Add iar kac tolerations

api/falcon/v1alpha1/falconadmission_types.go

@@ -198,13 +198,18 @@ type FalconAdmissionConfigSpec struct {
 	ResourcesAC *corev1.ResourceRequirements `json:"resources,omitempty"`
 
 	// Type of Deployment update. Can be "RollingUpdate" or "OnDelete". Default is RollingUpdate.
-	// +kubebuilder:default:={"rollingUpdate":{"maxUnavailable":0,"maxSurge":1}}
+	// +kubebuilder:default:={}
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Deployment Update Strategy",order=11
 	DepUpdateStrategy FalconAdmissionUpdateStrategy `json:"updateStrategy,omitempty"`
 
 	// Specifies node affinity for scheduling the Admission Controller.
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=19
 	NodeAffinity *corev1.NodeAffinity `json:"nodeAffinity,omitempty"`
+
+	// Specifies tolerations for scheduling the Admission Controller.
+	// +kubebuilder:default:={}
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=20
+	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
 }
 
 type FalconAdmissionServiceAccount struct {
@@ -215,6 +220,7 @@ type FalconAdmissionServiceAccount struct {
 
 type FalconAdmissionUpdateStrategy struct {
 	// RollingUpdate is used to specify the strategy used to roll out a deployment
+	// +kubebuilder:default:={"maxUnavailable":0,"maxSurge":1}
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Falcon Admission Controller deployment update configuration",order=1,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:updateStrategy"}
 	RollingUpdate appsv1.RollingUpdateDeployment `json:"rollingUpdate,omitempty"`
 }

api/falcon/v1alpha1/falconimageanalyzer_types.go

@@ -55,9 +55,14 @@ type FalconImageAnalyzerSpec struct {
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Falcon Image Analyzer Version",order=7
 	Version *string `json:"version,omitempty"`
 
-	// Specifies node affinity for scheduling the Sensor.
+	// Specifies node affinity for scheduling the Falcon Image Analyzer Sensor.
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=8
 	NodeAffinity *corev1.NodeAffinity `json:"nodeAffinity,omitempty"`
+
+	// Specifies tolerations for scheduling the Falcon Image Analyzer Sensor.
+	// +kubebuilder:default:={}
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=9
+	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
 }
 
 type FalconImageAnalyzerConfigSpec struct {
@@ -85,7 +90,7 @@ type FalconImageAnalyzerConfigSpec struct {
 	PriorityClass FalconImageAnalyzerPriorityClass `json:"priorityClass,omitempty"`
 
 	// Type of Deployment update. Can be "RollingUpdate" or "OnDelete". Default is RollingUpdate.
-	// +kubebuilder:default:={"rollingUpdate":{"maxUnavailable":0,"maxSurge":1}}
+	// +kubebuilder:default:={}
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Deployment Update Strategy",order=7
 	DepUpdateStrategy FalconImageAnalyzerUpdateStrategy `json:"updateStrategy,omitempty"`
 
@@ -142,6 +147,7 @@ type FalconImageAnalyzerServiceAccount struct {
 
 type FalconImageAnalyzerUpdateStrategy struct {
 	// RollingUpdate is used to specify the strategy used to roll out a deployment
+	// +kubebuilder:default:={"maxUnavailable":0,"maxSurge":1}
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Falcon Image Analyzer deployment update configuration",order=1,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:updateStrategy"}
 	RollingUpdate appsv1.RollingUpdateDeployment `json:"rollingUpdate,omitempty"`
 }

api/falcon/v1alpha1/zz_generated.deepcopy.go

@@ -424,6 +424,13 @@ func (in *FalconAdmissionConfigSpec) DeepCopyInto(out *FalconAdmissionConfigSpec
 		*out = new(corev1.NodeAffinity)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.Tolerations != nil {
+		in, out := &in.Tolerations, &out.Tolerations
+		*out = make([]corev1.Toleration, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FalconAdmissionConfigSpec.
@@ -1208,6 +1215,13 @@ func (in *FalconImageAnalyzerSpec) DeepCopyInto(out *FalconImageAnalyzerSpec) {
 		*out = new(corev1.NodeAffinity)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.Tolerations != nil {
+		in, out := &in.Tolerations, &out.Tolerations
+		*out = make([]corev1.Toleration, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FalconImageAnalyzerSpec.

