[ BUG ] Get-FalconContainerCluster doesn't return any results

[tcourtnage-tbl]

The Get-FalconContainerCluster function does not return any results. Running it with -Verbose seems to indicate it's not attempting to do anything at all. Using cURL to same route (/kubernetes-protection/entities/kubernetes/clusters/v1) shows the correct results, and falconpy works as well. I had a coworker confirm the behaviour as well.

To Reproduce

• Get an OAuth2 token (Request-FalconToken -ClientId '<client_id>' -ClientSecret '<client_secret>')
• Confirm your token is good and is pointing to the correct regional endpoint for your instance (Test-FalconToken)
• Execute the Get-FalconContainerCluster function.

Expected behavior I expect to see a list of our EKS clusters, but no results are returned. As mentioned, cURLing the same endpoint shows the proper results.

Environment (please complete the following information):

• OS: Debian Linux
• PowerShell: 7.3.1
• PSFalcon: 2.2.3 (also tested with 2.2.1)

Transcript content

**********************
PowerShell transcript start
Start time: 20230105141825
Username: xxxxxxxxx\xxxxxxxxx
RunAs User: xxxxxxxxx\xxxxxxxxx
Configuration Name: 
Machine: xxxxxxxxx (Unix 6.0.0.6)
Host Application: /opt/microsoft/powershell/7/pwsh.dll
Process ID: 149106
PSVersion: 7.3.1
PSEdition: Core
GitCommitId: 7.3.1
OS: Linux 6.0.0-6-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.0.12-1 (2022-12-09)
Platform: Unix
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.10032.0, 6.0.0, 6.1.0, 6.2.0, 7.0.0, 7.1.0, 7.2.0, 7.3.1
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
WSManStackVersion: 3.0
**********************
Transcript started, output file is /home/xxxxxxxxx/PowerShell_transcript.xxxxxxxxx.6XDkQBBx.20230105141825.txt
PS /home/xxxxxxxxx/Development/temp/eks> Show-FalconModule

PSVersion      : Core [7.3.1]
ModuleVersion  : v2.2.3 {d893eb9f-f6bb-4a40-9caf-aaff0e42acd1}
ModulePath     : /home/xxxxxxxxx/.local/share/powershell/Modules/PSFalcon/2.2.3
UserModulePath : /home/xxxxxxxxx/.local/share/powershell/Modules:/usr/local/share/powershell/Modules:/opt/microsoft/powershell/7/Modules
UserHome       : /home/xxxxxxxxx
UserAgent      : crowdstrike-psfalcon/2.2.3

PS /home/xxxxxxxxx/Development/temp/eks> Get-FalconContainerCluster -Verbose
PS /home/xxxxxxxxx/Development/temp/eks> Stop-Transcript
**********************
PowerShell transcript end
End time: 20230105141847
**********************

[bk-cs]

Thank you! This was due to a simple typo and will be fixed in the 2.2.4 release.

If you'd like to resolve it for your local module before release, you can replace Public\kubernetes-protection.ps1 with the following file:

https://raw.githubusercontent.com/CrowdStrike/psfalcon/8aa75a140e4647e21a9234c3147d7d5bbcc606cb/Public/kubernetes-protection.ps1

Update file using PowerShell 5.1 on Windows:

(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/8aa75a140e4647e21a9234c3147d7d5bbcc606cb/Public/kubernetes-protection.ps1 -UseBasicParsing).Content > $HOME\Documents\WindowsPowerShell\Modules\PSFalcon\2.2.3\Public\kubernetes-protection.ps1

Update file using PowerShell Core on Windows:

(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/8aa75a140e4647e21a9234c3147d7d5bbcc606cb/Public/kubernetes-protection.ps1 -UseBasicParsing).Content > $HOME\Documents\PowerShell\Modules\PSFalcon\2.2.3\Public\kubernetes-protection.ps1

Update file using PowerShell Core on Linux/Mac:

(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/8aa75a140e4647e21a9234c3147d7d5bbcc606cb/Public/kubernetes-protection.ps1 -UseBasicParsing).Content > $HOME/.local/share/PowerShell/Modules/PSFalcon/2.2.3/Public/kubernetes-protection.ps1

[bk-cs]

Solved in v2.2.4 release.