osquery daemonset

gistfile1.yaml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: osquery
spec:
  selector:
    matchLabels:
      app: osquery
  template:
    metadata:
      labels:
        app: osquery
    spec:
      hostPID: true
      hostIPC: true
      hostNetwork: true
      initContainers:
      - name: wget-osquery-in-host
        image: alpine:latest
        volumeMounts:
        - name: host-root
          mountPath: /host-root
        command: ["wget", "https://github.com/osquery/osquery/releases/download/5.12.2/osquery_5.12.2-1.linux_amd64.deb", "-O", "/host-root/tmp/osquery.deb"]
      - name: install-osquery-in-host
        image: alpine:latest
        volumeMounts:
        - name: host-root
          mountPath: /host-root
        command: ["chroot", "/host-root", "/bin/sh", "-c", "dpkg -i /tmp/osquery.deb"]
      containers:
      - name: osquery
        image: alpine:latest
        securityContext:
          privileged: true
        resources:
          limits:
            memory: "128Mi"
            cpu: "500m"
        command: ["nsenter", "--target", "1", "--mount", "--uts", "--ipc", "--net", "--pid", "--", "osqueryd", "--verbose"]
        volumeMounts:
        - name: host-root
          mountPath: /host-root
      volumes:
      - name: host-root
        hostPath:
          path: /