https://github.com/osquery/osquery logo
#extensions
Title
# extensions
r

Rupert

11/10/2022, 3:16 PM
I'm new to osquery & looking for some troubleshooting advice I built & installed this extension https://github.com/aquasecurity/kube-query & it works fine when used from the repl:
Copy code
KUBECONFIG="${HOME}/.kube/config" osqueryi --extension "${HOME}/.local/bin/kube-query"
osquery> -- this works ok
osquery> select * from kubernetes_pods limit 1;
when i pass in the query from the cli none of the
kubernetes_
tables show up & I can't query on them;
Copy code
# no kubernetes tables in this list
KUBECONFIG="${HOME}/.kube/config" osqueryi --extension "${HOME}/.local/bin/kube-query" '.tables'

# gives Error: no such table: kubernetes_pods
KUBECONFIG="${HOME}/.kube/config" osqueryi --extension "${HOME}/.local/bin/kube-query" 'select * from kubernetes_pods limit 1'
any advice appreciated!
s

Stefano Bonicatti

11/10/2022, 3:18 PM
Hello @Rupert, I think the doc is a bit lacking here (see https://github.com/osquery/osquery/issues/7816), but when starting the extension with
--extension
you’re also better of using the
--extensions_require
flag with the name the extension reports itself with, so that osquery waits until it’s fully registered.
r

Rupert

11/10/2022, 3:22 PM
thanks!
--extensions_require kube-query
fixed it
2 Views