Skip to content

Instantly share code, notes, and snippets.

@guilhem

guilhem/gist:d4c00f19fca8cad71fffbe67fdb28f96

Created September 10, 2024 09:24
Show Gist options
  • Save guilhem/d4c00f19fca8cad71fffbe67fdb28f96 to your computer and use it in GitHub Desktop.
Save guilhem/d4c00f19fca8cad71fffbe67fdb28f96 to your computer and use it in GitHub Desktop.
Download ZIP
osquery daemonset
Raw
gistfile1.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: osquery
spec:
selector:
matchLabels:
app: osquery
template:
metadata:
labels:
app: osquery
spec:
hostPID: true
hostIPC: true
hostNetwork: true
initContainers:
- name: wget-osquery-in-host
image: alpine:latest
volumeMounts:
- name: host-root
mountPath: /host-root
command: ["wget", "https://github.com/osquery/osquery/releases/download/5.12.2/osquery_5.12.2-1.linux_amd64.deb", "-O", "/host-root/tmp/osquery.deb"]
- name: install-osquery-in-host
image: alpine:latest
volumeMounts:
- name: host-root
mountPath: /host-root
command: ["chroot", "/host-root", "/bin/sh", "-c", "dpkg -i /tmp/osquery.deb"]
containers:
- name: osquery
image: alpine:latest
securityContext:
privileged: true
resources:
limits:
memory: "128Mi"
cpu: "500m"
command: ["nsenter", "--target", "1", "--mount", "--uts", "--ipc", "--net", "--pid", "--", "osqueryd", "--verbose"]
volumeMounts:
- name: host-root
mountPath: /host-root
volumes:
- name: host-root
hostPath:
path: /
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment