Falcon Operator

The CrowdStrike Falcon Operator installs CrowdStrike Falcon custom resources on a Kubernetes cluster.

[!IMPORTANT] Announcement: In January 2027, the Falcon sensor for Linux (DaemonSet), Kubernetes Admission Controller (KAC), and Image Assessment at Runtime (IAR) will be consolidated into Falcon Cluster Guard. This affects the FalconNodeSensor, FalconAdmission, and FalconImageAnalyzer custom resources. Read the Falcon Cluster Guard Announcement to prepare your environment.

About the CrowdStrike Falcon Operator

The CrowdStrike Falcon Operator is designed to streamline the deployment and use of CrowdStrike products on Kubernetes clusters. The operator exposes custom resources that allow you to protect your Kubernetes clusters when deployed.

About Custom Resources

Custom Resource	Description
FalconAdmission	Manages installation of Falcon Admission Controller on the cluster
FalconImageAnalyzer	Manages installation of Falcon Image Assessment at Runtime on the cluster
FalconContainer	Manages installation of Falcon Container Sensor on the cluster
FalconNodeSensor	Manages installation of Falcon Linux Sensor on the cluster nodes
FalconDeployment	Deploys FalconAdmission, FalconImageAnalyzer, FalconContainer, and FalconNodeSensor CRs from a single manifest

Installation and Deployment

For installation and deployment of the CrowdStrike Falcon Operator and its Custom Resources, please read the Installation and Deployment Guide and choose the deployment method that is right for your target environment.

Getting Help

If you encounter any issues while using the Falcon Operator, you can create an issue on our Github repo for bugs, enhancements, or other requests.

Contributing

You can contribute by:

• Raising any issues you find using Falcon Operator
• Fixing issues by opening Pull Requests
• Improving documentation
• Talking about the CrowdStrike Falcon Operator

All bugs, tasks or enhancements are tracked as GitHub issues.

Support

The CrowdStrike Falcon Operator is an open source project maintained by CrowdStrike. CrowdStrike will support use of falcon-operator in connection with the use of CrowdStrike’s products pursuant to applicable terms in the license for such product.

Learn how to get help, where to submit requests, and more here

Additional Resources

• CrowdStrike Container Security: Product Page
• So You Think Your Containers Are Secure? Four Steps to Ensure a Secure Container Deployment: Blog Post
• Container Security With CrowdStrike: Blog Post
• To learn more about Falcon Container Sensor for Linux: Deployment Guide, Release Notes
• To learn more about Falcon Sensor for Linux: Deployment Guide
• Developer Documentation