#1

CrowdStrike Falcon sensor support is very kernel specific and currently FedoraCoreOS (FCOS) is unsupported. CrowdStrike support have indicated that FCOS support is a H1 2021 roadmap item but with no hard delivery date.

Hopefully the September 2020 introduction of Falcon sensors that can cope with minor kernel updates (“Zero Touch Linux Updates”) will provide strong support for self-updating OS’s like FCOS without resulting in sensors being constantly degraded into an RFM (“Reduced Functionality Mode”) mode.

For those running K8S on OKD on FCOS a container-level CrowdStrike sensor is available but obviously this is not intended to provide the host-level monitoring that regular Falcon sensors provide.

1 Like
#2

Thanks for looking into that. Do you have a support ticket open with them to get updates on the progress? If not, I’d be interested in opening one with them.

#3

For OpenShift and kernel modules, see https://github.com/openshift/enhancements/pull/357

(But, nothing really is going to be better than having whatever they’re doing in the upstream kernel. I suspect KRSI is relevant)

#4

Found the ‘Idea’ that is roadmap-flagged in CrowdStrike. More votes from those of you who have CrowdStrike accounts can’t hurt: CrowdStrike Idea: Redhat CoreOS Support

It is worded for Redhat CoreOS support but the comments express desire for Fedora CoreOS support too. And more comments is good.