Add SPLUNK_KVSTORE_DISABLED to opt out of the KV Store - #928
Open
tod-uma wants to merge 2 commits into
Open
Conversation
Indexers and forwarders can run without the App Key Value Store, but nothing in the collection lets a deployment express that -- the only existing route is the generic splunk.conf escape hatch. Mirror the newest kvstore task's presence-gated pattern (set_default_kvstore_type.yml) to add a first-class splunk.kvstore.disabled setting, an env var override, and docs.
The play (`splunkCluster.yml`) leaves `become: true` commented out at
the play level, so every task in `splunk_common` that writes into
`$SPLUNK_HOME` must opt into privilege escalation itself. Every other
task that does so -- `set_default_kvstore_type.yml` (this feature's
own structural sibling), `set_general_symmkey_password.yml` (the
closest analogue: single `ini_file` write to `server.conf`, same
register-and-restart shape) -- carries `become: yes` /
`become_user: "{{ splunk.user }}"`. `set_kvstore_disabled.yml` never
got it; it copied `set_server_name.yml`'s register-and-restart
*shape* but not the privilege-escalation `set_default_kvstore_type.yml`
actually needed for a kvstore-section write.
Invisible on indexer03/04/05, where the KV store was already disabled
by hand and this `ini_file` call is a no-op against existing content
-- it never attempts an actual write, so the missing become never
gets exercised. It surfaced on `indexer06`'s first build, a genuinely
new host where every value this play sets is a first-time write:
OSError: [Errno 18] Invalid cross-device link: ... -> '/opt/splunk/etc/system/local/server.conf'
fatal: [lv-o-splunk-indexer06...]: FAILED! =>
msg: 'The destination directory (/opt/splunk/etc/system/local)
is not writable by the current user.'
Ansible's atomic_move hits EXDEV against the remote_tmp mount (as
expected -- $SPLUNK_HOME is its own LV) and falls back to writing the
temp file inside the destination directory itself; that fallback then
hit Permission Denied because the task was running as the raw
connection user, not `splunk.user`.
Fix: add the same `become: yes` / `become_user: "{{ splunk.user }}"`
`set_default_kvstore_type.yml` and `set_general_symmkey_password.yml`
already carry.
Contributor
Author
|
Pushed a fix ( |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Splunk indexers and forwarders are documented as safe to run without the App Key Value Store (About the app key value store), but the collection has no way to express that. The only existing route is the generic
splunk.confescape hatch, and the one branch that tried this directly (CSPL-4011-disable-kvstore) is ingestor-scoped, unmerged, and putskvstore:directly undervalue:— omitting the requiredcontent:level, so it never actually writes anything.What
Mirrors the newest kvstore task's presence-gated pattern (
set_default_kvstore_type.yml):roles/splunk_common/tasks/set_kvstore_disabled.yml(new) — singleini_filetask writing[kvstore] disabledtoserver.conf, following the register-and-restart pattern used elsewhere in this role (set_server_name.yml,set_postgres_sidecar.yml).roles/splunk_common/tasks/main.ymlright afterset_default_kvstore_type.yml, gated on presence ('disabled' in splunk.kvstore) rather than afalsedefault — same reasoning upstream already applied todefault_kvstore_type, and it meansroles/splunk_indexer/molecule/default/tests/test_default.py'smongod.lockassertion is untouched (this is opt-in, not a default-behavior change).SPLUNK_KVSTORE_DISABLEDenv override ininventory/environ.py, mirroringgetDefaultKVStoreType's shape.docs/ADVANCED.mdanddocs/advanced/default.yml.spec.md.tests/small/test_environ.py.Testing
tests/small/(pytest): all new cases pass, no regressions.main.ymlgate condition andset_kvstore_disabled.ymltask viaansible-playbookagainst a scratchsplunk.home, confirmed the gate only fires whenkvstore.disabledis explicitly set, the first write ischanged, a repeat is idempotent, and the resultingserver.confreads exactly[kvstore]\ndisabled = <bool>.