Hello,

Thanks for opening this, but unfortunately, this PR doesn't work as described or intended since it only sets the affinity for the webhook injector service and not the actual sidecar injected sensor. The container sensor uses a mutating webhook which is cluster-wide so setting the affinity for the injection service won't actually tell the sensor to only inject into pods on say fargate-only nodes. This means that in mixed clusters the sensor will be injected into all pods.

Setting sensor.falcon-system.crowdstrike.com/injection to disabled in each namespace/pod or disabling injection by default and setting sensor.falcon-system.crowdstrike.com/injection to enabled in each namespace/pod is the way to do it which is pretty standard/common for kubernetes deployments.

Hello,

Thanks for opening this, but unfortunately, this PR doesn't work as described or intended since it only sets the affinity for the webhook injector service and not the actual sidecar injected sensor. The container sensor uses a mutating webhook which is cluster-wide so setting the affinity for the injection service won't actually tell the sensor to only inject into pods on say fargate-only nodes. This means that in mixed clusters the sensor will be injected into all pods.

Setting sensor.falcon-system.crowdstrike.com/injection to disabled in each namespace/pod or disabling injection by default and setting sensor.falcon-system.crowdstrike.com/injection to enabled in each namespace/pod is the way to do it which is pretty standard/common for kubernetes deployments.

Hi,

Is it actually possible to run falcon helm chart with:
node:
enabled: true
container:
enabled: true

Because in our setup we have issue with using both node sensors and container sensors - using argo for the deployment.
And as I've reached the falcon support they said to me that this is not possible - to have both sensors run simultaneously.

Thanks in advance!

bellaned

Yes. However, this would only be for mixed cluster like EKS with Fargate nodes. Which in that case, you would need to disable the sidecar injection in each namespace or pod not running on Fargate nodes. What is not supported is running both the sidecar in pods that run on nodes that have the sensor also installed.