Anyone use osquery in k8s at all?

I have. Others have.

tryna understand a gap analysis between falco and osquery

Falco is syscalls only. That misses a lot of what osquery offers

Are people using kube-query for osquery in k8s?

Kube-query?

a lot is going to depend on what you’re doing, and what levels of beta and code you can commit to. Using osquery to pull info about the k8s deployment, is different than using it to pull information about a running container is different tha pulling into about another container.

Im asking because we have a team looking at Falco and I'm trying to understand what key differences there are between osquery and falco

Falco being syscalls is a big thing.

as a positive?

Just big difference.

does osquery not rely on syscalls? I thought it always used eBPF

osquery presents a sql interface to various OS and application APIs. Those conversations have been written by various people. See https://osquery.io/schema/4.2.0/ for the list of information.

I think I understand. My assumption was that osquery did (or at least could be configured) to use eBPF. That doesn't appear to be the case.

It’s pretty beta. I can’t really speak to it

Got it. Thank you for taking the time to answer my questions. This was incredibly helpful.

We do not run any k8s specific tables (although have looked at kube-query along with extending/writing our own impl) however we do run osquery all of our clusters as a Daemonsets (with some mounts/perms that gives it more visibility into the node is it monitoring).

You may be interested in the upcoming container tables

@burdz interesting to know that we can install osquery via Daemonset, can you please share the yaml file for it

@burdz Also interested to know about your Daemonset implementation, we already have some basic k8s visibility.

certainly! let me clean up the yaml (littered with our helm tpls) and I can share it. I can also talk about some of the ideas we were thinking about for extentions to gain more visibility into our clusters. early days in our journey currently but definitely looking forward expanding our usage of it to monitoring our kube environments

https://github.com/osquery/osquery/pull/6209 and associated are the things y’all may be interested in

apologizes my family had a close call with the global pandemic and I am just getting back to work now. I will share our configuration soon.