Skip to content

Update kubescape and tetragon tables for Pixie clickhouse compatibility#203

Open
ddelnano wants to merge 7 commits into
k8sstormcenter:mainfrom
ddelnano:ddelnano/update-tables-pixie-clickhouse-compatibility
Open

Update kubescape and tetragon tables for Pixie clickhouse compatibility#203
ddelnano wants to merge 7 commits into
k8sstormcenter:mainfrom
ddelnano:ddelnano/update-tables-pixie-clickhouse-compatibility

Conversation

@ddelnano
Copy link
Copy Markdown
Contributor

@ddelnano ddelnano commented Oct 29, 2025

Summary: Update kubescape and tetragon tables for Pixie clickhouse compatibility

These schema changes reflect the changes needed for Pixie to read and write these schemas with Pixie's clickhouse source and sink nodes (read & export support). While Pixie's clickhouse support can be extended to support customizations (like using a separate "time" column for its range query), these are needed to work with the current state of its functionality.

Todo

  • Confirm whether the Pixie clickhouse schema can be removed -- Pixie can create the scheme via PxL (px.CreateClickHouseSchemas())
  • Confirm if stix clickhouse tables will be read or written to via Pixie (otherwise schema for this table can be reverted)
  • Test this end to end with the lab
  • Create lab PR to reflect these changes once e2e testing is complete.

Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
Comment thread honeystack/clickhouse/init.sh
Comment thread honeystack/clickhouse/init.sh
Copy link
Copy Markdown
Contributor

@entlein entlein left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, want to test the vector else { get_hostname!() } syntax though

@entlein
Copy link
Copy Markdown
Contributor

entlein commented Oct 30, 2025

@ddelnano : please pull in the latest changes from main (PR 205) itll also remove the pipeline that is blocking

two commas missing
Comma where there shouldnt have been one
username and password for a clickhouse user with proper insert perms
hostname was missing as column in tretragon.stix table
Another hostname column missing
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants