From deee1c833ad82dfc6448fdb4dcb00de112663659 Mon Sep 17 00:00:00 2001 From: Carlos Matos Date: Mon, 16 Mar 2026 13:38:12 -0400 Subject: [PATCH 1/6] feat(container-pull): add version channel selector (latest, N-1, N-2, LTS, LTS-1) Allow users to pull images by release channel keyword via the existing -v/--version flag instead of requiring exact version numbers. Channel keywords are resolved from registry tag data with no new API calls. --- .../falcon-container-sensor-pull/README.md | 51 ++++++- .../falcon-container-sensor-pull.sh | 125 ++++++++++++++++-- 2 files changed, 164 insertions(+), 12 deletions(-) diff --git a/bash/containers/falcon-container-sensor-pull/README.md b/bash/containers/falcon-container-sensor-pull/README.md index 73ef137..3e36d4e 100644 --- a/bash/containers/falcon-container-sensor-pull/README.md +++ b/bash/containers/falcon-container-sensor-pull/README.md @@ -102,6 +102,16 @@ Optional Flags: By default, the image name and tag are appended. Use --copy-omit-image-name and/or --copy-custom-tag to change that behavior. -v, --version Specify sensor version to retrieve from the registry + + Accepts version strings or channel keywords: + ------------------------------------------- + latest Latest sensor version (default) + N-1 Previous major.minor release + N-2 Two major.minor releases back + LTS Latest LTS release + LTS-1 Previous LTS release + 7.33 Latest build of version 7.33.x + 7.33.0-18606 Specific sensor build -p, --platform Specify sensor platform to retrieve, e.g., x86_64, aarch64 -t, --type Specify which sensor to download (Default: falcon-container) @@ -148,7 +158,7 @@ Help Options: | `-s`, `--client-secret ` | `$FALCON_CLIENT_SECRET` | `None` (Required) | CrowdStrike API Client Secret | | `-r`, `--region ` | `$FALCON_CLOUD` | `us-1` (Optional) | CrowdStrike Region.
\**Auto-discovery is only available for [`us-1, us-2, us-3, eu-1`] regions.* | | `-c`, `--copy ` | `$COPY` | `None` (Optional) | Registry you want to copy the sensor image to. Example: `myregistry.com/mynamespace`.
*\*By default, the image name and tag are appended. Use `--copy-omit-image-name` and/or `--copy-custom-tag` to change that behavior.* | -| `-v`, `--version ` | `$SENSOR_VERSION` | `None` (Optional) | Specify sensor version to retrieve from the registry | +| `-v`, `--version ` | `$SENSOR_VERSION` | `None` (Optional) | Specify sensor version to retrieve from the registry. Accepts version strings (e.g., `7.33`, `7.33.0`) or channel keywords: `latest`, `N-1`, `N-2`, `LTS`, `LTS-1` | | `-p`, `--platform ` | `$SENSOR_PLATFORM` | `None` (Optional) | Specify sensor platform to retrieve from the registry | | `-t`, `--type ` | `$SENSOR_TYPE` | `falcon-container` (Optional) | Specify which sensor to download [`falcon-container`, `falcon-container-regional`, `falcon-sensor`, `falcon-sensor-regional`, `falcon-kac`, `falcon-kac-regional`, `falcon-snapshot`, `falcon-imageanalyzer`, `falcon-imageanalyzer-regional`, `fcs`, `falcon-jobcontroller`, `falcon-registryassessmentexecutor`] ([see more details below](#sensor-types)) | | `--runtime` | `$CONTAINER_TOOL` | `docker` (Optional) | Use a different container runtime [docker, podman, skopeo]. **Default is Docker**. | @@ -190,6 +200,45 @@ The following sensor types are available to download: | `falcon-jobcontroller` | The Self Hosted Registry Assessment Jobs Controller | | `falcon-registryassessmentexecutor` | The Self Hosted Registry Assessment Executor | +### Version Channels + +The `-v, --version` flag accepts channel keywords for policy-driven deployments without needing to know exact version numbers: + +| Keyword | Description | +| :------- | :---------------------------------- | +| `latest` | Latest sensor version (default) | +| `N-1` | Previous major.minor release | +| `N-2` | Two major.minor releases back | +| `LTS` | Latest LTS release | +| `LTS-1` | Previous LTS release | + +Channel keywords are case-insensitive (`n-1`, `N-1`, `lts`, `LTS` all work). N-1/N-2 exclude LTS tags from consideration. No additional API scopes are required — channels are resolved entirely from existing registry tag data. + +```shell +# Pull latest (default behavior) +./falcon-container-sensor-pull.sh \ +--client-id \ +--client-secret + +# Pull the previous major.minor release (N-1) +./falcon-container-sensor-pull.sh \ +--client-id \ +--client-secret \ +--version N-1 + +# Pull the latest LTS release +./falcon-container-sensor-pull.sh \ +--client-id \ +--client-secret \ +--version LTS + +# Pull the previous LTS release +./falcon-container-sensor-pull.sh \ +--client-id \ +--client-secret \ +--version LTS-1 +``` + ### Examples #### Example downloading the Falcon Kubernetes Admission Controller diff --git a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh index 1ef62f4..0012928 100755 --- a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh +++ b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh @@ -23,6 +23,17 @@ Optional Flags: By default, the image name and tag are appended. Use --copy-omit-image-name and/or --copy-custom-tag to change that behavior. -v, --version Specify sensor version to retrieve from the registry + + Accepts version strings or channel keywords: + ------------------------------------------- + latest Latest sensor version (default) + N-1 Previous major.minor release + N-2 Two major.minor releases back + LTS Latest LTS release + LTS-1 Previous LTS release + 7.33 Latest build of version 7.33.x + 7.33.0-18606 Specific sensor build + -p, --platform Specify sensor platform to retrieve, e.g., x86_64, aarch64 -t, --type Specify which sensor to download (Default: falcon-container) @@ -456,6 +467,94 @@ display_api_scopes() { esac } +# Extract clean tag strings from list_tags JSON output +extract_raw_tags() { + list_tags | awk ' + /^[[:space:]]*"[0-9]/ { + gsub(/^[[:space:]]*"/, "") + gsub(/"[[:space:]]*,?[[:space:]]*$/, "") + if (length($0) > 0) print $0 + } + ' +} + +# Resolve version channel keywords (latest, N-1, N-2, LTS, LTS-1) to version prefixes +resolve_version_channel() { + local input="$1" + local normalized all_tags major_minor_versions lts_tags lts_versions target_version + + normalized=$(echo "$input" | tr '[:upper:]' '[:lower:]') + + case "$normalized" in + latest) + echo "" + return 0 + ;; + n-1|n-2|lts|lts-1) + all_tags=$(extract_raw_tags) + if [ -z "$all_tags" ]; then + echo "Fatal error: No tags found for sensor type: ${SENSOR_TYPE}" >&2 + return 1 + fi + ;; + *) + # Not a channel keyword — pass through as-is + echo "$input" + return 0 + ;; + esac + + case "$normalized" in + n-1) + major_minor_versions=$(echo "$all_tags" | grep -v "\-LTS" | \ + awk -F'.' '{ print $1"."$2 }' | sort -u -V) + if [ "$(echo "$major_minor_versions" | wc -l)" -lt 2 ]; then + echo "Fatal error: Not enough versions available for N-1. Only $(echo "$major_minor_versions" | wc -l | tr -d ' ') major.minor version(s) found." >&2 + return 1 + fi + target_version=$(echo "$major_minor_versions" | tail -2 | head -1) + ;; + n-2) + major_minor_versions=$(echo "$all_tags" | grep -v "\-LTS" | \ + awk -F'.' '{ print $1"."$2 }' | sort -u -V) + if [ "$(echo "$major_minor_versions" | wc -l)" -lt 3 ]; then + echo "Fatal error: Not enough versions available for N-2. Only $(echo "$major_minor_versions" | wc -l | tr -d ' ') major.minor version(s) found." >&2 + return 1 + fi + target_version=$(echo "$major_minor_versions" | tail -3 | head -1) + ;; + lts) + lts_tags=$(echo "$all_tags" | grep "\-LTS") + if [ -z "$lts_tags" ]; then + echo "Fatal error: No LTS versions found for sensor type: ${SENSOR_TYPE}" >&2 + return 1 + fi + lts_versions=$(echo "$lts_tags" | awk -F'.' '{ print $1"."$2 }' | sort -u -V) + target_version=$(echo "$lts_versions" | tail -1) + ;; + lts-1) + lts_tags=$(echo "$all_tags" | grep "\-LTS") + if [ -z "$lts_tags" ]; then + echo "Fatal error: No LTS versions found for sensor type: ${SENSOR_TYPE}" >&2 + return 1 + fi + lts_versions=$(echo "$lts_tags" | awk -F'.' '{ print $1"."$2 }' | sort -u -V) + if [ "$(echo "$lts_versions" | wc -l)" -lt 2 ]; then + echo "Fatal error: Not enough LTS versions available for LTS-1. Only $(echo "$lts_versions" | wc -l | tr -d ' ') LTS version(s) found." >&2 + return 1 + fi + target_version=$(echo "$lts_versions" | tail -2 | head -1) + ;; + esac + + if [ -z "$target_version" ]; then + return 1 + fi + + echo "$target_version" + return 0 +} + # Smart version matching function match_sensor_version() { local requested_version="$1" @@ -464,14 +563,7 @@ match_sensor_version() { local version_pattern # Get all available tags by properly parsing JSON output from list_tags - all_tags=$(list_tags | awk ' - /^[[:space:]]*"[0-9]/ { - # Extract quoted tag (lines starting with version numbers), remove surrounding quotes and whitespace - gsub(/^[[:space:]]*"/, "") - gsub(/"[[:space:]]*,?[[:space:]]*$/, "") - if (length($0) > 0) print $0 - } - ') + all_tags=$(extract_raw_tags) if [ -z "$requested_version" ]; then # If no version specified, get the latest version @@ -860,9 +952,19 @@ if [ "${ERROR}" = "true" ]; then fi #Get latest sensor version -set +e # Temporarily disable exit-on-error for version matching -LATESTSENSOR=$(match_sensor_version "$SENSOR_VERSION") -set -e # Re-enable exit-on-error +# Resolve channel keywords (latest, N-1, N-2, LTS, LTS-1) to version prefixes +set +e +RESOLVED_VERSION=$(resolve_version_channel "$SENSOR_VERSION") +CHANNEL_STATUS=$? +set -e + +if [ $CHANNEL_STATUS -ne 0 ]; then + exit 1 # error message already printed to stderr by resolve_version_channel +fi + +set +e # Temporarily disable exit-on-error for version matching +LATESTSENSOR=$(match_sensor_version "$RESOLVED_VERSION") +set -e # Re-enable exit-on-error # Check if version matching was successful if [ -z "$LATESTSENSOR" ]; then @@ -871,6 +973,7 @@ if [ -z "$LATESTSENSOR" ]; then Available versions can be listed with: $0 --list-tags -t ${SENSOR_TYPE} Tips for version matching: + - Use channel keywords: -v latest, -v N-1, -v N-2, -v LTS, -v LTS-1 - Use exact version: -v 7.31.0 - Use partial version: -v 7.31 (matches latest 7.31.x) - Use major version: -v 7 (matches latest 7.x.x) From 9bfecca7c95c8efd0d3122c315dddf528e269d29 Mon Sep 17 00:00:00 2001 From: Carlos Matos Date: Mon, 16 Mar 2026 13:44:23 -0400 Subject: [PATCH 2/6] fix(container-pull): use die() in resolve_version_channel for cleaner error handling Replace echo-to-stderr + return 1 with die() calls, and remove the set +e / CHANNEL_STATUS boilerplate in the caller. die() prints to stderr (not captured by $()) and exit 1 propagates via set -e. --- .../falcon-container-sensor-pull.sh | 32 +++++++------------ 1 file changed, 11 insertions(+), 21 deletions(-) diff --git a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh index 0012928..1ff05e3 100755 --- a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh +++ b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh @@ -493,8 +493,7 @@ resolve_version_channel() { n-1|n-2|lts|lts-1) all_tags=$(extract_raw_tags) if [ -z "$all_tags" ]; then - echo "Fatal error: No tags found for sensor type: ${SENSOR_TYPE}" >&2 - return 1 + die "No tags found for sensor type: ${SENSOR_TYPE}" fi ;; *) @@ -509,8 +508,7 @@ resolve_version_channel() { major_minor_versions=$(echo "$all_tags" | grep -v "\-LTS" | \ awk -F'.' '{ print $1"."