feat: add PubSub → BigQuery log pipeline addons#231
Open
robbiet480 wants to merge 6 commits intofleetdm:mainfrom
Open
feat: add PubSub → BigQuery log pipeline addons#231robbiet480 wants to merge 6 commits intofleetdm:mainfrom
robbiet480 wants to merge 6 commits intofleetdm:mainfrom
Conversation
…vice, and push subscriptions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ubSub/BQ APIs - Add pubsub_to_bigquery_image variable (optional, gates pubsub_to_bigquery module) - Add module.fleet_pubsub and module.pubsub_to_bigquery - Merge fleet_pubsub.fleet_env_vars into module.fleet extra_env_vars - Enable pubsub.googleapis.com and bigquery.googleapis.com in activate_apis Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds two new GCP addons for routing Fleet osquery and audit logs from PubSub to BigQuery via a Cloud Run ingest service.
addons/gcp/fleet-pubsubConsumer-agnostic addon that creates the three PubSub topics Fleet publishes to and grants Fleet's service account publisher access. Outputs the Fleet server env vars required to enable PubSub logging:
FLEET_OSQUERY_RESULT_LOG_PLUGIN=pubsubFLEET_OSQUERY_STATUS_LOG_PLUGIN=pubsubFLEET_ACTIVITY_ENABLE_AUDIT_LOG=trueFLEET_PUBSUB_ADD_ATTRIBUTES=trueaddons/gcp/pubsub-to-bigqueryWires the topics to BigQuery via PubSub push subscriptions and a Cloud Run service:
result_logs,status_logs,audit_logs)fleet-pubsub-bqservice receives PubSub push messages and writes rowsThe
bq_project_idvariable allows the BigQuery dataset to live in a separate project from the Cloud Run service (e.g. a shared analytics project).gcp/main.tfwiringBoth addons are wired into the top-level
gcpmodule. Thefleet_pubsubmodule's env vars are merged into the Fleet Cloud Run service automatically. Thepubsub_to_bigquerymodule is gated by the nullablepubsub_to_bigquery_imagevariable — set it to enable the pipeline.BigQuery schema
result_logs— one row per osquery result row. Snapshot arrays are exploded;diffResultsare split intoadded/removedrows. Fixed envelope columns +rowJSON string.status_logs— osquery agent status/error messages with severity, filename, line, message, version, and decorations.audit_logs— Fleet user/automation activity with actor info and adetailsJSON blob (schema varies by activity type).Deployment
fleet-pubsub-bqservice image to Artifact Registrypubsub_to_bigquery_imagein your tfvarsterraform applyAuthorship
This code was written by Claude (Anthropic) and reviewed by a human before submission.