|
| 1 | +#!/bin/bash |
| 2 | +: <<'#DESCRIPTION#' |
| 3 | +File: falcon-container-sensor-pull.sh |
| 4 | +Description: Bash script to pull Falcon DaemonSet & Container Sensor images from CrowdStrike Container Registry. |
| 5 | +#DESCRIPTION# |
| 6 | + |
| 7 | +usage() |
| 8 | +{ |
| 9 | + echo "usage: |
| 10 | +$0 \\ |
| 11 | + -f | --cid <FALCONCID> \\ |
| 12 | + -u | --clientid <FALCONCLIENTID> \\ |
| 13 | + -s | --clientsecret <FALCONCLIENTSECRET> \\ |
| 14 | + -r | --region <FALCONREGION> \\ |
| 15 | + -n | --node (OPTIONAL FLAG) tells script to download node sensor instead of container sensor \\ |
| 16 | + -g | --gov (OPTIONAL FLAG) tells the script to use Gov Cloud endpoints |
| 17 | + -h | --help display this help message" |
| 18 | + exit 2 |
| 19 | +} |
| 20 | + |
| 21 | +while (( "$#" )); do |
| 22 | +case "$1" in |
| 23 | + -u|--clientid) |
| 24 | + if [[ -n ${2:-} ]] ; then |
| 25 | + CS_CLIENT_ID="$2" |
| 26 | + shift |
| 27 | + fi |
| 28 | + ;; |
| 29 | + -s|--clientsecret) |
| 30 | + if [[ -n ${2:-} ]]; then |
| 31 | + CS_CLIENT_SECRET="$2" |
| 32 | + shift |
| 33 | + fi |
| 34 | + ;; |
| 35 | + -r|--region) |
| 36 | + if [[ -n ${2:-} ]]; then |
| 37 | + CS_REGION="$2" |
| 38 | + shift |
| 39 | + fi |
| 40 | + ;; |
| 41 | + -f|--cid) |
| 42 | + if [[ -n ${2:-} ]]; then |
| 43 | + CID="$2" |
| 44 | + shift |
| 45 | + fi |
| 46 | + ;; |
| 47 | + -n|--node) |
| 48 | + if [[ -n ${1} ]]; then |
| 49 | + NODE=true |
| 50 | + fi |
| 51 | + ;; |
| 52 | + -g|--gov) |
| 53 | + if [[ -n ${1} ]]; then |
| 54 | + GOV=true |
| 55 | + fi |
| 56 | + ;; |
| 57 | + -h|--help) |
| 58 | + if [[ -n ${1} ]]; then |
| 59 | + usage |
| 60 | + fi |
| 61 | + ;; |
| 62 | + --) # end argument parsing |
| 63 | + shift |
| 64 | + break |
| 65 | + ;; |
| 66 | + -*) # unsupported flags |
| 67 | + >&2 echo "ERROR: Unsupported flag: '$1'" |
| 68 | + usage |
| 69 | + exit 1 |
| 70 | + ;; |
| 71 | +esac |
| 72 | +shift |
| 73 | +done |
| 74 | + |
| 75 | +#Check all mandatory variables set |
| 76 | +VARIABLES=(CID CS_CLIENT_ID CS_CLIENT_SECRET) |
| 77 | +{ |
| 78 | + for VAR_NAME in "${VARIABLES[@]}"; do |
| 79 | + [ -z "${!VAR_NAME}" ] && echo "$VAR_NAME is unset refer to help to set" && VAR_UNSET=true |
| 80 | + done |
| 81 | + [ -n "$VAR_UNSET" ] && usage |
| 82 | +} |
| 83 | + |
| 84 | +#Check if GOVCLOUD flag setup regions |
| 85 | +if [[ $GOV = true ]]; then |
| 86 | + echo "GovCloud flag set, using govcloud endpoints" |
| 87 | + REGION="govcloud" |
| 88 | + API="api.laggar.gcw" |
| 89 | + REGISTRY="registry.laggar.gcw" |
| 90 | + echo "Using Falcon API endpoint of ${API}.crowdstrike.com and Registry endpoint of ${REGISTRY}.crowdstrike.com" |