$2 }' | sort -u -V) if [ "$(echo "$major_minor_versions" | wc -l)" -lt 2 ]; then - echo "Fatal error: Not enough versions available for N-1. Only $(echo "$major_minor_versions" | wc -l | tr -d ' ') major.minor version(s) found." >&2 - return 1 + die "Not enough versions available for N-1. Only $(echo "$major_minor_versions" | wc -l | tr -d ' ') major.minor version(s) found." fi target_version=$(echo "$major_minor_versions" | tail -2 | head -1) ;; @@ -518,16 +516,14 @@ resolve_version_channel() { major_minor_versions=$(echo "$all_tags" | grep -v "\-LTS" | \ awk -F'.' '{ print $1"."$2 }' | sort -u -V) if [ "$(echo "$major_minor_versions" | wc -l)" -lt 3 ]; then - echo "Fatal error: Not enough versions available for N-2. Only $(echo "$major_minor_versions" | wc -l | tr -d ' ') major.minor version(s) found." >&2 - return 1 + die "Not enough versions available for N-2. Only $(echo "$major_minor_versions" | wc -l | tr -d ' ') major.minor version(s) found." fi target_version=$(echo "$major_minor_versions" | tail -3 | head -1) ;; lts) lts_tags=$(echo "$all_tags" | grep "\-LTS") if [ -z "$lts_tags" ]; then - echo "Fatal error: No LTS versions found for sensor type: ${SENSOR_TYPE}" >&2 - return 1 + die "No LTS versions found for sensor type: ${SENSOR_TYPE}" fi lts_versions=$(echo "$lts_tags" | awk -F'.' '{ print $1"."$2 }' | sort -u -V) target_version=$(echo "$lts_versions" | tail -1) @@ -535,13 +531,11 @@ resolve_version_channel() { lts-1) lts_tags=$(echo "$all_tags" | grep "\-LTS") if [ -z "$lts_tags" ]; then - echo "Fatal error: No LTS versions found for sensor type: ${SENSOR_TYPE}" >&2 - return 1 + die "No LTS versions found for sensor type: ${SENSOR_TYPE}" fi lts_versions=$(echo "$lts_tags" | awk -F'.' '{ print $1"."$2 }' | sort -u -V) if [ "$(echo "$lts_versions" | wc -l)" -lt 2 ]; then - echo "Fatal error: Not enough LTS versions available for LTS-1. Only $(echo "$lts_versions" | wc -l | tr -d ' ') LTS version(s) found." >&2 - return 1 + die "Not enough LTS versions available for LTS-1. Only $(echo "$lts_versions" | wc -l | tr -d ' ') LTS version(s) found." fi target_version=$(echo "$lts_versions" | tail -2 | head -1) ;; @@ -952,17 +946,13 @@ if [ "${ERROR}" = "true" ]; then fi #Get latest sensor version -# Resolve channel keywords (latest, N-1, N-2, LTS, LTS-1) to version prefixes -set +e +# Resolve channel keywords (latest, N-1, N-2, LTS, LTS-1) to version prefixes. +# die() inside resolve_version_channel exits the subshell with code 1; +# set -e (active since line 7) propagates that to the parent script. RESOLVED_VERSION=$(resolve_version_channel "$SENSOR_VERSION") -CHANNEL_STATUS=$? -set -e -if [ $CHANNEL_STATUS -ne 0 ]; then - exit 1 # error message already printed to stderr by resolve_version_channel -fi - -set +e # Temporarily disable exit-on-error for version matching +# match_sensor_version returns 1 for "no match" — a soft failure we handle below. +set +e LATESTSENSOR=$(match_sensor_version "$RESOLVED_VERSION") set -e # Re-enable exit-on-error From 7018ff5b4b7a1871c11a4fb0a65b1718a63846d6 Mon Sep 17 00:00:00 2001 From: Carlos Matos Date: Mon, 16 Mar 2026 13:50:31 -0400 Subject: [PATCH 