As Kubernetes becomes increasingly integral to production environments, cyber adversaries are likewise becoming more skilled in cloud-native exploitation. According to the CrowdStrike 2024 Global Threat Report, cases involving exploitation of cloud services increased by 110% in 2023, far outpacing non-cloud cases, which grew only 60% year-over-year.
CrowdStrike helps organizations stay ahead of these evolving adversaries by providing breach prevention solutions that span endpoints, Kubernetes, clouds, data and identity in the consolidated CrowdStrike Falcon® platform.
This article talks about the following:
- CrowdStrike Falcon Platform architecture
- CrowdStrike Falcon Platform operator
- Installing Red Hat OpenShift Certified Falcon operator
Falcon platform architecture
The Falcon platform was designed to better protect against breaches and empower security teams. The lightweight Falcon sensor helps detect and prevent known and zero-day attacks, and the cloud-delivered Falcon platform consolidates dozens of cloud security capabilities, regularly processing trillions of telemetry events every day. This means there's very little for administrators to manage. Specifically, for Red Hat OpenShift, the Falcon platform offers better runtime protection against advanced adversaries, and helps protect both container workloads and the underlying Red Hat Enterprise Linux CoreOS operating system.
Why CrowdStrike developed an operator
Ease of deployment is a core tenet of CrowdStrike: The easier it is to deploy security software, the more likely an organization is to use it effectively. In the Kubernetes ecosystem, operators are the de facto packaging mechanism to simplify both the "Day 1" deployment and "Day 2" maintenance of software.
The CrowdStrike Falcon operator automates these tasks during initial deployment:
- Getting registry credentials from the CrowdStrike API and creating a corresponding registry
Secret
- Creating a
DaemonSet
for the Falcon sensor to be deployed to all nodes - Optionally, deploying Falcon Admission Controller for cluster-level security
Plus, the Falcon operator performs these lifecycle tasks:
- Redeploys the Falcon sensor when sensor configurations have changed
- Correlates your CrowdStrike Customer ID (CID) based on the provided CrowdStrike API credentials
- Redeploys the Falcon admission controller when a change has occurred
Finally, future areas of potential enhancement include:
- Verifying that the certified operator is being installed when deploying on OpenShift
- Automatically renewing certificates when cert-manger.io is deployed
The Falcon operator streamlines a number of tasks, making it easier to maintain a more consistent security posture across your Kubernetes fleet.
Installation steps
Prerequisites
- OpenShift 4.x Cluster
- CrowdStrike Falcon® Cloud Security subscription. Reach out to redhat@crowdstrike.com if you'd like to trial this. (Please use your company email address and provide background on the clusters you want to protect)
Step 1: Create a CrowdStrike API client for the Falcon operator
- Login to the CrowdStrike website
- Navigate to the API Clients and Keys page (Support and resources > Resources and tools > API Clients and Keys)
- Click Create API client
- Enter details to define your API client:
- Client Name (required)
- Description (optional)
- API Scopes (required):
- Select Falcon Images Download with read permission
- Select Sensor Download with read permission
- Click Create to save the API client and generate the client ID and secret
![rhos-crowdstrike-falcon-image1 API client and keys tab](/rhdc/managed-files/styles/wysiwyg_full_width/private/rhos-crowdstrike-falcon-image1.png.webp?itok=QFW2Q1gp)
Step 2: Install the CrowdStrike Falcon operator from OperatorHub
- Log in to the OpenShift cluster
- Navigate to Operators > OperatorHub
- Search for "Falcon Operator" and select the tile offered by the Marketplace. Click "Install"
- By default, the Falcon operator installs in the falcon-operator namespace. Continue with the default settings and click "Install"
- On the screen, you will see a confirmation indicating that the Falcon operator is "ready for use"
- Click on "View Operator" to proceed
Step 3: Deploy FalconNodeSensor resource
The FalconNodeSensor
resource manages the installation of the Falcon sensor on the OpenShift control plane and worker nodes.
- Navigate to Installed Operators > CrowdStrike Falcon Platform - Operator
- In the Falcon Node Sensor tile, select "Create instance"
- Choose the YAML view and fill in your
client_id
andclient_secret
- Fill in
namespace: falcon-operator
- Click "Create"
- Wait until the Status updates to "Success"
- Switch to the Workloads > DaemonSets view and verify the
falcon-node-sensor
resource shows "X of X pods" (where X is the number of nodes in your cluster)
Step 4: Deploy the FalconAdmission resource
The FalconAdmission
resource manages deployment of the Falcon Admission Controller on the cluster, which prevents noncompliant workloads from being deployed.
- Navigate to Installed Operators > CrowdStrike Falcon Platform - Operator
- In the Falcon Admission tile, select "Create instance"
- Choose the YAML view and fill in your
client_id
andclient_secret
- Click "Create"
- By default, Falcon Admission is deployed in the falcon-kac namespace
- Select "Project: falcon-kac"
- Switch to the Workloads > Pods view and verify the two
falcon-admission-*
pods are running
Stop a simulated breach
To observe Falcon protection in action, install the vulnapp
example vulnerable application. This application allows you to trigger malicious behavior inside a container from a web browser. You can find the source for vulnapp
on GitHub.
