Skip to content

Commit 52c9b60

Browse files
mr-jungchoimr-jungchoi
committed
feat(container-pull): add unified image support for falcon-imageanalyzer
1 parent ae165d7 commit 52c9b60

2 files changed

Lines changed: 47 additions & 17 deletions

File tree

‎bash/containers/falcon-container-sensor-pull/README.md‎

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,10 @@ CrowdStrike now provides unified images that work across all regions:
4343
- **`falcon-sensor`** (unified) - Single sensor image for version 7.31+
4444
- **`falcon-container`** (unified) - Single container image for version 7.33+
4545
- **`falcon-kac`** (unified) - Single KAC image for version 7.33+
46+
- **`falcon-imageanalyzer`** (unified) - Single IAR image for version 1.0.24+
4647

4748
> [!IMPORTANT]
48-
> **Backward Compatibility**: Existing users automatically receive unified images. For regional images, use `-t falcon-sensor-regional`, `-t falcon-container-regional`, or `-t falcon-kac-regional`.
49+
> **Backward Compatibility**: Existing users automatically receive unified images. For regional images, use `-t falcon-sensor-regional`, `-t falcon-container-regional`, `-t falcon-kac-regional`, or `-t falcon-imageanalyzer-regional`.
4950
5051
## Security recommendations
5152

@@ -67,7 +68,7 @@ To check your version of cURL, run the following command: `curl --version`
6768
> [!IMPORTANT]
6869
> The following API scopes are the minimum required to retrieve the images. If you need to perform other operations post-retrieval, please refer to the CrowdStrike documentation to identify any additional scopes that may be required.
6970
70-
- **falcon-sensor | falcon-sensor-regional | falcon-container | falcon-container-regional | falcon-kac | falcon-kac-regional | falcon-imageanalyzer | falcon-jobcontroller | falcon-registryassessmentexecutor**
71+
- **falcon-sensor | falcon-sensor-regional | falcon-container | falcon-container-regional | falcon-kac | falcon-kac-regional | falcon-imageanalyzer | falcon-imageanalyzer-regional | falcon-jobcontroller | falcon-registryassessmentexecutor**
7172
- `Sensor Download (read)`
7273
- `Falcon Images Download (read)`
7374
- **falcon-snapshot**
@@ -107,11 +108,14 @@ Optional Flags:
107108
Available sensor types:
108109
-----------------------
109110
falcon-container
111+
falcon-container-regional
110112
falcon-sensor
111113
falcon-sensor-regional
112114
falcon-kac
115+
falcon-kac-regional
113116
falcon-snapshot
114117
falcon-imageanalyzer
118+
falcon-imageanalyzer-regional
115119
fcs
116120
falcon-jobcontroller
117121
falcon-registryassessmentexecutor
@@ -146,7 +150,7 @@ Help Options:
146150
| `-c`, `--copy <REGISTRY/NAMESPACE>` | `$COPY` | `None` (Optional) | Registry you want to copy the sensor image to. Example: `myregistry.com/mynamespace`. <br> *\*By default, the image name and tag are appended. Use `--copy-omit-image-name` and/or `--copy-custom-tag` to change that behavior.* |
147151
| `-v`, `--version <SENSOR_VERSION>` | `$SENSOR_VERSION` | `None` (Optional) | Specify sensor version to retrieve from the registry |
148152
| `-p`, `--platform <SENSOR_PLATFORM>` | `$SENSOR_PLATFORM` | `None` (Optional) | Specify sensor platform to retrieve from the registry |
149-
| `-t`, `--type <SENSOR_TYPE>` | `$SENSOR_TYPE` | `falcon-container` (Optional) | Specify which sensor to download [`falcon-container`, `falcon-sensor`, `falcon-sensor-regional`, `falcon-kac`, `falcon-snapshot`, `falcon-imageanalyzer`, `fcs`, `falcon-jobcontroller`, `falcon-registryassessmentexecutor`] ([see more details below](#sensor-types)) |
153+
| `-t`, `--type <SENSOR_TYPE>` | `$SENSOR_TYPE` | `falcon-container` (Optional) | Specify which sensor to download [`falcon-container`, `falcon-container-regional`, `falcon-sensor`, `falcon-sensor-regional`, `falcon-kac`, `falcon-kac-regional`, `falcon-snapshot`, `falcon-imageanalyzer`, `falcon-imageanalyzer-regional`, `fcs`, `falcon-jobcontroller`, `falcon-registryassessmentexecutor`] ([see more details below](#sensor-types)) |
150154
| `--runtime` | `$CONTAINER_TOOL` | `docker` (Optional) | Use a different container runtime [docker, podman, skopeo]. **Default is Docker**. |
151155
| `--dump-credentials` | `$CREDS` | `False` (Optional) | Print registry credentials to stdout to copy/paste into container tools |
152156
| `--get-image-path` | N/A | `None` | Get the full image path including the registry, repository, and latest tag for the specified `SENSOR_TYPE`. |
@@ -171,17 +175,20 @@ Help Options:
171175

