diff --git a/helm-charts/falcon-kac/README.md b/helm-charts/falcon-kac/README.md index 21148b5f..4a06a823 100644 --- a/helm-charts/falcon-kac/README.md +++ b/helm-charts/falcon-kac/README.md @@ -219,4 +219,5 @@ The following tables lists the Falcon KAC configurable parameters and their defa | `falconSecret.enabled` | Enable k8s secrets to inject sensitive Falcon values | false (Must be true if falcon.cid is not set) | | `falconSecret.secretName` | Existing k8s secret name to inject sensitive Falcon values.
The secret must be under the same namespace as the KAC deployment. | None (Existing secret must include `FALCONCTL_OPT_CID`) | | `clusterName` | Manually set cluster name for self-hosted Kubernetes clusters where auto-discovery fails (e.g., MicroK8s). Displayed as hostname in Host Management UI. | None (auto-discovery used) | +| `priorityClassName` | Set the priorityClassName for the KAC pods to protect them from eviction under resource pressure. | `system-cluster-critical` | | `falconImageAnalyzerNamespace` | Falcon Image Analyzer namespace | falcon-image-analyzer | diff --git a/helm-charts/falcon-kac/templates/deployment_webhook.yaml b/helm-charts/falcon-kac/templates/deployment_webhook.yaml index 7c84afda..26cede2b 100644 --- a/helm-charts/falcon-kac/templates/deployment_webhook.yaml +++ b/helm-charts/falcon-kac/templates/deployment_webhook.yaml @@ -300,7 +300,7 @@ spec: name: crowdstrike-falcon-vol2 nodeSelector: kubernetes.io/os: linux - priorityClassName: system-cluster-critical + priorityClassName: {{ .Values.priorityClassName }} securityContext: seccompProfile: type: RuntimeDefault diff --git a/helm-charts/falcon-kac/templates/resourcequota.yaml b/helm-charts/falcon-kac/templates/resourcequota.yaml index bd8f3b96..7d130087 100644 --- a/helm-charts/falcon-kac/templates/resourcequota.yaml +++ b/helm-charts/falcon-kac/templates/resourcequota.yaml @@ -13,4 +13,4 @@ spec: - operator: In scopeName: PriorityClass values: - - system-cluster-critical + - {{ .Values.priorityClassName }} diff --git a/helm-charts/falcon-kac/values.schema.json b/helm-charts/falcon-kac/values.schema.json index cab84cb6..1423a8cb 100644 --- a/helm-charts/falcon-kac/values.schema.json +++ b/helm-charts/falcon-kac/values.schema.json @@ -427,6 +427,10 @@ "falconImageAnalyzerNamespace": { "type": "string", "default": "falcon-image-analyzer" + }, + "priorityClassName": { + "type": "string", + "default": "system-cluster-critical" } } } diff --git a/helm-charts/falcon-kac/values.yaml b/helm-charts/falcon-kac/values.yaml index 1bc66ba5..971b20c2 100644 --- a/helm-charts/falcon-kac/values.yaml +++ b/helm-charts/falcon-kac/values.yaml @@ -127,6 +127,10 @@ labels: {} # Annotations to apply to the webhook deployment podAnnotations: {} +# Set the priorityClassName for the KAC deployment. +# A priority class is required to protect KAC pods from eviction under resource pressure. +priorityClassName: system-cluster-critical + tolerations: [] affinity: