Splunk Operator: Does not allow setting specific AWS IMDS version

[w00jay]

Please select the type of request

Enhancement

Tell us more

Describe the request

• The Operator workflow does not allow setting of [imds] stanza in server.conf and relies on the system default. Splunk CRDs do not contain necessary spec to configure IMDS version and Splunk-ansible does not have any related options either.

Expected behavior

• A user should be able to select specific IMDS version other than default, namely v2

Splunk setup on K8S

• Splunk operator 1.0.5 with Splunk 8.2.3 on EKS

Reproduction/Testing steps

• Cluster pods report splunk relying on the system default version of IMDS when running ./splunk btool server list --debug | grep imds. This will report:

./splunk btool server list imds --debug
/opt/splunk/etc/system/default/server.conf [imds]
/opt/splunk/etc/system/default/server.conf imds_version = v1

K8s environment

• EKS 1.22

[markusspitzli]

Hey @w00jay

Actually you can set the parameter in docker-splunk by using default.yml.

You just have to define a default.yml config map and use the defaultUrlparameter

Your configmap could look like this:

apiVersion: v1
kind: ConfigMap
metadata:
  name: splunk-defaults
data:
  default.yml: |
    splunk:
      conf: 
        - key: server
          value:
            directory: /opt/splunk/etc/system/local
            content:
              "imds":
                imds_version: v2

An additional thing I want to point out. You should upgrade the splunk operator to the latest version. It has a lot of bugfixes. I really enjoy using the helmcharts. But you will have to upgrade the Splunk Enterprise as well.

[w00jay]

@markusspitzli thank you for the quick solution!