https://github.com/osquery/osquery logo
Title
z

Zach Zeid

10/02/2020, 3:30 PM
How does it not convert
decorators
over to yaml?
s

sundsta

10/02/2020, 3:38 PM
From the description of the
convert
command:
Convert osquery packs into decomposed fleet configs
z

Zach Zeid

10/02/2020, 3:38 PM
Yes.
s

sundsta

10/02/2020, 3:39 PM
So what is your question?
Decorators are not a part of a pack, so they wouldn’t be included in this
z

Zach Zeid

10/02/2020, 3:40 PM
so it wouldn't converted anything in that json?
ALL it does is take json that contains queries and converts them?
Looking at the code, it handles packs and queries
z

Zach Zeid

10/02/2020, 3:44 PM
looks like it'll do convert based on
Kind, Version, Spec
and dump anything that matches
Queries, Packs, Labels
into the yaml file?
s

sundsta

10/02/2020, 3:46 PM
osquery doesn’t have the concept of labels, that’s a Fleet thing. This handles queries and packs
z

Zach Zeid

10/02/2020, 3:47 PM
ok.
s

sundsta

10/02/2020, 3:47 PM
If you wanted to open a PR to add support for converting more items from the osquery config to the Fleet config YAML, I’m sure it would be accepted
z

Zach Zeid

10/02/2020, 3:48 PM
Ok, thanks.
z

zwass

10/02/2020, 3:58 PM
Keep in mind JSON is valid yaml so you could just paste your decorators block into the yaml.
z

Zach Zeid

10/02/2020, 3:59 PM
Well, the end goal is formulating some sort of CI/CD pipeline that'll convert and deploy changes to Fleet
because if I'm not mistaken, the
profile.py
script wouldn't work on fleet yaml?
z

zwass

10/02/2020, 4:01 PM
Is there a reason you can't write yaml to your repo? If not, you could always parse the json and pull out that block.
Or implement conversion for that like @sundsta said.
z

Zach Zeid

10/02/2020, 4:02 PM
I could absolutely write yaml to the repo, but the goal is to do some profiling first.
z

zwass

10/02/2020, 4:03 PM
Ah, with profile.py?
Does that work on decorators?
Could be interesting to add yaml parsing to profile.py or fleetctl export for yaml to json.
But I'm not sure that would solve your issue with decorators.
z

Zach Zeid

10/02/2020, 4:06 PM
No, that's separate issue, I was testing with
osquery.conf
and noticed it didn't pick up
decorators
. I'll have to dig into how
fleetctl convert
does that, and make a PR for decorators.
I just noticed it because my intent is to gitops deploying new queries.