https://github.com/osquery/osquery logo
Title
v

vaar

09/12/2020, 4:14 PM
someone use gitlab CI/CD with fleetctl for deploying packs?
z

Zach Zeid

09/12/2020, 10:09 PM
It's on my todo list this quarter
s

sundsta

09/14/2020, 4:01 PM
Have done it, although our solution did not handle removing no longer used queries
z

Zach Zeid

09/14/2020, 5:13 PM
Interesting, how would you be able to tell that the queries were no longer used?
s

sundsta

09/14/2020, 5:21 PM
Well, we decided not to use them, so we removed them from all query packs so they never ran on any hosts. But they were not removed from Fleet since our CD strategy was fairly “dumb” and just did
fleetctl apply -f
for the query and pack configurations
z

Zach Zeid

09/14/2020, 5:27 PM
if they're not in the config when doing the apply, they don't get removed from Fleet?
s

sundsta

09/14/2020, 5:29 PM
No. You need to specifically delete them if you want them gone.
z

Zach Zeid

09/14/2020, 5:30 PM
That makes sense.
v

vaar

09/14/2020, 9:12 PM
interesting, is there an api to remove the unsed queries? I was thinking to remove them all before to apply the updated packs
s

sundsta

09/14/2020, 9:21 PM
No, but your CD system could
fleetctl delete -f
them assuming each query is in its own file
In my experience, our queries are fairly static so this wasn’t really a problem