Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Store osquery configuration and data per-registration #1984

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

RebeccaMahany
Copy link
Contributor

@RebeccaMahany RebeccaMahany commented Dec 10, 2024

Closes #1939.

Some osquery data, like the node key, should be stored per registration instead of globally. This PR updates how we store data for non-default registrations in our key-value stores. We will store this data by "identifier type" and "identifier" -- so, for example, the key nodeKey becomes nodeKey:registration:<registration-id>.

The data for the default registration will be stored just under the key (so, uuid, not uuid:registration:default) -- this should give us good backwards compatibility if launcher rolls back to a previous version, and means we won't have to do any data migration (from uuid to uuid:registration:default) to avoid e.g. a launcher re-enroll. This means that, since we only have the one default registration at the moment, the current data isn't actually being stored any differently!

A note about the KATC config: the KATC config store contains a series of key-value pairs, where the key is the table name and the value is the config for that table. Under this new storage scheme, the keys (for non-default registrations) would therefore take the form <table-name>:registration:<registration-id>. We treat the keys as such when retrieving the KATC config from bbolt. However, I am punting on setting the registration ID when setting the data in the KATC config store in bbolt to #1940 -- that will require figuring out how the control server wants to send down per-registration data to each subsystem, and I'm going to handle that in #1940 separately.

@RebeccaMahany RebeccaMahany marked this pull request as ready for review December 11, 2024 15:35
return newKey
}

func SplitKey(key []byte) ([]byte, []byte) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wondering if you think it would be worth it to return all parts here and let callers disregard/take what they need? not critical/blocking, just wondering if the identifier type gets additional uses if callers would want that

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also fine with kicking that down the road I don't see much usage of this yet anyway

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done!

zackattack01
zackattack01 previously approved these changes Dec 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Osquery configuration and data must be stored per-organization
3 participants