{"id":28409895,"url":"https://github.com/crowdstrike/terraform-kubectl-falcon","last_synced_at":"2025-09-06T22:38:44.978Z","repository":{"id":106788789,"uuid":"593702157","full_name":"CrowdStrike/terraform-kubectl-falcon","owner":"CrowdStrike","description":"Module to manage CrowdStrike Falcon Sensor on a Kubernetes cluster.","archived":false,"fork":false,"pushed_at":"2025-08-19T20:24:22.000Z","size":113,"stargazers_count":7,"open_issues_count":5,"forks_count":16,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-08-19T22:22:37.208Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/CrowdStrike/falcon/kubectl/latest","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CrowdStrike.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-01-26T16:45:23.000Z","updated_at":"2025-08-19T20:23:55.000Z","dependencies_parsed_at":"2025-04-04T13:01:01.362Z","dependency_job_id":null,"html_url":"https://github.com/CrowdStrike/terraform-kubectl-falcon","commit_stats":null,"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/CrowdStrike/terraform-kubectl-falcon","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Fterraform-kubectl-falcon","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Fterraform-kubectl-falcon/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Fterraform-kubectl-falcon/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Fterraform-kubectl-falcon/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CrowdStrike","download_url":"https://codeload.github.com/CrowdStrike/terraform-kubectl-falcon/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Fterraform-kubectl-falcon/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":273973979,"owners_count":25200579,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-06T02:00:13.247Z","response_time":2576,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-02T11:08:55.330Z","updated_at":"2025-09-06T22:38:44.955Z","avatar_url":"https://github.com/CrowdStrike.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003c!-- BEGIN_TF_DOCS --\u003e\n![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)\n\n[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike\u0026style=social\u0026url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)\u003cbr/\u003e\n\n# CrowdStrike Falcon\n\nThis repository contains modules that can be used to automate the deployment of the CrowdStrike Falcon Sensor, Falcon Admission Controller (KAC) Falcon Image Analyzer (IAR) and the Kubernetes Protection Agent (KPA) on a Kubernetes cluster.\n\nLearn more about each module:\n\n| Module                                                           | Description               |\n| ---------------------------------------------------------------- | ------------------------- |\n| [operator](./modules/operator/README.md)                         | Manages Falcon Sensor, KAC and IAR deployments |\n| [operator-openshift](./modules/operator-openshift/README.md)     | Manages Falcon Sensor, KAC and IAR deployments on OpenShift |\n| [k8s-protection-agent](./modules/k8s-protection-agent/README.md) | Manage KPA deployment     |\n\n## Pre-requisites\n\n1. You will need to provide CrowdStrike API Keys and CrowdStrike cloud region for the installation. It is recommended to establish new API credentials for the installation at https://falcon.crowdstrike.com/support/api-clients-and-keys, minimal required permissions are:\n\n    | Scope Name                  | Permission             |\n    | --------------------------- | ---------------------- |\n    | Falcon Images Download      | **Read**               |\n    | Sensor Download             | **Read**               |\n    | Falcon Container CLI        | **Write**              |\n    | Falcon Container Image      | **Read** and **Write** |\n    | Kubernetes Protection Agent | **Write**              |\n    | Kubernetes Protection       | **Read** and **Write** |\n\n2. You need a CrowdStrike Docker API Token and CID. See [How to retrieve your Falcon Docker API Token and CID](./modules//k8s-protection-agent/README.md#how-to-retrieve-your-falcon-docker-api-token-and-cid) for instructions on how to retrieve your Docker API Token and CID.\n\n## Providers\n\nNo providers.\n## Resources\n\nNo resources.