| 91 | +elif [[ -z "${CS_REGION}" ]] || [[ "${CS_REGION}" = "US-1" ]] || [[ "${CS_REGION}" = "us-1" ]]; then |
| 92 | + REGION="us-1" |
| 93 | + API="api" |
| 94 | + REGISTRY="registry" |
| 95 | + echo "Using Falcon API endpoint of ${API}.crowdstrike.com and Registry endpoint of ${REGISTRY}.crowdstrike.com" |
| 96 | +else |
| 97 | + REGION=$(echo "${CS_REGION}" | tr '[:upper:]' '[:lower:]') #Convert to lowercase if user entered as UPPERCASE |
| 98 | + API="api.${REGION}" |
| 99 | + REGISTRY="registry" |
| 100 | + echo "Using Falcon API endpoint of ${API}.crowdstrike.com and Registry endpoint of ${REGISTRY}.crowdstrike.com" |
| 101 | +fi |
| 102 | + |
| 103 | +#Convert CID to lowercase and remove checksum if present |
| 104 | +CIDLOWER=$(echo "${CID}" | cut -d'-' -f1 | tr '[:upper:]' '[:lower:]') |
| 105 | + |
| 106 | +#Get Bearer token to use with registry credentials api endpoint |
| 107 | +BEARER=$(curl \ |
| 108 | +--data "client_id=${CS_CLIENT_ID}&client_secret=${CS_CLIENT_SECRET}" \ |
| 109 | +--request POST \ |
| 110 | +--silent \ |
| 111 | +https://"${API}".crowdstrike.com/oauth2/token | jq -r '.access_token') |
| 112 | + |
| 113 | +#Set Docker token using the BEARER token captured earlier |
| 114 | +ART_PASSWORD=$(curl -s -X GET -H "authorization: Bearer ${BEARER}" \ |
| 115 | +https://"${API}".crowdstrike.com/container-security/entities/image-registry-credentials/v1 | \ |
| 116 | +jq -r '.resources[].token') |
| 117 | + |
| 118 | +#Set docker login |
| 119 | +docker login --username "fc-${CIDLOWER}" --password "${ART_PASSWORD}" $REGISTRY.crowdstrike.com |
| 120 | + |
| 121 | +#Check if user wants to download DaemonSet Node Sensor |
| 122 | +if [[ $NODE = true ]]; then |
| 123 | + SENSORTYPE="falcon-sensor" |
| 124 | +else |
| 125 | + SENSORTYPE="falcon-container" |
| 126 | +fi |
| 127 | + |
| 128 | +#Get BEARER token for Registry |
| 129 | +REGISTRYBEARER=$(curl -X GET -s -u "fc-${CIDLOWER}:${ART_PASSWORD}" "https://$REGISTRY.crowdstrike.com/v2/token?=fc-${CIDLOWER}&scope=repository:$SENSORTYPE/$REGION/release/falcon-sensor:pull&service=registry.crowdstrike.com" | jq -r '.token') |
| 130 | +#Get latest sensor version |
| 131 | +LATESTSENSOR=$(curl -X GET -s -H "authorization: Bearer ${REGISTRYBEARER}" "https://$REGISTRY.crowdstrike.com/v2/$SENSORTYPE/$REGION/release/falcon-sensor/tags/list" | jq -r '.tags[-1]') |
| 132 | +#Construct full image path |
| 133 | +FULLIMAGEPATH="$REGISTRY.crowdstrike.com/$SENSORTYPE/${REGION}/release/falcon-sensor:${LATESTSENSOR}" |
| 134 | +#Pull the container image locally |
| 135 | +docker pull "${FULLIMAGEPATH}" |
0 commit comments