search

splunk / splunk-ansible

Ansible playbooks for configuring and managing Splunk Enterprise and Universal Forwarder deployments
353 stars 185 forks source link

[GUIDANCE] DEPLOYING APPLICATIONS SPLUNK V 8.0.5 #572

Open amp4045 opened 3 years ago

amp4045 commented 3 years ago

Re-opening this issue to get some eyes on it :) Thank you all for your dedication & help!

@nwang92 Appears 8.0.5 was the best I could get, with this version I've gotten passed the "waiting for SHC to be ready". Wahoo! It's failing to deploy the shcluster-bundle now. I have those various apps mounted under /tmp/apps/.tgz and provide the SPLUNK_APPS_URL but it appears to never copy the apps from /tmp/apps/.tgz to /opt/splunk/etc/shcluster/apps. Thoughts?

Originally posted by @amp4045 in https://github.com/splunk/splunk-ansible/issues/562#issuecomment-721290903

nwang92 commented 3 years ago

Copying the format of the environment variable from your previous issue:

                       - name: SPLUNK_APPS_URL
                          value: /tmp/apps/myAppHere.tgz

Does the deployer container fail to recognize there are apps to install, or does it fail + crash on attempting to process (untar/cp) the app?

nwang92 commented 3 years ago

Not sure if it's related, but I've seen issues where apps compressed on OSX (or other BSD-based OS) cause problems during the install/extraction. Any tarball should be compressed using tar in a GNU/Linux environment.

amp4045 commented 3 years ago

@nwang92 Sorry for such a late response! The tars were all created on a linux box using ansible's archive built-in command. These were then ansible-synchronized out to the volume (then permissions were set to splunk's user)

I'm thinking it's failing to recognize the app or something as it never mentions the name of the app in the logs. I did see something like "Found N installed apps" and continued to list out the apps. (default apps?) So I'm not sure what's going on further than that.

nwang92 commented 3 years ago

From what I see in your last post with the deployer's k8s manifest, the way you have it set up looks fine. At least, there's nothing that jumps out at me in terms of misconfiguration.

It's a bit difficult to read, but there is a test case that uses a bind-mounted app and has Splunk installing the app from some location on the container's filesystem. So installing from a filepath should be working.

Would it be possible to update the deployer's spec to include a new environment variable:

- name: "DEBUG"
   value: "true"

When this is added, the container bootstrapping process prints out the Ansible inventory/variable as it sees it, which may be helpful in terms of debugging what's wrong. If you don't see the app name in the container logs, we can at least confirm whether or not it gets set properly.