Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

osquery instance should not restart when the KATC configuration changes #2097

Open
RebeccaMahany opened this issue Feb 10, 2025 · 0 comments · May be fixed by #2128
Open

osquery instance should not restart when the KATC configuration changes #2097

RebeccaMahany opened this issue Feb 10, 2025 · 0 comments · May be fixed by #2128
Assignees
Labels
features-improvements Features and Improvements

Comments

@RebeccaMahany
Copy link
Contributor

RebeccaMahany commented Feb 10, 2025

Currently, the osquery runner restarts all instances when Ping is called. (See: https://github.com/kolide/launcher/blob/main/pkg/osquery/runtime/runner.go#L286-L302.) On launcher first-time startup, launcher will receive an updated KATC configuration the first time it talks to the control server. Consequently, on launcher first-time startup, the osquery runner will start an instance, then restart it almost immediately afterward. This immediate restart is problematic because it delays the time before osquery is fully functional and running queries, and additionally because osquery startup is a little fragile on Windows and having to do it not once but twice is not desirable.

This issue is for researching options that will allow us to avoid this restart.

Research notes:

  • It doesn't look like we can de-register individual plugins, so I don't think we can de-register the KATC table plugins and then re-register new ones.
  • Because the kolide_grpc extension is required (we indicate this with the --extensions_require flag when starting up osquery), I don't think we can safely de-register the entire extension and start up a new one in its place -- but it's probably worthwhile to validate this assumption.
  • We cannot register plugins after the server has started, so we cannot add the new KATC tables when we receive them after osquery instance startup.
  • Therefore -- we have to either wait for the control server data to become available, or ensure that the KATC configuration is available ahead of time or on demand.
  • We could make the config available ahead of time by packaging launcher with the current KATC config. (This wouldn't help with organizations that continue to use older installers, though.)
  • We could make the config available on demand via e.g. unauthed K2 API endpoint.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
features-improvements Features and Improvements
Projects
None yet
1 participant