Skip to content

Conversation

@ivanaguilario
Copy link

@ivanaguilario ivanaguilario commented Sep 29, 2025

This PR adds support for kubernetes tolerations in the FalconAdmission and FalconImageAnalyzer CRDs.

Closes #654

This is blocking us from deploying Crowdstrike Falcon across all our Kubernetes clusters as we use tolerations in order to gate workloads to specific node groups.

Added e2e tests for deploying FalconAdmission, FalconImageAnalyzer and FalconNodeSensor with tolerations set.

@ivanaguilario ivanaguilario marked this pull request as draft September 29, 2025 16:25
@gpontejos
Copy link
Contributor

@ivanaguilario Thanks for creating this. Can you please add the following:

  1. A check within the reconciler here for IAR to ensure that the the tolerations cause a reconciliation loop? GKE Autopilot and OpenShift will add tolerations with their mutators and since the Deployment is owned by the IAR controller it'll trigger another reconcile. It's not exactly a breaking change for all deployments but it will flood the logs and continuously spam the API server.
  2. The same as above but in KAC here.

The above can also be achieved by updating watches with predicates.

@ivanaguilario
Copy link
Author

Hi there @gpontejos! Thanks for taking a look. Sorry for the late reply, got a bit busy the past few weeks.

I added the reconciler checks as requested. I saw there was already some similar work done so for consistency I took the same approach.

Let me know if anything else is needed.

Thanks!

@kgrotel
Copy link

kgrotel commented Dec 16, 2025

Any reason why this is not going forward? I cannot deploy KAC and IAR without that..

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Allow setting tolerations for Admission and ImageAnalyzer

3 participants