3/6] chore(container-pull): clean up version resolution comments --- .../falcon-container-sensor-pull.sh | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh index 1ff05e3..779bbf0 100755 --- a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh +++ b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh @@ -945,12 +945,10 @@ if [ "${ERROR}" = "true" ]; then die "ERROR: ${CONTAINER_TOOL} login failed. Error message: ${error_message}" fi -#Get latest sensor version # Resolve channel keywords (latest, N-1, N-2, LTS, LTS-1) to version prefixes. -# die() inside resolve_version_channel exits the subshell with code 1; -# set -e (active since line 7) propagates that to the parent script. RESOLVED_VERSION=$(resolve_version_channel "$SENSOR_VERSION") +# Get latest sensor version # match_sensor_version returns 1 for "no match" — a soft failure we handle below. set +e LATESTSENSOR=$(match_sensor_version "$RESOLVED_VERSION") From 52a35778dc319e10645020a5e6a342d276c9f729 Mon Sep 17 00:00:00 2001 From: Carlos Matos Date: Mon, 16 Mar 2026 14:00:08 -0400 Subject: [PATCH 4/6] style(container-pull): apply shfmt formatting fixes --- .../falcon-container-sensor-pull.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh index 779bbf0..6befacf 100755 --- a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh +++ b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh @@ -490,7 +490,7 @@ resolve_version_channel() { echo "" return 0 ;; - n-1|n-2|lts|lts-1) + n-1 | n-2 | lts | lts-1) all_tags=$(extract_raw_tags) if [ -z "$all_tags" ]; then die "No tags found for sensor type: ${SENSOR_TYPE}" @@ -505,7 +505,7 @@ resolve_version_channel() { case "$normalized" in n-1) - major_minor_versions=$(echo "$all_tags" | grep -v "\-LTS" | \ + major_minor_versions=$(echo "$all_tags" | grep -v "\-LTS" | awk -F'.' '{ print $1"."$2 }' | sort -u -V) if [ "$(echo "$major_minor_versions" | wc -l)" -lt 2 ]; then die "Not enough versions available for N-1. Only $(echo "$major_minor_versions" | wc -l | tr -d ' ') major.minor version(s) found." @@ -513,7 +513,7 @@ resolve_version_channel() { target_version=$(echo "$major_minor_versions" | tail -2 | head -1) ;; n-2) - major_minor_versions=$(echo "$all_tags" | grep -v "\-LTS" | \ + major_minor_versions=$(echo "$all_tags" | grep -v "\-LTS" | awk -F'.' '{ print $1"."$2 }' | sort -u -V) if [ "$(echo "$major_minor_versions" | wc -l)" -lt 3 ]; then die "Not enough versions available for N-2. Only $(echo "$major_minor_versions" | wc -l | tr -d ' ') major.minor version(s) found." @@ -952,7 +952,7 @@ RESOLVED_VERSION=$(resolve_version_channel "$SENSOR_VERSION") # match_sensor_version returns 1 for "no match" — a soft failure we handle below. set +e LATESTSENSOR=$(match_sensor_version "$RESOLVED_VERSION") -set -e # Re-enable exit-on-error +set -e # Re-enable exit-on-error # Check if version matching was successful if [ -z "$LATESTSENSOR" ]; then From 85892882d48966a51ac8f62269ea89c22ad36058 Mon Sep 17 00:00:00 2001 From: Carlos Matos Date: Mon, 8 Jun 2026 20:39:19 -0400 Subject: [PATCH 5/6] fix(container-pull): fix LTS case sensitivity and return LTS-tagged image The registry uses lowercase "-lts" suffix on LTS tags (e.g. 7.32.0-18504-1-lts), but the version channel resolver was grepping for uppercase "-LTS", causing LTS/LTS-1 to always die with "No LTS versions found" and the N-1/N-2 exclusion to silently leak LTS tags into the candidate list. Also changes LTS/LTS-1 resolution to return the full "-lts" tagged image directly rather than extracting the major.minor prefix, which previously caused match_sensor_version to select the latest non-LTS build of that line instead of the designated LTS build. --- .../falcon-container-sensor-pull.sh | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh index 6befacf..ce92e4a 100755 --- a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh +++ b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh @@ -505,7 +505,7 @@ resolve_version_channel() { case "$normalized" in n-1) - major_minor_versions=$(echo "$all_tags" | grep -v "\-LTS" | + major_minor_versions=$(echo "$all_tags" | grep -iv -- "-lts" | awk -F'.' '{ print $1"."