diff --git a/docs/ADVANCED.md b/docs/ADVANCED.md index 4341071d..9a79b1ae 100644 --- a/docs/ADVANCED.md +++ b/docs/ADVANCED.md @@ -87,6 +87,7 @@ Splunk-Ansible ships with an inventory script in `inventory/environ.py`. The scr | SPLUNKD_SSL_PASSWORD | Custom SSL password used with Splunkd when HTTPS is enabled | no | no | no | | SPLUNK_KVSTORE_PORT | Port to run Splunk KVStore. Default: `8191` | no | no | no | | SPLUNK_KVSTORE_DEFAULT_TYPE | Configures `[kvstore] defaultKVStoreType` in `server.conf` when explicitly set. Allowed values are `cohosted` and `local`; Ansible writes the setting only for Splunk Enterprise 10.6.0 or later. When set to `cohosted`, Ansible also writes `[kvstore] postgresMigrateOnStartup=true`; when set to `local`, it writes `[kvstore] postgresMigrateOnStartup=false`. Older Splunk versions skip the default KV Store type configuration. SOK injects `local` for supported CMP-K deployments. | no | no | no | +| SPLUNK_KVSTORE_DISABLED | Configures `[kvstore] disabled` in `server.conf` when explicitly set to `true` or `false`. Indexers and forwarders are documented as safe to run without the KV Store; use this to disable it on deployments that have no local apps or lookups depending on it. Unset by default, leaving Splunk's own default (enabled) in place. | no | no | no | | SPLUNK_APPSERVER_PORT | Port to run Splunk appserver. Default: `8065` | no | no | no | | SPLUNK_SET_SEARCH_PEERS | Boolean to configure whether search heads should connect to search peers. Default: `True`. Not recommended to change | no | no | no | | SPLUNK_SITE | For multisite topologies, define the site of this particular Splunk Enterprise instance | no | no | no | diff --git a/docs/advanced/default.yml.spec.md b/docs/advanced/default.yml.spec.md index 4cc92b30..493679ba 100644 --- a/docs/advanced/default.yml.spec.md +++ b/docs/advanced/default.yml.spec.md @@ -418,6 +418,11 @@ splunk: * Determine the port used for Splunk Key-Value store * Default: 8191 + disabled: + * When explicitly set, writes [kvstore] disabled in server.conf. Splunk indexers and + forwarders can run without the KV Store; this lets a deployment opt out of it. + * Default: null (not written; Splunk's own default of enabled stands) + launch: null * key::value pairs for environment variables that get written to ${SPLUNK_HOME}/etc/splunk-launch.conf * Default: null diff --git a/inventory/environ.py b/inventory/environ.py index 13739e89..81130b5d 100755 --- a/inventory/environ.py +++ b/inventory/environ.py @@ -177,6 +177,7 @@ def getDefaultVars(): getDSP(defaultVars) getIPv6(defaultVars) getDefaultKVStoreType(defaultVars) + getKVStoreDisabled(defaultVars) getNodeSidecarPostgres(defaultVars) return defaultVars @@ -764,6 +765,19 @@ def getDefaultKVStoreType(vars_scope): vars_scope["splunk"].setdefault("kvstore", {}) vars_scope["splunk"]["kvstore"]["default_kvstore_type"] = default_kvstore_type +def getKVStoreDisabled(vars_scope): + """ + Honor SPLUNK_KVSTORE_DISABLED to configure server.conf + [kvstore] disabled when explicitly provided. + """ + kvstore = vars_scope["splunk"].get("kvstore", {}) + val = os.environ.get("SPLUNK_KVSTORE_DISABLED", kvstore.get("disabled")) + if val is None or val == "": + return + + vars_scope["splunk"].setdefault("kvstore", {}) + vars_scope["splunk"]["kvstore"]["disabled"] = str(val).lower() == "true" + def getNodeSidecarPostgres(vars_scope): """ Honor SPLUNK_NODE_SIDECAR_POSTGRES_DISABLED to toggle the co-hosted diff --git a/roles/splunk_common/tasks/main.yml b/roles/splunk_common/tasks/main.yml index fdc0fc91..28af3f06 100644 --- a/roles/splunk_common/tasks/main.yml +++ b/roles/splunk_common/tasks/main.yml @@ -112,6 +112,11 @@ - splunk.kvstore.default_kvstore_type | length > 0 - splunk.role != "splunk_universal_forwarder" +- include_tasks: set_kvstore_disabled.yml + when: + - "'kvstore' in splunk and 'disabled' in splunk.kvstore" + - splunk.kvstore.disabled is not none + - include_tasks: enable_splunkweb_ssl.yml when: - "'http_enableSSL' in splunk and splunk.http_enableSSL is not none" diff --git a/roles/splunk_common/tasks/set_kvstore_disabled.yml b/roles/splunk_common/tasks/set_kvstore_disabled.yml new file mode 100644 index 00000000..616686a7 --- /dev/null +++ b/roles/splunk_common/tasks/set_kvstore_disabled.yml @@ -0,0 +1,14 @@ +--- +- ini_file: + dest: "{{ splunk.home }}/etc/system/local/server.conf" + section: kvstore + option: "disabled" + value: "{{ splunk.kvstore.disabled | bool | lower }}" + owner: "{{ splunk.user }}" + group: "{{ splunk.group }}" + register: set_kvstore_disabled + become: yes + become_user: "{{ splunk.user }}" + +- include_tasks: ../handlers/restart_splunk.yml + when: set_kvstore_disabled is changed diff --git a/tests/small/test_environ.py b/tests/small/test_environ.py index 1c1b08ba..c57905dc 100644 --- a/tests/small/test_environ.py +++ b/tests/small/test_environ.py @@ -671,6 +671,25 @@ def test_getDefaultKVStoreType(default_yml, os_env, result): environ.getDefaultKVStoreType(vars_scope) assert vars_scope["splunk"]["kvstore"] == result +@pytest.mark.parametrize(("default_yml", "os_env", "result"), + [ + ({}, {}, {}), + ({"disabled": True}, {}, {"disabled": True}), + ({"disabled": False}, {}, {"disabled": False}), + ({}, {"SPLUNK_KVSTORE_DISABLED": ""}, {}), + ({}, {"SPLUNK_KVSTORE_DISABLED": "true"}, {"disabled": True}), + ({}, {"SPLUNK_KVSTORE_DISABLED": "TRUE"}, {"disabled": True}), + ({}, {"SPLUNK_KVSTORE_DISABLED": "false"}, {"disabled": False}), + ] + ) +def test_getKVStoreDisabled(default_yml, os_env, result): + vars_scope = {"splunk": {"kvstore": {}}} + vars_scope["splunk"]["kvstore"].update(default_yml) + with patch("environ.inventory") as mock_inven: + with patch("os.environ", new=os_env): + environ.getKVStoreDisabled(vars_scope) + assert vars_scope["splunk"]["kvstore"] == result + @pytest.mark.parametrize(("es_enablement", "os_env", "result"), [ (None, {}, ""),