Title
#kolide
z

Zach Zeid

10/02/2020, 3:30 PM
How does it not convert
decorators
over to yaml?
sundsta

sundsta

10/02/2020, 3:38 PM
From the description of the
convert
command:
Convert osquery packs into decomposed fleet configs
z

Zach Zeid

10/02/2020, 3:38 PM
Yes.
sundsta

sundsta

10/02/2020, 3:39 PM
So what is your question?
3:40 PM
Decorators are not a part of a pack, so they wouldn’t be included in this
z

Zach Zeid

10/02/2020, 3:40 PM
so it wouldn't converted anything in that json?
3:41 PM
ALL it does is take json that contains queries and converts them?
3:43 PM
Looking at the code, it handles packs and queries
z

Zach Zeid

10/02/2020, 3:44 PM
looks like it'll do convert based on
Kind, Version, Spec
and dump anything that matches
Queries, Packs, Labels
into the yaml file?
sundsta

sundsta

10/02/2020, 3:46 PM
osquery doesn’t have the concept of labels, that’s a Fleet thing. This handles queries and packs
z

Zach Zeid

10/02/2020, 3:47 PM
ok.
sundsta

sundsta

10/02/2020, 3:47 PM
If you wanted to open a PR to add support for converting more items from the osquery config to the Fleet config YAML, I’m sure it would be accepted
z

Zach Zeid

10/02/2020, 3:48 PM
Ok, thanks.
zwass

zwass

10/02/2020, 3:58 PM
Keep in mind JSON is valid yaml so you could just paste your decorators block into the yaml.
z

Zach Zeid

10/02/2020, 3:59 PM
Well, the end goal is formulating some sort of CI/CD pipeline that'll convert and deploy changes to Fleet
4:00 PM
because if I'm not mistaken, the
profile.py
script wouldn't work on fleet yaml?
zwass

zwass

10/02/2020, 4:01 PM
Is there a reason you can't write yaml to your repo? If not, you could always parse the json and pull out that block.
4:01 PM
Or implement conversion for that like @sundsta said.
z

Zach Zeid

10/02/2020, 4:02 PM
I could absolutely write yaml to the repo, but the goal is to do some profiling first.
zwass

zwass

10/02/2020, 4:03 PM
Ah, with profile.py?
4:04 PM
Does that work on decorators?
4:04 PM
Could be interesting to add yaml parsing to profile.py or fleetctl export for yaml to json.
4:05 PM
But I'm not sure that would solve your issue with decorators.
z

Zach Zeid

10/02/2020, 4:06 PM
No, that's separate issue, I was testing with
osquery.conf
and noticed it didn't pick up
decorators
. I'll have to dig into how
fleetctl convert
does that, and make a PR for decorators.
4:06 PM
I just noticed it because my intent is to gitops deploying new queries.