There is a valid sensor update policy for all Linux hosts that is set to...

According to CrowdStrike Falcon documentation regardingFalcon Cloud Security (FCS)andContainer Security, the method used to deploy sensors significantly impacts how updates are managed. When Linux hosts are part of a Kubernetes cluster and the Falcon sensor is deployed as aDaemonSet, the standard "Sensor Update Policy" configured in the Falcon Console does not automatically trigger a version change in the same way it does for a standard Windows or Linux workstation.

In aDaemonSet deployment, the sensor version is typically tied to the specificcontainer image tagor the version defined in theHelm chartor YAML manifest used during deployment. If the manifest specifies a static version or if the orchestration layer (Kubernetes) is not instructed to pull a newer image and rollout a restart of the DaemonSet pods, the hosts will remain on their current version regardless of the "n-2" policy set in the console.

Furthermore, CrowdStrike documentation notes that forLinux Sensor Update Policies, the "n-2" setting dictates which version isassignedto the host, but the mechanism of delivery must be supported. In containerized environments, the "Auto-update" feature is often bypassed by the immutable nature of the deployment. To resolve this, the administrator must update the DaemonSet configuration to point to the newer sensor image, allowing Kubernetes to perform a rolling update across the nodes.