Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
h
harveywells
11/26/2018, 5:15 PM👋 Howdy! We've just converted one of our query packs for use with our Kolide Fleet tls server. We're specifying our label as
macOSfleetctl get packsr
RPuth
11/26/2018, 5:57 PMI just tested this personally and it worked just fine. Looking at your snippet I think your targeted label has an extra space.
You have:
labels:
(space)- macOS
While it worked for me with:
labels:
(nospace)- macOS
IE removed the space before
- macOSlabelsI believe you're also missing an ID number too.
Try something along the lines of:
apiVersion: v1
kind: pack
spec:
id: <some ID number not used>
name: <your_pack_name>
targets:
labels:
- <your label>
a
atom
11/26/2018, 6:12 PMthanks @RPuth we'll give this a shot
hmm tested with spacing and ID's, not fixing the issue
r
RPuth
11/26/2018, 7:02 PMI just want to make sure, your label is pointing to existing hosts - yes?
a
atom
11/26/2018, 7:16 PMyep, the label is pointing to
macOSr
RPuth
11/26/2018, 7:42 PMCan you paste the exact yaml file that you're attempting to apply? The one previously pasted has some weird line numbering indentations.
a
atom
11/26/2018, 8:07 PMyep 1s
---
apiVersion: v1
kind: pack
spec:
id: 2
name: network
targets:
labels:
- macOS
queries:
- description: Retrieves the current status of IP/IPv6 forwarding.
interval: 3600
name: ip_forwarding
query: ip_forwarding
version: 1.4.5@RPuth thanks for your help, here's our file
this file had a bunch more queries in it
the label worked after we removed other queries, still debugging
figured out the issue
fleetctllabels:nullremove that and everything is good, thanks for your help @RPuth