Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Store configuration for Kolide custom ATC tables #1761

Merged
merged 5 commits into from
Jun 26, 2024

Conversation

RebeccaMahany
Copy link
Contributor

@RebeccaMahany RebeccaMahany commented Jun 25, 2024

This is part 1 of enabling ATC for non-vanilla sqlite files (indexeddb, sqlite where the data has been compressed with snappy, dataflatten/exec tables).

This PR gets some boilerplate out of the way:

  • Adds a new KVStore to hold configuration
  • Adds consumer for subsystem to update the KVStore
  • Subscribes osquery runner and startup settings writer to changes in store, and has each handle updates appropriately
  • Logs configuration value, does not do anything with it yet

I don't love "Kolide custom ATC" -- I'm happy to rename if anyone has a better suggestion.

@RebeccaMahany RebeccaMahany marked this pull request as ready for review June 25, 2024 16:00
cmd/launcher/launcher.go Outdated Show resolved Hide resolved
@@ -87,6 +87,10 @@ func (k *knapsack) AgentFlagsStore() types.KVStore {
return k.getKVStore(storage.AgentFlagsStore)
}

func (k *knapsack) AtcConfigStore() types.KVStore {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will end up in a new bucket, right? Do we want that vs I-don't-know

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, new bucket! I think the other option would be making it an agent flag and it'd live alongside the other agent flags, which I'm not opposed to either. A new bucket and subsystem felt like it gave me a little bit more room to iterate.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm game to try....

In a world where we have 4 katc tables, what will that look like? I imagine they'll be a DSL where we have a table name, and then some parameters defining it.

So if that was in the agent flags, we'd have katc => { table1 => {...}, table2 => {...} } and if it was in a bucket we'll see entries for each table? I guess it's kinda all the same.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, the options are exactly as you describe. They both feel ok to me -- let's try this and it shouldn't be painful to switch if we change our minds later 🙂

Copy link
Contributor

@zackattack01 zackattack01 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good to me!

Copy link
Contributor

@James-Pickett James-Pickett left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice!

@RebeccaMahany RebeccaMahany added this pull request to the merge queue Jun 26, 2024
Merged via the queue into kolide:main with commit 05ea065 Jun 26, 2024
31 checks passed
@RebeccaMahany RebeccaMahany deleted the becca/kolide-atc branch June 26, 2024 14:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants