Skip to content
[EXPERIMENTAL] Extend osquery to report on Kubernetes
Go Makefile
Branch: master
Clone or download

Latest commit

Latest commit 770c446 Dec 16, 2019

Files

Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
tables tables: Pods with multiple volumes are now listed with all volumes (#11) Dec 11, 2019
utils common: sort imports and lint Dec 3, 2019
.gitignore Some improvements (#8) Nov 29, 2019
LICENSE Initial commit Jul 31, 2019
Makefile
README.md docs: tidy README Dec 16, 2019
go.mod containers_test: Add tests for Generate Dec 3, 2019
kube-query.go Some improvements (#8) Nov 29, 2019

README.md

kube-query

kube-query is an extension for osquery, letting you visualize your cluster using sql queries.

Deployment

Prerequisites

Go v1.12+

build

$ export GO111MODULE=on 
$ go build kube-query.go 

Running kube-query

When running kube-query, you should always pass the -kubeconfig flag, specifying the path to your kubeconfig file.

osqueryi

When using the osqueryi tool you can easily register kube-query by passing the -socket parameter to kube-query on another process. For example:
./kube-query -socket="/path/to/osquery/socket" -kubeconfig="/path/to/kubeconfig.yml"

One way to get the path to the osquery socket is like this:

osqueryi --nodisable_extensions
osquery> select value from osquery_flags where name = 'extensions_socket';
+-----------------------------------+
| value                             |
+-----------------------------------+
| /Users/USERNAME/.osquery/shell.em |
+-----------------------------------+

There are many other options to automatically register extensions.

Example Queries

# query all kube-system pods
SELECT * FROM kubernetes_pods WHERE namespace="kube-system";

# query all containers created by kubernetes
SELECT * FROM kubernetes_containers;

# query all pods that runs with a privileged container   
SELECT * 
 FROM kubernetes_containers 
 JOIN kubernetes_pods 
 ON kubernetes_containers.pod_uid=kubernetes_pods.uid
 WHERE privileged="True";
You can’t perform that action at this time.