splunk / docker-splunk

Splunk Docker GitHub Repository
462 stars 253 forks source link

Conf setting is duplicating configuration #601

Open dp-42 opened 1 year ago

dp-42 commented 1 year ago

Issue

When you want to set a configuration using the default.yml - configuration-files option the resulting Splunk configuration is broken as options are duplicated:

[kvstore]
storageEngine = wiredTiger
storageEngine

Splunk image: splunk/splunk:9.0.5@sha256:aa74f1f9dbe37eb8710ad79bd5c0ce5229b236c737a8a3aa4143dc9c4023ae7f

Replication:

  1. Spawn a Splunk with a config setting in the default.yml - here is an example:
    splunk:
    conf:
    - key: server
      value:
        directory: /opt/splunk/etc/system/local
        content:
          kvstore:
            storageEngine: wiredTiger
  2. Start the Splunk container
  3. Check the /opt/splunk/etc/system/local/server.conf file - everything should be fine
  4. Stop container
  5. Start container
  6. Check the /opt/splunk/etc/system/local/server.conf file - now you will see duplicated and empty keys without values

Debugging

I tried to figure out why this happens - IMHO this seems to be a bug in the shipped Ansible/ini_file module. I use this setting quite frequently and never had any issue with this in the older releases.

In addition I noticed that this is only possible because the allow_no_value was explicitly for false to true - see set_config_stanza.yml#L21. I am not sure why this was done as I cannot think of any Splunk configuration that would utilize this option.

Can you please have a look? If you need further information just let me know!

yaroslav-nakonechnikov commented 1 year ago

https://github.com/splunk/splunk-ansible/issues/751