-
Notifications
You must be signed in to change notification settings - Fork 103
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Store osquery configuration and data per-registration #1984
base: main
Are you sure you want to change the base?
Store osquery configuration and data per-registration #1984
Conversation
ee/agent/storage/keys.go
Outdated
return newKey | ||
} | ||
|
||
func SplitKey(key []byte) ([]byte, []byte) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
wondering if you think it would be worth it to return all parts here and let callers disregard/take what they need? not critical/blocking, just wondering if the identifier type gets additional uses if callers would want that
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
also fine with kicking that down the road I don't see much usage of this yet anyway
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done!
Closes #1939.
Some osquery data, like the node key, should be stored per registration instead of globally. This PR updates how we store data for non-default registrations in our key-value stores. We will store this data by "identifier type" and "identifier" -- so, for example, the key
nodeKey
becomesnodeKey:registration:<registration-id>
.The data for the default registration will be stored just under the key (so,
uuid
, notuuid:registration:default
) -- this should give us good backwards compatibility if launcher rolls back to a previous version, and means we won't have to do any data migration (fromuuid
touuid:registration:default
) to avoid e.g. a launcher re-enroll. This means that, since we only have the one default registration at the moment, the current data isn't actually being stored any differently!A note about the KATC config: the KATC config store contains a series of key-value pairs, where the key is the table name and the value is the config for that table. Under this new storage scheme, the keys (for non-default registrations) would therefore take the form
<table-name>:registration:<registration-id>
. We treat the keys as such when retrieving the KATC config from bbolt. However, I am punting on setting the registration ID when setting the data in the KATC config store in bbolt to #1940 -- that will require figuring out how the control server wants to send down per-registration data to each subsystem, and I'm going to handle that in #1940 separately.