bundle/manifests/falcon-operator.clusterserviceversion.yaml

@@ -148,7 +148,7 @@ metadata:
     capabilities: Seamless Upgrades
     categories: Security,Monitoring
     containerImage: quay.io/crowdstrike/falcon-operator
-    createdAt: "2025-11-05T18:34:58Z"
+    createdAt: "2026-06-02T21:19:50Z"
     description: Falcon Operator installs CrowdStrike Falcon Sensors on the cluster
     features.operators.openshift.io/cnf: "false"
     features.operators.openshift.io/cni: "false"
@@ -431,6 +431,9 @@ spec:
           to know this to discover and communicate with IAR.
         displayName: Falcon Image Analyzer Namespace
         path: admissionConfig.falconImageAnalyzerNamespace
+      - description: Specifies tolerations for scheduling the Admission Controller.
+        displayName: Tolerations
+        path: admissionConfig.tolerations
       version: v1alpha1
     - description: FalconContainer is the Schema for the falconcontainers API
       displayName: Falcon Container
@@ -1429,7 +1432,8 @@ spec:
       - description: Set the falcon image analyzer volume size limit.
         displayName: Falcon Image Analyzer Volume Size Limit
         path: falconImageAnalyzer.imageAnalyzerConfig.sizeLimit
-      - description: Specifies node affinity for scheduling the Sensor.
+      - description: Specifies node affinity for scheduling the Falcon Image Analyzer
+          Sensor.
         displayName: Node Affinity
         path: falconImageAnalyzer.nodeAffinity
       - description: Utilize default or Pay-As-You-Go billing.
@@ -1458,6 +1462,10 @@ spec:
       - description: Set the falcon image analyzer volume mount path.
         displayName: Falcon Image Analyzer Volume Mount Path
         path: falconImageAnalyzer.imageAnalyzerConfig.mountPath
+      - description: Specifies tolerations for scheduling the Falcon Image Analyzer
+          Sensor.
+        displayName: Tolerations
+        path: falconImageAnalyzer.tolerations
       - description: Falcon Node Sensor Controller Configuration
         displayName: Falcon Node Sensor Configuration
         path: falconNodeSensor
@@ -1559,6 +1567,9 @@ spec:
           to know this to discover and communicate with IAR.
         displayName: Falcon Image Analyzer Namespace
         path: falconAdmission.admissionConfig.falconImageAnalyzerNamespace
+      - description: Specifies tolerations for scheduling the Admission Controller.
+        displayName: Tolerations
+        path: falconAdmission.admissionConfig.tolerations
       - description: |-
           Advanced configures various options that go against industry practices or are otherwise not recommended for use.
           Adjusting these settings may result in incorrect or undesirable behavior. Proceed at your own risk.
@@ -1802,12 +1813,17 @@ spec:
       - description: Set the falcon image analyzer volume size limit.
         displayName: Falcon Image Analyzer Volume Size Limit
         path: imageAnalyzerConfig.sizeLimit
-      - description: Specifies node affinity for scheduling the Sensor.
+      - description: Specifies node affinity for scheduling the Falcon Image Analyzer
+          Sensor.
         displayName: Node Affinity
         path: nodeAffinity
       - description: Set the falcon image analyzer volume mount path.
         displayName: Falcon Image Analyzer Volume Mount Path
         path: imageAnalyzerConfig.mountPath
+      - description: Specifies tolerations for scheduling the Falcon Image Analyzer
+          Sensor.
+        displayName: Tolerations
+        path: tolerations
       - description: Name of the Kubernetes Cluster.
         displayName: Falcon Image Analyzer Cluster Name
         path: imageAnalyzerConfig.clusterName
@@ -2398,7 +2414,7 @@ spec:
                       fieldPath: metadata.annotations['olm.targetNamespaces']
                 - name: OPERATOR_NAME
                   value: falcon-operator
-                image: quay.io/crowdstrike/falcon-operator:1.6.0
+                image: quay.io/crowdstrike/falcon-operator:iar-kac-tolerations
                 livenessProbe:
                   httpGet:
                     path: /healthz

bundle/manifests/falcon.crowdstrike.com_falconadmissions.yaml

@@ -643,15 +643,57 @@ spec:
                         type: integer
                         x-kubernetes-int-or-string: true
                     type: object
+                  tolerations:
+                    default: []
+                    description: Specifies tolerations for scheduling the Admission
+                      Controller.
+                    items:
+                      description: |-
+                        The pod this Toleration is attached to tolerates any taint that matches
+                        the triple <key,value,effect> using the matching operator <operator>.
+                      properties:
+                        effect:
+                          description: |-
+                            Effect indicates the taint effect to match. Empty means match all taint effects.
+                            When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                          type: string
+                        key:
+                          description: |-
+                            Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                            If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                          type: string
+                        operator:
+                          description: |-
+                            Operator represents a key's relationship to the value.
+                            Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
+                            Exists is equivalent to wildcard for value, so that a pod can
+                            tolerate all taints of a particular category.
+                            Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
+                          type: string
+                        tolerationSeconds:
+                          description: |-
+                            TolerationSeconds represents the period of time the toleration (which must be
+                            of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                            it is not set, which means tolerate the taint forever (do not evict). Zero and
+                            negative values will be treated as 0 (evict immediately) by the system.
+                          format: int64
+                          type: integer
+                        value:
+                          description: |-
+                            Value is the taint value the toleration matches to.
+                            If the operator is Exists, the value should be empty, otherwise just a regular string.
+                          type: string
+                      type: object
+                    type: array
                   updateStrategy:
-                    default:
-                      rollingUpdate:
-                        maxSurge: 1
-                        maxUnavailable: 0
+                    default: {}
                     description: Type of Deployment update. Can be "RollingUpdate"
                       or "OnDelete". Default is RollingUpdate.
                     properties:
                       rollingUpdate:
+                        default:
+                          maxSurge: 1
+                          maxUnavailable: 0
                         description: RollingUpdate is used to specify the strategy
                           used to roll out a deployment
                         properties: