Falcon Operator

Falcon Operator installs CrowdStrike Falcon Container Sensor or CrowdStrike Falcon Node Sensor on the cluster.

Falcon Operator is an open source project, not a CrowdStrike product. As such it carries no formal support, expressed or implied.

About Falcon Operator

Falcon Operator deploys CrowdStrike Falcon Workload Protection to the cluster. The operator exposes 2 custom resources that allows you to deploy either Falcon Container Sensor or Falcon Node Sensor.

About Custom Resources

Custom Resource	Description
FalconContainer	Manages installation of Falcon Container Sensor on the cluster
FalconNodeSensor	Manages installation of Falcon Linux Sensor on the cluster nodes

Additional information can be found in FAQ document

Installation Steps

Installation steps differ based on Operator Life-cycle Manager (OLM) availability. You can determine whether your cluster is using OLM by running: kubectl get crd catalogsources.operators.coreos.com

• (option 1): In case your cluster is not using OLM (Operator Life-cycle Manager) run:

  kubectl apply -f https://raw.githubusercontent.com/CrowdStrike/falcon-operator/main/deploy/falcon-operator.yaml
  

• (option 2): In case your cluster is using OLM run:

  OPERATOR_NAMESPACE=falcon-operator
  kubectl create ns $OPERATOR_NAMESPACE --dry-run=client -o yaml | kubectl apply -f -
  operator-sdk run bundle quay.io/crowdstrike/falcon-operator-bundle:latest --namespace $OPERATOR_NAMESPACE
  

After the installation concludes please proceed with deploying either Falcon Container Sensor or Falcon Node Sensor.

Uninstall Steps

• To uninstall Falcon Operator run (when installed using OLM)

  operator-sdk cleanup falcon-operator --namespace falcon-operator
  

• To uninstall Falcon Operator run (when installed manually)

  kubectl delete -f https://raw.githubusercontent.com/CrowdStrike/falcon-operator/main/deploy/falcon-operator.yaml
  

Getting Help

If you encounter any issues while using Falcon Operator, you can create an issue on our Github repo for bugs, enhancements, or other requests.

Contributing

You can contribute by:

• Raising any issues you find using Falcon Operator
• Fixing issues by opening Pull Requests
• Submitting a patch or opening a PR
• Improving documentation
• Talking about Falcon Operator

All bugs, tasks or enhancements are tracked as GitHub issues.

Additional Resources

• CrowdStrike Container Security: Product Page
• So You Think Your Containers Are Secure? Four Steps to Ensure a Secure Container Deployment: Blog Post
• Container Security With CrowdStrike: Blog Post
• To learn more about Falcon Container Sensor for Linux: Deployment Guide, Release Notes
• Developer Documentation