$2 }' | sort -u -V) if [ "$(echo "$major_minor_versions" | wc -l)" -lt 2 ]; then die "Not enough versions available for N-1. Only $(echo "$major_minor_versions" | wc -l | tr -d ' ') major.minor version(s) found." @@ -513,7 +513,7 @@ resolve_version_channel() { target_version=$(echo "$major_minor_versions" | tail -2 | head -1) ;; n-2) - major_minor_versions=$(echo "$all_tags" | grep -v "\-LTS" | + major_minor_versions=$(echo "$all_tags" | grep -iv -- "-lts" | awk -F'.' '{ print $1"."$2 }' | sort -u -V) if [ "$(echo "$major_minor_versions" | wc -l)" -lt 3 ]; then die "Not enough versions available for N-2. Only $(echo "$major_minor_versions" | wc -l | tr -d ' ') major.minor version(s) found." @@ -521,15 +521,16 @@ resolve_version_channel() { target_version=$(echo "$major_minor_versions" | tail -3 | head -1) ;; lts) - lts_tags=$(echo "$all_tags" | grep "\-LTS") + lts_tags=$(echo "$all_tags" | grep -i -- "-lts") if [ -z "$lts_tags" ]; then die "No LTS versions found for sensor type: ${SENSOR_TYPE}" fi lts_versions=$(echo "$lts_tags" | awk -F'.' '{ print $1"."$2 }' | sort -u -V) - target_version=$(echo "$lts_versions" | tail -1) + lts_line=$(echo "$lts_versions" | tail -1) + target_version=$(echo "$lts_tags" | grep "^${lts_line}\." | sort -V | tail -1) ;; lts-1) - lts_tags=$(echo "$all_tags" | grep "\-LTS") + lts_tags=$(echo "$all_tags" | grep -i -- "-lts") if [ -z "$lts_tags" ]; then die "No LTS versions found for sensor type: ${SENSOR_TYPE}" fi @@ -537,7 +538,8 @@ resolve_version_channel() { if [ "$(echo "$lts_versions" | wc -l)" -lt 2 ]; then die "Not enough LTS versions available for LTS-1. Only $(echo "$lts_versions" | wc -l | tr -d ' ') LTS version(s) found." fi - target_version=$(echo "$lts_versions" | tail -2 | head -1) + lts_line=$(echo "$lts_versions" | tail -2 | head -1) + target_version=$(echo "$lts_tags" | grep "^${lts_line}\." | sort -V | tail -1) ;; esac From 86f159d3bbd0d0c0fb05d335c84bb1704ab04a22 Mon Sep 17 00:00:00 2001 From: Carlos Matos Date: Fri, 24 Jul 2026 10:57:55 -0400 Subject: [PATCH 6/6] docs(container-pull): reword N-1/N-2, note LTS availability, add channel examples Reword N-1/N-2 descriptions to generic "one/two releases prior to the latest" phrasing in both usage help and README. Add a note that LTS tags are not yet published to the registry, and add two examples showing channel keywords in automation (N-1 image-path pinning) and registry mirroring (LTS copy) workflows. --- .../falcon-container-sensor-pull/README.md | 44 ++++++++++++++++--- .../falcon-container-sensor-pull.sh | 4 +- 2 files changed, 41 insertions(+), 7 deletions(-) diff --git a/bash/containers/falcon-container-sensor-pull/README.md b/bash/containers/falcon-container-sensor-pull/README.md index 3e36d4e..fcdb61d 100644 --- a/bash/containers/falcon-container-sensor-pull/README.md +++ b/bash/containers/falcon-container-sensor-pull/README.md @@ -106,8 +106,8 @@ Optional Flags: Accepts version strings or channel keywords: ------------------------------------------- latest Latest sensor version (default) - N-1 Previous major.minor