Add RHEL 8/9/10 simulated hosts to osquery-perf - #44453
Conversation
Adds three new host templates (rhel_8, rhel_9, rhel_10) plus matching RPM kernel fixtures so osquery-perf can load-test Fleet's RHEL OSV vulnerability scanning. RHEL agents report platform=rhel, realistic major.minor.patch versions, RPM kernel packages with version+release fields, and (when --software_db_path is set) RPM software from the existing software library.
Verified template fields against `orbit shell` on a Red-Hat-family host: - platform_like: "rhel" (not "rhel fedora") - codename: "" — osquery does not extract codename for RHEL family; the codename instead lives inside the version string - version: "Red Hat Enterprise Linux release X.Y (Codename)" — full human-readable line from /etc/os-release VERSION - osquery_info.build_distro: "centos7" — reflects the osquery binary's build distro, not the host (matches real output) - os_unix_like now reports `extra` field - hardware_vendor/model: plausible Dell PowerEdge values - rpm_packages kernel entries now carry vendor "Red Hat, Inc." and arch "x86_64" matching real RHEL output
Running osquery-perf from the repo root previously crashed because the default --software_db_path is a relative path that only resolves from cmd/osquery-perf/. macOS, Windows, and Ubuntu all have embedded fallback fixtures, and RHEL kernels are embedded too — the DB only adds non-kernel RPM/DEB variety. Downgrade the load failure to a warning and continue with the embedded fixtures.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #44453 +/- ##
==========================================
- Coverage 66.75% 66.74% -0.01%
==========================================
Files 2633 2635 +2
Lines 211741 212046 +305
Branches 9543 9543
==========================================
+ Hits 141349 141540 +191
- Misses 57548 57650 +102
- Partials 12844 12856 +12
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
WalkthroughReworks cmd/osquery-perf/agent.go to replace Ubuntu-only deb kernel handling with structured kernel records and multi-distro support (RHEL 8/9/10). Adds embedded RHEL kernel fixtures and new template files for RHEL 8/9/10 enrollment and Fleet query responses. Kernel loaders now emit maps of {name, version, source}, selectKernels accepts and deep-copies these entries, and software_linux handling gains an RHEL path that filters rows with Source == "rpm_packages", builds per-agent cached software indices, and appends selected kernels and host software. Software DB load failures now warn and fall back to embedded data. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
cmd/osquery-perf/agent.go (1)
640-641: UseTrimSuffixfor exact suffix removal.Line 640 uses
strings.TrimRight(templates.Name(), ".tmpl"), which trims any trailing runes in that set rather than an exact suffix. For example, this would incorrectly remove trailing characters from template names like "foo.t" or "foo.tm". UseTrimSuffixto remove the exact ".tmpl" suffix.Proposed fix
- templateBase := strings.TrimRight(templates.Name(), ".tmpl") + templateBase := strings.TrimSuffix(templates.Name(), ".tmpl")🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cmd/osquery-perf/agent.go` around lines 640 - 641, The code uses strings.TrimRight(templates.Name(), ".tmpl") which removes any of the rune characters '.' 't' 'm' 'p' from the end instead of the exact suffix; update the logic that builds templateBase (where templates.Name() is used) to use strings.TrimSuffix(templates.Name(), ".tmpl") so the ".tmpl" suffix is removed exactly before calling strings.Cut to derive agentOS and osVariant.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@cmd/osquery-perf/agent.go`:
- Around line 640-641: The code uses strings.TrimRight(templates.Name(),
".tmpl") which removes any of the rune characters '.' 't' 'm' 'p' from the end
instead of the exact suffix; update the logic that builds templateBase (where
templates.Name() is used) to use strings.TrimSuffix(templates.Name(), ".tmpl")
so the ".tmpl" suffix is removed exactly before calling strings.Cut to derive
agentOS and osVariant.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 959af88d-a1e6-417e-968a-8a4f8f2e8a10
⛔ Files ignored due to path filters (1)
cmd/osquery-perf/README.mdis excluded by!**/*.md
📒 Files selected for processing (7)
cmd/osquery-perf/agent.gocmd/osquery-perf/rhel_10-kernels.jsoncmd/osquery-perf/rhel_10.tmplcmd/osquery-perf/rhel_8-kernels.jsoncmd/osquery-perf/rhel_8.tmplcmd/osquery-perf/rhel_9-kernels.jsoncmd/osquery-perf/rhel_9.tmpl
There was a problem hiding this comment.