172176
The following sensor types are available to download:
173177

174-
| Sensor Image Name | Description |
175-
| :---------------------------------- | :---------------------------------------------------- |
178+
| Sensor Image Name | Description |
179+
| :---------------------------------- |:--------------------------------------------------------------------------------|
176180
| `falcon-sensor` | The Falcon sensor for Linux as a DaemonSet deployment (unified - version 7.31+) |
177-
| `falcon-sensor-regional` | The Falcon sensor for Linux as a DaemonSet deployment w/ regions (traditional) |
178-
| `falcon-container` **(default)** | The Falcon Container sensor for Linux |
179-
| `falcon-kac` | The Falcon Kubernetes Admission Controller |
180-
| `falcon-snapshot` | The Falcon Snapshot scanner |
181-
| `falcon-imageanalyzer` | The Falcon Image Assessment at Runtime |
182-
| `fcs` | The Falcon Cloud Security CLI tool |
183-
| `falcon-jobcontroller` | The Self Hosted Registry Assessment Jobs Controller |
184-
| `falcon-registryassessmentexecutor` | The Self Hosted Registry Assessment Executor |
181+
| `falcon-sensor-regional` | The Falcon sensor for Linux as a DaemonSet deployment w/ regions (traditional) |
182+
| `falcon-container` **(default)** | The Falcon Container sensor for Linux (unified - version 7.33+) |
183+
| `falcon-container-regional` | The Falcon Container sensor for Linux w/ regions (traditional) |
184+
| `falcon-kac` | The Falcon Kubernetes Admission Controller (unified - version 7.33+) |
185+
| `falcon-kac-regional` | The Falcon Kubernetes Admission Controller w/ regions (traditional) |
186+
| `falcon-snapshot` | The Falcon Snapshot scanner |
187+
| `falcon-imageanalyzer` | The Falcon Image Assessment at Runtime (unified - version 1.0.24+) |
188+
| `falcon-imageanalyzer-regional` | The Falcon Image Assessment at Runtime w/ regions (traditional) |
189+
| `fcs` | The Falcon Cloud Security CLI tool |
190+
| `falcon-jobcontroller` | The Self Hosted Registry Assessment Jobs Controller |
191+
| `falcon-registryassessmentexecutor` | The Self Hosted Registry Assessment Executor |
185192

186193
### Examples
187194

‎bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ Optional Flags:
3636
falcon-kac-regional
3737
falcon-snapshot
3838
falcon-imageanalyzer
39+
falcon-imageanalyzer-regional
3940
fcs
4041
falcon-jobcontroller
4142
falcon-registryassessmentexecutor
@@ -302,7 +303,7 @@ format_tags() {
302303
local all_tags=$1
303304

304305
case "${SENSOR_TYPE}" in
305-
"falcon-snapshot" | "falcon-imageanalyzer" | "fcs" | "falcon-jobcontroller" | "falcon-registryassessmentexecutor")
306+
"falcon-snapshot" | "falcon-imageanalyzer" | "falcon-imageanalyzer-regional" | "fcs" | "falcon-jobcontroller" | "falcon-registryassessmentexecutor")
306307
echo "$all_tags" |
307308
sed -n 's/.*"tags" : \[\(.*\)\].*/\1/p' |
308309
tr -d '"' | tr ',' '\n' |
@@ -439,7 +440,7 @@ detect_container_tool() {
439440
display_api_scopes() {
440441
local sensor_type=$1
441442
case "${sensor_type}" in
442-
falcon-sensor | falcon-sensor-regional | falcon-container | falcon-container-regional | falcon-kac | falcon-kac-regional | falcon-imageanalyzer | falcon-jobcontroller | falcon-registryassessmentexecutor)
443+
falcon-sensor | falcon-sensor-regional | falcon-container | falcon-container-regional | falcon-kac | falcon-kac-regional | falcon-imageanalyzer | falcon-imageanalyzer-regional | falcon-jobcontroller | falcon-registryassessmentexecutor)
443444
echo "Sensor Download [read], Falcon Images Download [read]"
444445
;;
445446
falcon-snapshot)
@@ -544,7 +545,7 @@ fi
544545

