issue with crowdstrike.falcon.falcon_install role

[fasdrubalpsg]

Hello,

Just updated my crowdstrike falcon collection because of the GPG issue, but now i have an error : My playbook :

- name: CROWDSTRIKE FALCON
  hosts: all,!localhost
  vars:
      falcon_client_id: <my ID>
      falcon_client_secret: <My Secret>
      falcon_api_enable_no_log: false
      falcon_cid: "<My CID>"

  roles:
  - role: crowdstrike.falcon.falcon_install
    vars:
      falcon_sensor_version_decrement: 1
      falcon_api_enable_no_log: false

  tasks:

  - name: configure falconctl
    crowdstrike.falcon.falconctl:
      state: present
      cid: "<My CID>"

  - name: start falcon sensor service
    service:
      name: falcon-sensor
      enabled: True
      state: started

My environement :

[admin@computer ansible]$ ansible --version
ansible [core 2.15.12]
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/domain/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/domain/user/.local/lib/python3.9/site-packages/ansible
  ansible collection location = /home/domain/user/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/domain/user/.local/bin/ansible
  python version = 3.9.19 (main, May 16 2024, 08:45:40) [GCC 8.5.0 20210514 (Red Hat 8.5.0-22)] (/usr/bin/python3.9)
  jinja version = 3.1.4
  libyaml = True

the error is :

TASK [configure falconctl] *******************************************************************************************************************************************************************************************************************************
fatal: [computer]: FAILED! => {"changed": false, "msg": "Failed to find required executable \"falconctl\" in paths: /opt/CrowdStrike:/home/domain/user/.local/bin:/home/domain/user/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin"}

Did I make a mistake somewhere? It was working before the collection upgrade. Thanks for the help. Regards.

edit: I tried to add /opt/crowdstrike to the global PATH, but it didn't change anything.

edit 2 : all my systems are running on rhel 8.x

[fasdrubalpsg]

well ... just regenerated my execution environnement (upgraded all elements, included python, wheel, ect) ... added in my inventory vars localhost ansible_connection=local ... and now it's working. don't really understand what did the trick ...

[carlosmmatos]

@fasdrubalpsg generally the above issue is related to the task trying to run on the localhost executing the playbook such as an execution env: From the image - it looks like that host executing the script was also part of the inventory run ( which it sounds like you configured the localhost stuff correctly now to prevent that from happening ).

I don't know all the specifics around what version you upgraded from or what not, but not much has changed from the falconct module - so hopefully this was just an isolated issue and I'm happy to hear it's working for you now! 👊🏼

[vikas-falconx]

Having the same issue, everything was working so far and i didn't update anything in my execution environment. I am on 4.5.1 Is there any fix for this. This is a blocker for us

[carlosmmatos]

@vikas-falconx - just trying to better understand and there hasn't been any updates since june 28th to this collection. Are you saying that this was working for you on 4.5.1 until recently? Can you provide more details on the execution environment (ie ansible-core version etc)? Does it work on 4.5.0? What OS are you seeing the issue on (all of them or certain ones)? Just trying to get a better understanding as I said, not much has changed in a little bit.

[vikas-falconx]

This issue has started happening recently, we have not changed anything on our end. We are using ubuntu 22.04 with ansible-core>=2.15

[evanstoner]

@vikas-falconx Can you run falconctl manually (as root), e.g. /opt/CrowdStrike/falconctl -g --version?

Please also paste in your exact error output and Ansible version. Thanks!

[carlosmmatos]

@vikas-falconx I just noticed that you are running the falconctl module without becoming root, can you try either of the following:

Recommended Way:

- name: CROWDSTRIKE FALCON
  hosts: all,!localhost
  vars:
      falcon_client_id: <my ID>
      falcon_client_secret: <My Secret>
      falcon_api_enable_no_log: false

  roles:
  - role: crowdstrike.falcon.falcon_install
    vars:
      falcon_sensor_version_decrement: 1
      falcon_api_enable_no_log: false
  - role: crowdstrike.falcon.falcon_configure
    vars:
      falcon_cid: "<My CID>"

Same w/ become:

- name: CROWDSTRIKE FALCON
  hosts: all,!localhost
  vars:
      falcon_client_id: <my ID>
      falcon_client_secret: <My Secret>
      falcon_api_enable_no_log: false
      falcon_cid: "<My CID>"

  roles:
  - role: crowdstrike.falcon.falcon_install
    vars:
      falcon_sensor_version_decrement: 1
      falcon_api_enable_no_log: false

  tasks:
  - name: configure falconctl
    crowdstrike.falcon.falconctl:
      state: present
      cid: "<My CID>"
    become: true

  - name: start falcon sensor service
    service:
      name: falcon-sensor
      enabled: True
      state: started
    become: true

[carlosmmatos]

Just checking in to see if this has been resolved for you. If so could you please close the issue? Otherwise I will close it in a few days.