This operator manages Splunk Universal Forwarder. It deploys a daemonset which deploys a pod on each node including the masters. It expects the service account for the namespace can deploy privileged pods. It also needs a secret that holds the forwarder auth.
If you are using splunk cloud you can download the spl file, extract it with
tar xvf splunkclouduf.spl
then edit outputs.conf and change sslCertPath and
sslRootCAPath to point to the directory $SPLUNK_HOME/etc/apps/splunkauth/default/
create a secret with the files as is and they will be mounted in the correct place.
The CRD is very to point to the files you want to ship(currently only supports monitor://).
apiVersion: splunkforwarder.managed.openshift.io/v1alpha1
kind: SplunkForwarder
metadata:
name: example-splunkforwarder
spec:
image: dockerimageurl
imageDigest: sha256:f4aadcdd52400bee07587d81c8000ff99af18c78d1b0c57d3cb7fe41e3393a66
splunkLicenseAccepted: true
clusterID: optional-cluster-name
splunkInputs:
- path: /host/var/log/openshift-apiserver/audit.log
index: openshift_managed_audit
whitelist: \.log$
sourcetype: _json
- path: /host/var/log/containers/ip-*-*-*-*ec2internal-debug*.log
index: openshift_managed_debug_node
whitelist: \.log$
sourcetype: _json
The image
and imageDigest
are for the splunk-forwarder image.
If useHeavyForwarder
is true
, heavyForwarderImage
and heavyForwarderDigest
are used for the splunk-heavyforwarder image.
(The CRD supports imageTag
for both, but this is deprecated.)
To use the current version, 8.0.5-a1a6394cc5ae-fa50892
, specify the following:
- For splunk-forwarder:
image: quay.io/app-sre/splunk-forwarder imageDigest: sha256:f4aadcdd52400bee07587d81c8000ff99af18c78d1b0c57d3cb7fe41e3393a66
- For splunk-heavyforwarder:
heavyForwarderImage: quay.io/app-sre/splunk-heavyforwarder heavyForwarderDigest: sha256:714780cf50e80251662538aaa4a55ba1a6e6c5aaca7f09d160f628fcbd7a54d8
Run make image-update
to update to the current master branch commit of splunk-forwarder-images.
This process will update the Makefile with a new value for FORWARDER_IMAGE_TAG
(from the forwarder version, forwarder hash and commit hash) and populate the OLM template with the by-digest URIs for that version.
To use a specific version, use make SFI_UPDATE=<commit/branch/etc> image-update
or edit the Makefile by hand and run make image-digests
to update the OLM template.
Commit and propose the changes as usual.
This repository is configured to support the testing strategy documented here.
Note that, in addition to creating personal repositories for the operator and
OLM registry, you must also create them for splunk-forwarder
and
splunk-heavyforwarder
.