:wave: Hey so I'm wondering if there are any good ...
# kolide
n
👋 Hey so I'm wondering if there are any good mechanisms in fleet to target different query versions to different environments. Right now as I understand it, I'd need to: • create label that somehow targets specific environment • create differently-named queries / packs for each environment, targeting the different labels • deploy change to first set of hosts by updating a pack called
alpha-queries
, with query names
my-awesome-query-alpha
• deploy change to second set of hosts by updating a pack called
beta-queries
, with query names
my-awesome-query-beta
• repeat for each additional environment • then the queries will be logged with different pack names / query names, and alerts based on them would need to take into account the weird naming schema as well I guess this whole thing sounds fairly tedious and frustrating, because there's a lot of duplication of effort, duplication of packs / queries, duplication of alerting rules, etc. I'm kind of assuming / hoping that I'm missing something that's obvious to other teams, and if not, how different teams have solved the problems here. Maybe a better way would be a feature request to add "query versions" and be able to target different versions of queries to different labels.
s
Ideally you would have separate dev/integration environments with their own Fleet instances
n
Sure, and we do, but the problem is that there's not really a way to control the release of new configs within fleet easily. It's limiting it to entire blocks of services updating configs at their next check-in interval. It would be nice to control the rollout in a nicer way. "Release this query change to X% of hosts" -> Increase rollout to 10%, rollout to 20%, rollout everywhere, etc.
s
Ah, I misunderstood. I believe that’s what sharding is for, as defined by the query pack https://github.com/kolide/fleet/blob/master/docs/dashboard/scheduling-queries.md
n
Ah okay, that would help a lot, although still is problematic in that you need to manage duplicates of queries with different names (both from query config and alerting config, I think). But way better than I thought before 🤔