falcon-sensor helm incorrect clusterrole permissions #375
Description
Hello, you have recently updated falcon-sensor clusterrole. Resources were not arranged under proper kubernetes API groups in that role and our pipelines started failing because of that when trying to install falcon-sensor. Please fix the role asap
helm-charts/falcon-sensor/templates/clusterrole.yaml
the role should be like this
{{- if or .Values.container.enabled .Values.node.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "falcon-sensor.fullname" . }}-access-role
labels:
app: {{ include "falcon-sensor.name" . }}
app.kubernetes.io/name: {{ include "falcon-sensor.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- if .Values.container.enabled }}
app.kubernetes.io/component: "container_sensor"
{{ else if .Values.node.enabled }}
app.kubernetes.io/component: "kernel_sensor"
{{ end -}}
crowdstrike.com/provider: crowdstrike
helm.sh/chart: {{ include "falcon-sensor.chart" . }}
rules:
- apiGroups:
- ""
resources:
- namespaces
- secrets
verbs:
- get
{{- if .Values.node.enabled }}
- apiGroups:
- ""
resources:
- pods
- services
- nodes
- persistentvolumes
verbs:
- get
- watch
- list
- apiGroups:
- apps
resources:
- daemonsets
- replicasets
- deployments
verbs:
- get
- watch
- list
- apiGroups:
- batch
resources:
- jobs
- cronjobs
verbs:
- get
- watch
- list
- apiGroups:
- networking.k8s.io
resources:
- ingresses
verbs:
- get
- watch
- list
{{- end }}
{{- end }}