Splunk Operator: Containers Need Readonly Root Filesystem

[thormanrd]

Please select the type of request

Enhancement

Tell us more

Describe the request

• All the containers the Splunk Operator for Kubernetes uses or deploy needs to honor a readonly root file system. There is nothing in the / or /root filesystem that should be writeable in any container the Splunk Operator uses or deploys. This is a compliance issue in most large organizations.

Expected behavior

• All root filesystems (e.g. / and /root) should be readonly.

Splunk setup on K8S

• This is critical to large, clustered environments with many indexers, search heads, and forwarders.

Reproduction/Testing steps

• Install Splunk using the operator and verify all nodes created have readonly root filesystems.

• K8s environment

• This comes from a large Splunk platform using Azure Kubernetes Service

• Proposed changes(optional)

• Proposed change, if any.

K8s collector data(optional)

• Please provide data collected from the K8s collectors, if any.

Additional context(optional)

• Add any other context about the problem here.

[vivekr-splunk]

@thormanrd, we're collaborating with our internal team and product department to assess the feasibility of prioritizing this feature change. The change is necessary in Splunk Ansible, and redesigning it entails eliminating the use of sudo. We'll provide you with an update on the timelines shortly.

[yaroslav-nakonechnikov]

@thormanrd why this is here and not in https://github.com/splunk/docker-splunk ?

[thormanrd]

@yaroslav-nakonechnikov because the operator has it's own issues for read-only settings and then deploys containers with issues.

[yaroslav-nakonechnikov]

i've re-read description, and it is still not clear which container is affected. for splunk-operator image? or just splunk? for splunk - root cause is docker-splunk project, and creating ticket here won't help in any way... just because i already struggle a lot with that project.

and if you have access to splunk support - please, also raise ticket there, for reference. otherwise i have a strong feeling that all issues in gh are considered as low priority.