. (`none`,`err`,`warn`,`info`,`debug`) | `none`                |
+| `falcon.feature`            | Sensor Feature options                                | None                  |
+| `falcon.billing`            | Utilize default or metered billing                    | None                  |
+| `falcon.tags`               | Comma separated list of tags for sensor grouping      | None                  |
+| `falcon.provisioning_token` | Provisioning token value                              | None                  |

helm-charts/falcon-kac/ci/cid-values.yaml

@@ -0,0 +1,2 @@
+falcon:
+  cid: 1234567890ABCDEF1234567890ABCDEF-12

helm-charts/falcon-kac/templates/NOTES.txt

@@ -0,0 +1,4 @@
+Thank you for installing the CrowdStrike Falcon Kubernetes Admission Controller!
+
+Access to the Falcon Kubernetes Admissions Controller container image is
+required to complete the install of this Helm chart.

helm-charts/falcon-kac/templates/_helpers.tpl

@@ -0,0 +1,94 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "falcon-kac.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Set the webhook name
+*/}}
+{{- define "falcon-kac.webhookName" -}}
+{{ printf "%s.crowdstrike.com" .Chart.Name }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "falcon-kac.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "falcon-kac.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "falcon-kac.labels" -}}
+{{ include "falcon-kac.selectorLabels" . }}
+app.kubernetes.io/component: kac
+app.kubernetes.io/name: {{ include "falcon-kac.name" . }}
+crowdstrike.com/provider: crowdstrike
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+helm.sh/chart: {{ include "falcon-kac.chart" . }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "falcon-kac.selectorLabels" -}}
+app: {{ include "falcon-kac.name" . }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "falcon-kac.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "falcon-kac.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "falcon-kac.image" -}}
+{{- if .Values.image.digest -}}
+{{- if contains "sha256:" .Values.image.digest -}}
+{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}}
+{{- else -}}
+{{- printf "%s@%s:%s" .Values.image.repository "sha256" .Values.image.digest -}}
+{{- end -}}
+{{- else -}}
+{{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+On Openshift lookup namespaces and print namespaces with prefix openshift
+*/}}
+{{- define "falcon-kac.openshiftNamespaces" -}}
+{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1" -}}
+{{- range $index, $namespace := (lookup "v1" "Namespace" "" "").items -}}
+{{- if hasPrefix "openshift" $namespace.metadata.name -}}
+- {{ printf "%s\n" $namespace.metadata.name }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}

helm-charts/falcon-kac/templates/clusterrole.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "falcon-kac.fullname" . }}-resource-reader
+  labels:
+    {{- include "falcon-kac.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["namespaces", "nodes"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["apps"]
+  resources: ["daemonsets"]
+  verbs: ["get", "list", "watch"]

helm-charts/falcon-kac/templates/clusterrolebindings.yaml

@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "falcon-kac.fullname" . }}-security-crb
+  labels:
+    {{- include "falcon-kac.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "falcon-kac.fullname" . }}-resource-reader
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.serviceAccount.name }}
+  namespace: {{ .Release.Namespace }}

helm-charts/falcon-kac/templates/configmap.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "falcon-kac.fullname" . }}-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "falcon-kac.labels" . | nindent 4 }}
+data:
+  FALCONCTL_OPT_CID: {{ .Values.falcon.cid }}
+  {{- range $key, $value := .Values.falcon }}
+  {{- if and ($value) (ne $key "cid") }}
+  FALCONCTL_OPT_{{ $key | upper }}: {{ $value | quote }}
+  {{- end }}
+  {{- end }}
+