release - N-2 Two major.minor releases back + N-1 One release prior to the latest + N-2 Two releases prior to the latest LTS Latest LTS release LTS-1 Previous LTS release 7.33 Latest build of version 7.33.x @@ -207,12 +207,15 @@ The `-v, --version` flag accepts channel keywords for policy-driven deployments | Keyword | Description | | :------- | :---------------------------------- | | `latest` | Latest sensor version (default) | -| `N-1` | Previous major.minor release | -| `N-2` | Two major.minor releases back | +| `N-1` | One release prior to the latest | +| `N-2` | Two releases prior to the latest | | `LTS` | Latest LTS release | | `LTS-1` | Previous LTS release | -Channel keywords are case-insensitive (`n-1`, `N-1`, `lts`, `LTS` all work). N-1/N-2 exclude LTS tags from consideration. No additional API scopes are required — channels are resolved entirely from existing registry tag data. +Channel keywords are case-insensitive (`n-1`, `N-1`, `lts`, `LTS` all work). N-1/N-2 step back through releases and exclude LTS tags from consideration. No additional API scopes are required — channels are resolved entirely from existing registry tag data. + +> [!NOTE] +> LTS (Long Term Support) sensor release tags are not yet generally available. The `LTS` and `LTS-1` keywords are included ahead of that release and will return an error until LTS-tagged images are published to the registry. ```shell # Pull latest (default behavior) @@ -280,6 +283,37 @@ The following example will print the image repository path with the latest image Example output: `registry.crowdstrike.com/falcon-sensor/us-1/release/falcon-sensor:7.29.0-15501-1.falcon-linux.Release.US-1` +#### Example pinning to a version channel for automation + +Channel keywords are useful in CI/CD or GitOps pipelines where you want to track a release channel without hardcoding version numbers. The following example resolves the N-1 channel to a concrete image path that can be pinned into a Kubernetes manifest or Helm value. + +```shell +./falcon-container-sensor-pull.sh \ +--client-id \ +--client-secret \ +--type falcon-sensor \ +--version N-1 \ +--get-image-path +``` + +Example output: `registry.crowdstrike.com/falcon-sensor/release/falcon-sensor:7.30.0-15400-1` + +#### Example mirroring a version channel to another registry + +The following example resolves the latest LTS release and copies it to an internal registry, so downstream consumers pull from a controlled mirror. + +> [!NOTE] +> LTS tags may not yet be available in the registry. See the [Version Channels](#version-channels) note above for details. + +```shell +./falcon-container-sensor-pull.sh \ +--client-id \ +--client-secret \ +--type falcon-sensor \ +--version LTS \ +--copy myregistry.com/mynamespace +``` + #### Example downloading the Falcon DaemonSet sensor (unified) The following example will download the latest version of the Falcon DaemonSet sensor container image using the unified sensor and copy it to another registry. diff --git a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh index ce92e4a..ad176aa 100755 --- a/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh +++ b/bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh @@ -27,8 +27,8 @@ Optional Flags: Accepts version strings or channel keywords: ------------------------------------------- latest Latest sensor version (default) - N-1 Previous major.minor release - N-2 Two major.minor releases back + N-1 One release prior to the latest + N-2 Two releases prior to the latest LTS Latest LTS release LTS-1 Previous LTS release 7.33 Latest build of version 7.33.x