feat: support kubernetes tolerations for FalconAdmission and FalconImageAnalyzer
This PR adds support for kubernetes tolerations in the FalconAdmission and FalconImageAnalyzer CRDs.
Closes #654
This is blocking us from deploying Crowdstrike Falcon across all our Kubernetes clusters as we use tolerations in order to gate workloads to specific node groups.
Added e2e tests for deploying FalconAdmission, FalconImageAnalyzer and FalconNodeSensor with tolerations set.
@ivanaguilario Thanks for creating this. Can you please add the following:
- A check within the reconciler here for IAR to ensure that the the tolerations cause a reconciliation loop? GKE Autopilot and OpenShift will add tolerations with their mutators and since the Deployment is owned by the IAR controller it'll trigger another reconcile. It's not exactly a breaking change for all deployments but it will flood the logs and continuously spam the API server.
- The same as above but in KAC here.
The above can also be achieved by updating watches with predicates.
Hi there @gpontejos! Thanks for taking a look. Sorry for the late reply, got a bit busy the past few weeks.
I added the reconciler checks as requested. I saw there was already some similar work done so for consistency I took the same approach.
Let me know if anything else is needed.
Thanks!