https://github.com/osquery/osquery logo
Title
h

harveywells

02/06/2019, 6:10 PM
Howdy! Is there a way to add batch add labels to enrolled nodes with
fleectl
? For example we have a number of enrolled centos linux hosts that we’d like to label with
dev
and
prod
n

nyanshak

02/07/2019, 4:28 PM
@harveywells you'd need something on the system to identify
dev
/
prod
hosts (such as environment variables or a file or something -- placed by whatever config mgmt tool you use), but then it's easy:
---
apiVersion: v1
kind: label
spec:
  name: prod
  query: >
    SELECT * FROM process_envs WHERE key = 'MY_ENV_KEY' AND value = 'prod';
The first things that come to mind are... files on the system, env vars, or maybe ec2_instance_metadata / ec2_instance_tags, but that'll be up to you / your environment.
z

zwass

02/08/2019, 2:38 AM
btw “manual labels” are an existing feature request and something I would love to get to. It’s nontrivial so no eta.