545546
# Check if SENSOR_TYPE is set to a valid value
546547
case "${SENSOR_TYPE}" in
547-
falcon-container | falcon-container-regional | falcon-sensor | falcon-sensor-regional | falcon-kac | falcon-kac-regional | falcon-snapshot | falcon-imageanalyzer | fcs | falcon-jobcontroller | falcon-registryassessmentexecutor) ;;
548+
falcon-container | falcon-container-regional | falcon-sensor | falcon-sensor-regional | falcon-kac | falcon-kac-regional | falcon-snapshot | falcon-imageanalyzer | falcon-imageanalyzer-regional | fcs | falcon-jobcontroller | falcon-registryassessmentexecutor) ;;
548549
*) die """
549550
Unrecognized sensor type: ${SENSOR_TYPE}
550551
Valid values are:
@@ -556,6 +557,7 @@ case "${SENSOR_TYPE}" in
556557
falcon-kac-regional
557558
falcon-snapshot
558559
falcon-imageanalyzer
560+
falcon-imageanalyzer-regional
559561
fcs
560562
falcon-jobcontroller
561563
falcon-registryassessmentexecutor""" ;;
@@ -576,6 +578,11 @@ if [ "${SENSOR_TYPE}" = "falcon-kac-regional" ]; then
576578
echo "WARNING: Use 'falcon-kac' for the new unified KAC image as the regional KAC images will eventually be EOL."
577579
fi
578580

581+
# Add deprecation warning for falcon-imageanalyzer-regional
582+
if [ "${SENSOR_TYPE}" = "falcon-imageanalyzer-regional" ]; then
583+
echo "WARNING: Use 'falcon-imageanalyzer' for the new unified IAR image as the regional IAR images will eventually be EOL."
584+
fi
585+
579586
#Check all mandatory variables set
580587
VARIABLES="FALCON_CLIENT_ID FALCON_CLIENT_SECRET"
581588
{
@@ -652,6 +659,18 @@ registry_opts=$(
652659
else
653660
echo "falcon-kac/$FALCON_CLOUD"
654661
fi
662+
# Handle unified falcon-imageanalyzer format (no region)
663+
elif [ "${SENSOR_TYPE}" = "falcon-imageanalyzer" ]; then
664+
echo "falcon-imageanalyzer"
665+
# Handle falcon-imageanalyzer-regional with traditional regional paths
666+
elif [ "${SENSOR_TYPE}" = "falcon-imageanalyzer-regional" ]; then
667+
if [ "${FALCON_CLOUD}" = "us-gov-1" ]; then
668+
echo "falcon-imageanalyzer/gov1"
669+
elif [ "${FALCON_CLOUD}" = "us-gov-2" ]; then
670+
echo "falcon-imageanalyzer/gov2"
671+
else
672+
echo "falcon-imageanalyzer/$FALCON_CLOUD"
673+
fi
655674
# Account for govcloud api mismatch for other sensor types
656675
elif [ "${FALCON_CLOUD}" = "us-gov-1" ]; then
657676
echo "$SENSOR_TYPE/gov1"
@@ -727,7 +746,11 @@ elif [ "${SENSOR_TYPE}" = "falcon-snapshot" ]; then
727746
repository_name="$BUILD_STAGE/cs-snapshotscanner"
728747
registry_type="snapshots"
729748
elif [ "${SENSOR_TYPE}" = "falcon-imageanalyzer" ]; then
730-
# overrides for Image Analyzer
749+
# Unified format: use falcon-imageanalyzer image name
750+
IMAGE_NAME="falcon-imageanalyzer"
751+
repository_name="$BUILD_STAGE/falcon-imageanalyzer"
752+
elif [ "${SENSOR_TYPE}" = "falcon-imageanalyzer-regional" ]; then
753+
# Regional format: use falcon-imageanalyzer image name (same as unified)
731754
IMAGE_NAME="falcon-imageanalyzer"
732755
repository_name="$BUILD_STAGE/falcon-imageanalyzer"
733756
elif [ "${SENSOR_TYPE}" = "fcs" ]; then

0 commit comments

Comments
 (0)