apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: falcon-sensor
spec:
  selector:
    matchLabels:
      name: falcon-sensor

  template:
    metadata:
      labels:
        name: falcon-sensor

    spec:
      initContainers:
      
      # This init container creates empty falconstore file so that when
      # it's mounted into the sensor-container, k8s would just use it
      # rather than creating a directory.  Mounting falconstore file as
      # a file volume ensures that AID is preserved across container
      # restarts.
      - name: init-falconstore
        image: busybox
        args: [/bin/sh, -c, 'touch /tmp/CrowdStrike/falconstore']
        volumeMounts:
          - name: falconstore-dir
            mountPath: /tmp/CrowdStrike

      containers:
      - name: sensor-container
        
        #
        # For example, with Red Hat OpenShift's internal registry:
        # image: image-registry.openshift-image-registry.svc:5000/default/falcon-sensor:latest
        #
        image: image-registry.openshift-image-registry.svc:5000/default/falcon-sensor:latest
        volumeMounts:
        - name: dev
          mountPath: /dev
        - name: var-run
          mountPath: /var/run
        - name: etc
          mountPath: /etc
        - name: var-log
          mountPath: /var/log
        - name: falconstore
          mountPath: /opt/CrowdStrike/falconstore

        securityContext:
          privileged: true
        envFrom:
        - configMapRef:
            name: falconctl-options

      # This spits out logs from sensor-container to stdout so that they
      # are routed through k8s log driver.
      - name: log
        image: busybox
        args: [/bin/sh, -c, 'tail --retry -n1 -f /var/log/falcon-sensor.log']
        volumeMounts:
        - name: var-log
          mountPath: /var/log

      volumes:
        - name: dev
          hostPath:
            path: /dev
        - name: etc
          hostPath:
            path: /etc
        - name: var-run
          hostPath:
            path: /var/run
        - name: var-log
          emptyDir: {}
        - name: falconstore
          hostPath:
            path: /tmp/CrowdStrike/falconstore
        - name: falconstore-dir
          hostPath:
            path: /tmp/CrowdStrike

      terminationGracePeriodSeconds: 10
      hostNetwork: true
      hostPID: true
      hostIPC: true