Pull request overview
Adds RHEL 8/9/10 simulated hosts to cmd/osquery-perf so it can load-test Fleet’s RHEL OSV vulnerability scanning path with realistic RPM kernel fixtures and platform metadata.
Changes:
- Added RHEL 8/9/10 osquery-perf host templates and per-major RPM kernel fixture JSON files.
- Updated
agent.goto support RPM kernel fixtures, unify kernel selection across distros, and add anrhelbranch insoftware_linux. - Updated osquery-perf README with RHEL template usage notes and software DB fallback behavior.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| cmd/osquery-perf/agent.go | Adds embedded RHEL kernel fixtures, RPM kernel/software handling, unified kernel selection input type, and non-fatal software DB load fallback. |
| cmd/osquery-perf/README.md | Documents supported Linux templates (including RHEL) and optional software DB behavior. |
| cmd/osquery-perf/rhel_8.tmpl | New RHEL 8 host template (platform/labels/kernel_version). |
| cmd/osquery-perf/rhel_9.tmpl | New RHEL 9 host template (platform/labels/kernel_version). |
| cmd/osquery-perf/rhel_10.tmpl | New RHEL 10 host template (platform/labels/kernel_version). |
| cmd/osquery-perf/rhel_8-kernels.json | New RPM kernel fixture list for RHEL 8. |
| cmd/osquery-perf/rhel_9-kernels.json | New RPM kernel fixture list for RHEL 9. |
| cmd/osquery-perf/rhel_10-kernels.json | New RPM kernel fixture list for RHEL 10. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
GitHub Actions
Failure
There was a problem hiding this comment.
🧹 Nitpick comments (1)
cmd/osquery-perf/agent.go (1)
3293-3293: 💤 Low valueConsider adding a brief comment explaining the "ubuntu" reuse.
Using
RandomSoftwareCount("ubuntu")for RHEL works (since the RPM pool is filtered fromsoftwareDB.Ubuntu), but a short inline comment would clarify this intentional reuse for future maintainers.- count := min(softwaredb.RandomSoftwareCount("ubuntu"), len(rpmPool)) + // Reuse Ubuntu's count distribution since RPM pool is filtered from softwareDB.Ubuntu + count := min(softwaredb.RandomSoftwareCount("ubuntu"), len(rpmPool))🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cmd/osquery-perf/agent.go` at line 3293, Add a short inline comment above the count calculation explaining why RandomSoftwareCount("ubuntu") is reused for RHEL: note that rpmPool is already filtered from softwareDB.Ubuntu so the ubuntu key intentionally provides the desired distribution; reference the variables and functions involved (RandomSoftwareCount, rpmPool, softwareDB.Ubuntu) so future maintainers understand the reuse.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@cmd/osquery-perf/agent.go`:
- Line 3293: Add a short inline comment above the count calculation explaining
why RandomSoftwareCount("ubuntu") is reused for RHEL: note that rpmPool is
already filtered from softwareDB.Ubuntu so the ubuntu key intentionally provides
the desired distribution; reference the variables and functions involved
(RandomSoftwareCount, rpmPool, softwareDB.Ubuntu) so future maintainers
understand the reuse.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 629ea06c-e6a4-44c7-8490-97a54e7b4f00
📒 Files selected for processing (1)
cmd/osquery-perf/agent.go
Related issue: Resolves #44452
Summary
Adds three new host templates (
rhel_8,rhel_9,rhel_10) plus matching RPM kernel fixtures so osquery-perf can load-test Fleet's RHEL OSV vulnerability scanning path.platform=rhel,name="Red Hat Enterprise Linux", andmajor.minor.patchversions (8.10.0,9.4.0,10.0.0) — what Fleet's OSV analyzer keys on.name/version/release, covering kernel package variants (kernel,kernel-core,kernel-modules,kernel-debug-core, ...) so the analyzer's kernel-package mapping is exercised.selectKernelsis unified across distros to take[]map[string]string; Ubuntu's existing string-format JSON is converted at load time so its on-disk fixture is unchanged.software_linuxswitch gains acase "rhel":branch that reuses the existing software DB (softwareDB.Ubuntufiltered torpm_packagesonce viasync.Once). When the DB is absent, RHEL agents emit kernels + per-host installed software only.Checklist for submitter
Testing
go test ./cmd/osquery-perf/... → ? no test files)Summary by CodeRabbit
New Features
Bug Fixes