However, because the Falcon platform learns which applications are malicious, you may need to exclude the vulnerable application from monitoring to make sure it runs.
Step 1: Exclude the vulnerable application from detections
- Log in to the CrowdStrike console
- In the Falcon console, navigate to Endpoint security > Configure > Exclusions
- Click "Create exclusion"
- Select "All hosts" or follow the instructions to create a new group for the OpenShift nodes
- Exclude from: Detections and preventions
- Exclusion pattern:
/shell2http
- Click "Create exclusion"
Step 2: Install vulnerable testing application
Note that these steps expose vulnapp on a public route.
- Create a new project for the application:
oc new-project vulnapp
- Deploy the application:
oc apply -f https://raw.githubusercontent.com/crowdstrike/vulnapp/main/vulnerable.openshift.yaml
- Retrieve the web address by running the following command:
oc get route vulnapp
- Open the application using the web address, then select "/rootkit" to trigger a detection. (This script will change the group owner of /etc/ld.so.preload to 0, indicative of a Jynx rootkit)
- In the Falcon console, navigate to Endpoint security > Monitor > Endpoint detections to view the detection
- Select the Severity box on the left-hand side of the dashboard to view the details of the detection
- In the screenshot, you can see the
chgrp
command fromcoreutils
being used to change the group ownership to 0 (root group) for the/etc/ld.so.preload
file
- In the screenshot, you can see the
![rhos-crowdstrike-falcon-image2 Falcon console, Endpoint detection view](/rhdc/managed-files/styles/wysiwyg_full_width/private/rhos-crowdstrike-falcon-image2.png.webp?itok=4WQAyif3)
Conclusion
You have successfully installed the CrowdStrike Falcon operator on your OpenShift 4.x cluster and deployed an example application to test detections.
Visit crowdstrike.com/redhat to learn about all of the ways CrowdStrike integrates with Red Hat Enterprise Linux, Red Hat OpenShift and Red Hat Ansible Automation Platform.
저자 소개
Specializing in end-to-end infrastructure to deployment of containerized applications, I am a Cloud Infrastructure Engineer with extensive experience in Kubernetes native application design and optimization.
My passion for technology drives me to continuously explore cutting-edge tools and practices, enabling me to design and implement innovative solutions that optimize performance and user experience.
With a keen eye for detail and a commitment to excellence, I thrive on turning challenging problems into seamless, efficient solutions.
Evan Stoner is a Senior Solution Architect at CrowdStrike focused on integrating its leading security platform with Red Hat’s enterprise open source solutions. Together, Red Hat and CrowdStrike provide a stable and secure foundation for the hybrid cloud: on-premises, in the cloud, or at the edge. Evan has previously held roles as a solution architect for aerospace and defense at Red Hat, platform engineering lead at a defense contractor, and cybersecurity researcher in academia. He has worked at the intersection of security and open source his entire career.
Gabriel Alford is a Staff Solutions Architect at CrowdStrike where he collaborates with Cloud Service Providers and Cloud ISVs on integrating and certifying CrowdStrike products on partner platforms as well as creating joint partner technical solutions. He has over 15 years experience in security, compliance, and IT operations.
유사한 검색 결과
채널별 검색
오토메이션
기술, 팀, 인프라를 위한 IT 자동화 최신 동향
인공지능
고객이 어디서나 AI 워크로드를 실행할 수 있도록 지원하는 플랫폼 업데이트
오픈 하이브리드 클라우드
하이브리드 클라우드로 더욱 유연한 미래를 구축하는 방법을 알아보세요
보안
환경과 기술 전반에 걸쳐 리스크를 감소하는 방법에 대한 최신 정보
엣지 컴퓨팅
엣지에서의 운영을 단순화하는 플랫폼 업데이트
인프라
세계적으로 인정받은 기업용 Linux 플랫폼에 대한 최신 정보
애플리케이션
복잡한 애플리케이션에 대한 솔루션 더 보기
오리지널 쇼
엔터프라이즈 기술 분야의 제작자와 리더가 전하는 흥미로운 스토리
제품
- Red Hat Enterprise Linux
- Red Hat OpenShift Enterprise
- Red Hat Ansible Automation Platform
- 클라우드 서비스
- 모든 제품 보기
툴
체험, 구매 & 영업
커뮤니케이션
Red Hat 소개
Red Hat은 Linux, 클라우드, 컨테이너, 쿠버네티스 등을 포함한 글로벌 엔터프라이즈 오픈소스 솔루션 공급업체입니다. Red Hat은 코어 데이터센터에서 네트워크 엣지에 이르기까지 다양한 플랫폼과 환경에서 기업의 업무 편의성을 높여 주는 강화된 기능의 솔루션을 제공합니다.