Is Talos Linux v.1.10.x supported by the falcon-operator and falcon node sensor?

[BlueJay909]

I installed the falcon-operator and CRDs and I have obtained the sensor image (7.26.0-17905-1.falcon-linux.Release.EU-1) and the CID using the api key with the correct permissions.

I copied the node sensor image to my internal harbor registry, I deployed the deamonset like this:

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: falcon.crowdstrike.com/v1alpha1
kind: FalconNodeSensor
metadata:
  labels:
    crowdstrike.com/component: sample
    crowdstrike.com/created-by: falcon-operator
    crowdstrike.com/instance: falcon-node-sensor
    crowdstrike.com/managed-by: kustomize
    crowdstrike.com/name: falconnodesensor
    crowdstrike.com/part-of: Falcon
    crowdstrike.com/provider: crowdstrike
  name: falcon-node-sensor
spec:
  falcon:
    tags:
    - daemonset
    trace: debug
    aph: "dummy"
    app: dummy
    cid: dummy
  node:
    image: dummy.net/falcon/falcon-sensor:7.26.0-17905-1.falcon-linux.Release.EU-1
    imagePullSecrets:
      - name: dummy-secret

I get those debug errors in the sensor pods:

Wed Jun 25 16:23:04 2025 Invalid File Specified by the  unix:///run/crio/crio.sock	(3927) [0]
Wed Jun 25 16:23:04 2025 Failed to initialize container runtime endpoint	(3927) [0]
Wed Jun 25 16:23:04 2025 Failed to determine the path for ctr binary	(3927) [0]
Wed Jun 25 16:23:04 2025 Failed to Initialize	(3927) [0]
Wed Jun 25 16:23:04 2025 Get crictl command failed for pods	(3927) [0]

Of course my agent id is empty:

falconctl -g --aid 
aid is not set.

Is Talos supported and i'm doing something wrong?

[BlueJay909]

I even tried with Talos v1.9.4 and 7.24.0-17706-1.falcon-linux.Release.EU-1 and it still does not work... same issues, and this should be supported...

[redhatrises]

Please open a support case with CrowdStrike support. This repo is not a place to get support for the sensors. You need to at least be on 1.10 and have the ctr extension installed.

[BlueJay909]

Thanks for your reply!

I'm going to open a support ticket with them, it's not clear though, because in their latest release notes/article (a couple of days old) they shared this compatibility matrix: Talos v1.9.4 and 7.24.0-17706-1.falcon-linux.Release.EU-1 in "User mode" (i don't know what that means but i guess it refers to BPF) and no other versions are mentioned, not even the fact that you need the CTR extension. I will check with them and write an answer here so that it will remain as reference for other people. I tried with Talos 1.10.4 with the ctr extension and i still see the same compatibility issue, and it's not just a cosmetic issue:

bash-5.1# falcon-kernel-check
Host OS Linux 6.12.31-talos #1 SMP Tue Jun 10 11:58:23 UTC 2025 is not supported by Sensor version 17706.

[redhatrises]

IIRC falcon-kernel-check is for kernel module checking, and since Talos runs only in BPF, I imagine will always fail since Talos will only work in eBPF. So, you would want to check for rfm with the falconctl utility if not the console under Host Management.