node: updating init containers for node daemonset and node cleanup da…

pkg/common/common_test.go

@@ -14,14 +14,14 @@ type FakeDiscovery struct {
 }
 
 func TestInitContainerArgs(t *testing.T) {
-	want := []string{"-c", `if [ -d "/opt/CrowdStrike/falconstore" ] ; then echo "Re-creating /opt/CrowdStrike/falconstore as it is a directory instead of a file"; rm -rf /opt/CrowdStrike/falconstore; fi; mkdir -p /opt/CrowdStrike && touch /opt/CrowdStrike/falconstore`}
+	want := []string{"-c", `if [ -x "/opt/CrowdStrike/falcon-daemonset-init" ]; then echo "Executing falcon-daemonset-init -i"; falcon-daemonset-init -i ; else if [ -d "/host_opt/CrowdStrike/falconstore" ]; then echo "Re-creating /opt/CrowdStrike/falconstore as it is a directory instead of a file"; rm -rf /host_opt/CrowdStrike/falconstore; fi; mkdir -p /host_opt/CrowdStrike/ && touch /host_opt/CrowdStrike/falconstore; fi`}
 	if got := InitContainerArgs(); !reflect.DeepEqual(got, want) {
 		t.Errorf("InitContainerArgs() = %v, want %v", got, want)
 	}
 }
 
 func TestInitCleanupArgs(t *testing.T) {
-	want := []string{"-c", "rm -rf /opt/CrowdStrike"}
+	want := []string{"-c", `if [ -x "/opt/CrowdStrike/falcon-daemonset-init" ]; then echo "Running falcon-daemonset-init -u"; falcon-daemonset-init -u; else echo "Manually removing /host_opt/CrowdStrike/"; rm -rf /host_opt/CrowdStrike/; fi`}
 	if got := InitCleanupArgs(); !reflect.DeepEqual(got, want) {
 		t.Errorf("InitCleanupArgs() = %v, want %v", got, want)
 	}

pkg/common/constants.go

@@ -1,14 +1,20 @@
 package common
 
 const (
-	FalconContainerInjection       = "sensor.falcon-system.crowdstrike.com/injection"
-	FalconContainerInjectorTLSName = "injector-tls"
-	FalconHostInstallDir           = "/opt"
-	FalconDataDir                  = "/opt/CrowdStrike"
-	FalconStoreFile                = "/opt/CrowdStrike/falconstore"
-	FalconContainerProbePath       = "/live"
-	FalconServiceHTTPSName         = "https"
-	FalconServiceHTTPSPort         = 443
+	FalconContainerInjection               = "sensor.falcon-system.crowdstrike.com/injection"
+	FalconContainerInjectorTLSName         = "injector-tls"
+	FalconHostInstallDir                   = "/opt"
+	FalconInitHostInstallDir               = "/host_opt"
+	FalconDataDir                          = "/opt/CrowdStrike"
+	FalconInitDataDir                      = "/host_opt/CrowdStrike/"
+	FalconStoreFile                        = "/opt/CrowdStrike/falconstore"
+	FalconInitStoreFile                    = "/host_opt/CrowdStrike/falconstore"
+	FalconDaemonsetInitBinary              = "/opt/CrowdStrike/falcon-daemonset-init"
+	FalconDaemonsetInitBinaryInvocation    = "falcon-daemonset-init -i"
+	FalconDaemonsetCleanupBinaryInvocation = "falcon-daemonset-init -u"
+	FalconContainerProbePath               = "/live"
+	FalconServiceHTTPSName                 = "https"
+	FalconServiceHTTPSPort                 = 443
 
 	FalconInstanceNameKey = "crowdstrike.com/name"
 	FalconInstanceKey     = "crowdstrike.com/instance"

pkg/common/funcs.go

@@ -16,17 +16,26 @@ import (
 func InitContainerArgs() []string {
 	return []string{
 		"-c",
-		`if [ -d "/opt/CrowdStrike/falconstore" ] ; then echo "Re-creating /opt/CrowdStrike/falconstore as it is a directory instead of a file"; rm -rf /opt/CrowdStrike/falconstore; fi; ` +
-			"mkdir -p " + FalconDataDir +
-			" && " +
-			"touch " + FalconStoreFile,
+		// Versions of falcon-sensor 6.53+ will contain an init binary that we invoke
+		`if [ -x "` + FalconDaemonsetInitBinary + `" ]; then ` +
+			`echo "Executing ` + FalconDaemonsetInitBinaryInvocation + `"; ` + FalconDaemonsetInitBinaryInvocation + ` ; else ` +
+			`if [ -d "` + FalconInitStoreFile + `" ]; then echo "Re-creating ` + FalconStoreFile + ` as it is a directory instead of a file"; rm -rf ` + FalconInitStoreFile + `; fi; ` +
+			`mkdir -p ` + FalconInitDataDir +
+			` && ` +
+			`touch ` + FalconInitStoreFile +
+			`; fi`,
 	}
 }
 
 func InitCleanupArgs() []string {
 	return []string{
 		"-c",
-		"rm -rf " + FalconDataDir,
+		// Versions of falcon-sensor 6.53+ will contain an init binary that we invoke with a cleanup argument
+		`if [ -x "` + FalconDaemonsetInitBinary + `" ]; then ` +
+			`echo "Running ` + FalconDaemonsetCleanupBinaryInvocation + `"; ` + FalconDaemonsetCleanupBinaryInvocation + `; else ` +
+			`echo "Manually removing ` + FalconInitDataDir + `"; ` +
+			`rm -rf ` + FalconInitDataDir +
+			`; fi`,
 	}
 }
 

pkg/node/assets/daemonset.go

@@ -124,9 +124,15 @@ func Daemonset(dsName, image, serviceAccount string, node *falconv1alpha1.Falcon
 							VolumeMounts: []corev1.VolumeMount{
 								{
 									Name:      "falconstore-hostdir",
-									MountPath: common.FalconHostInstallDir,
+									MountPath: common.FalconInitHostInstallDir,
 								},
 							},
+							SecurityContext: &corev1.SecurityContext{
+								Privileged:               &privileged,
+								RunAsUser:                &runAs,
+								ReadOnlyRootFilesystem:   &readOnlyFs,
+								AllowPrivilegeEscalation: &escalation,
+							},
 						},
 					},
 					ServiceAccountName: serviceAccount,
@@ -188,6 +194,7 @@ func RemoveNodeDirDaemonset(dsName, image, serviceAccount string, node *falconv1
 	privileged := true
 	escalation := true
 	readOnlyFs := false
+	hostpid := true
 	runAs := int64(0)
 
 	return &appsv1.DaemonSet{
@@ -235,6 +242,7 @@ func RemoveNodeDirDaemonset(dsName, image, serviceAccount string, node *falconv1
 					// NodeSelector is set to linux until windows containers are supported for the Falcon sensor
 					NodeSelector:                  common.NodeSelector,
 					Tolerations:                   node.Spec.Node.Tolerations,
+					HostPID:                       hostpid,
 					TerminationGracePeriodSeconds: getTermGracePeriod(node),
 					ImagePullSecrets:              pullSecrets(node),
 					InitContainers: []corev1.Container{
@@ -252,7 +260,7 @@ func RemoveNodeDirDaemonset(dsName, image, serviceAccount string, node *falconv1
 							VolumeMounts: []corev1.VolumeMount{
 								{
 									Name:      "opt-crowdstrike",
-									MountPath: common.FalconHostInstallDir,
+									MountPath: common.FalconInitHostInstallDir,
 								},
 							},
 						},

pkg/node/assets/daemonset_test.go

@@ -152,10 +152,16 @@ func TestDaemonset(t *testing.T) {
 							Image:   image,
 							Command: common.FalconShellCommand,
 							Args:    common.InitContainerArgs(),
+							SecurityContext: &corev1.SecurityContext{
+								Privileged:               &privileged,
+								RunAsUser:                &runAs,
+								ReadOnlyRootFilesystem:   &readOnlyFs,
+								AllowPrivilegeEscalation: &escalation,
+							},
 							VolumeMounts: []corev1.VolumeMount{
 								{
 									Name:      "falconstore-hostdir",
-									MountPath: common.FalconHostInstallDir,
+									MountPath: common.FalconInitHostInstallDir,
 								},
 							},
 						},
@@ -230,6 +236,7 @@ func TestRemoveNodeDirDaemonset(t *testing.T) {
 	privileged := true
 	escalation := true
 	readOnlyFs := false
+	hostpid := true
 	runAs := int64(0)
 
 	want := &appsv1.DaemonSet{
@@ -275,6 +282,7 @@ func TestRemoveNodeDirDaemonset(t *testing.T) {
 					// NodeSelector is set to linux until windows containers are supported for the Falcon sensor
 					NodeSelector:                  common.NodeSelector,
 					Tolerations:                   falconNode.Spec.Node.Tolerations,
+					HostPID:                       hostpid,
 					TerminationGracePeriodSeconds: getTermGracePeriod(&falconNode),
 					ImagePullSecrets:              pullSecrets(&falconNode),
 					InitContainers: []corev1.Container{
@@ -292,7 +300,7 @@ func TestRemoveNodeDirDaemonset(t *testing.T) {
 							VolumeMounts: []corev1.VolumeMount{
 								{
 									Name:      "opt-crowdstrike",
-									MountPath: common.FalconHostInstallDir,
+									MountPath: common.FalconInitHostInstallDir,
 								},
 							},
 						},