\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_admission_controller_manifest_path\"\u003e\u003c/a\u003e [admission\\_controller\\_manifest\\_path](#input\\_admission\\_controller\\_manifest\\_path) | n/a | `string` | `\"default\"` | no |\n| \u003ca name=\"input_cid\"\u003e\u003c/a\u003e [cid](#input\\_cid) | Customer ID (CID) of the Falcon platform. | `string` | n/a | yes if kpa = true |\n| \u003ca name=\"input_cleanup\"\u003e\u003c/a\u003e [cleanup](#input\\_cleanup) | Whether to cleanup resources on destroy. | `bool` | `true` | no |\n| \u003ca name=\"input_client_id\"\u003e\u003c/a\u003e [client\\_id](#input\\_client\\_id) | Falcon API Client Id | `string` | n/a | yes |\n| \u003ca name=\"input_client_secret\"\u003e\u003c/a\u003e [client\\_secret](#input\\_client\\_secret) | Falcon API Client Secret | `string` | n/a | yes |\n| \u003ca name=\"input_cluster_name\"\u003e\u003c/a\u003e [cluster\\_name](#input\\_cluster\\_name) | Your Cluster Name | `string` | n/a | yes |\n| \u003ca name=\"input_container_sensor_manifest_path\"\u003e\u003c/a\u003e [container\\_sensor\\_manifest\\_path](#input\\_container\\_sensor\\_manifest\\_path) | n/a | `string` | `\"default\"` | no |\n| \u003ca name=\"input_docker_api_token\"\u003e\u003c/a\u003e [docker\\_api\\_token](#input\\_docker\\_api\\_token) | Falcon Docker API Token | `string` | n/a | yes |\n| \u003ca name=\"input_environment\"\u003e\u003c/a\u003e [environment](#input\\_environment) | Environment or 'Alias' tag | `string` | `\"tf_module\"` | no |\n| \u003ca name=\"input_falcon_admission\"\u003e\u003c/a\u003e [falcon\\_admission](#input\\_falcon\\_admission) | Whether to deploy the FalconAdmission Custom Resource (CR) to the cluster. | `bool` | `true` | no |\n| \u003ca name=\"input_cloud\"\u003e\u003c/a\u003e [cloud](#input\\_cloud) | Falcon Cloud Region to use. | `string` | n/a | no |\n| \u003ca name=\"input_iar\"\u003e\u003c/a\u003e [iar](#input\\_iar) | Whether to deploy the Falcon Image Analyzer Custom Resource (CR) to the cluster. | `bool` | `true` | no |\n| \u003ca name=\"input_iar_manifest_path\"\u003e\u003c/a\u003e [iar\\_manifest\\_path](#input\\_iar\\_manifest\\_path) | n/a | `string` | `\"default\"` | no |\n| \u003ca name=\"input_kpa\"\u003e\u003c/a\u003e [kpa](#input\\_kpa) | Whether to deploy the Falcon Kubernetes Protection Agent to the cluster. | `bool` | `false` | no |\n| \u003ca name=\"input_node_manifest_path\"\u003e\u003c/a\u003e [node\\_manifest\\_path](#input\\_node\\_manifest\\_path) | n/a | `string` | `\"default\"` | no |\n| \u003ca name=\"input_node_sensor_mode\"\u003e\u003c/a\u003e [node\\_sensor\\_mode](#input\\_node\\_sensor\\_mode) | Falcon Node Sensor mode: 'kernel' or 'bpf'. | `string` | `\"bpf\"` | no |\n| \u003ca name=\"input_operator_version\"\u003e\u003c/a\u003e [operator\\_version](#input\\_operator\\_version) | Falcon Operator version to deploy. Can be a branch, tag, or commit hash of the falcon-operator repo. | `string` | `\"v0.9.1\"` | no |\n| \u003ca name=\"input_platform\"\u003e\u003c/a\u003e [platform](#input\\_platform) | Specify whether your cluster is managed by kubernetes or openshift. | `string` | `\"kubernetes\"` | no |\n| \u003ca name=\"input_sensor_type\"\u003e\u003c/a\u003e [sensor\\_type](#input\\_sensor\\_type) | Falcon sensor type: FalconNodeSensor or FalconContainer. | `string` | `\"FalconNodeSensor\"` | no |\n## Outputs\n\nNo outputs.\n\n## Usage\n\n```hcl\nprovider \"aws\" {\n  region = local.region\n}\n\n# Example of using secrets stored in AWS Secrets Manager\ndata \"aws_eks_cluster_auth\" \"this\" {\n  name = module.eks_blueprints.eks_cluster_id\n}\n\ndata \"aws_secretsmanager_secret_version\" \"current\" {\n  secret_id     = data.aws_secretsmanager_secret.falcon_secrets.id\n  version_stage = var.aws_secret_version_stage\n}\n\nlocals {\n  cluster_name  = \"cluster-name\"\n  region        = var.region\n  falcon_region = var.falcon_region\n\n  secrets = jsondecode(data.aws_secretsmanager_secret_version.current.secret_string)\n}\n\nmodule \"crowdstrike_falcon\" {\n  source = \"CrowdStrike/falcon/kubectl\"\n  version = \"0.6.1\"\n\n  cid              = local.secrets[\"cid\"]\n  client_id        = local.secrets[\"client_id\"]\n  client_secret    = local.secrets[\"client_secret\"]\n  falcon_region    = local.falcon_region\n  cluster_name     = local.cluster_name\n  docker_api_token = local.secrets[\"docker_api_token\"]\n}\n```\n\u003c!-- END_TF_DOCS --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcrowdstrike%2Fterraform-kubectl-falcon","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcrowdstrike%2Fterraform-kubectl-falcon","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcrowdstrike%2Fterraform-kubectl-falcon/lists"}