splunk / splunk-operator

Splunk Operator for Kubernetes
Other
209 stars 115 forks source link

Can't login to Standalone Splunk, when replicas=3 #913

Closed hausanstreicha closed 2 years ago

hausanstreicha commented 2 years ago

Please select the type of request

Bug

Tell us more

Describe the request If I set the replicacount to 3, I can't log into splunk enterprise.

Expected behavior When replicas = 3, the login should be possible.

Splunk setup on K8S

apiVersion: enterprise.splunk.com/v3
kind: Standalone
metadata:
  name: standalone
  namespace: splunk
  labels:
    app: splunkstandalone
spec:
  replicas: 3
  etcVolumeStorageConfig:
    storageClassName: rook-ceph-block
    storageCapacity: 20Gi
  varVolumeStorageConfig:
    storageClassName: rook-ceph-block
    storageCapacity: 200Gi
  resources:
    requests:
      memory: "8Gi"
      cpu: "4"
    limits:
      memory: "8Gi"
      cpu: "4"
  affinity:
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        - labelSelector:
            matchExpressions:
              - key: app
                operator: In
                values:
                  - splunkstandalone
          topologyKey: "kubernetes.io/hostname"

Reproduction/Testing steps set replicas to 3 in the CR with:

spec:
  replicas: 3

K8s environment v.1.24.1

Additional context(optional) Homepage is loading correcty, but when I try to login the page starts reloading. Same setup works as expected with replicas: 1

satellite-no commented 2 years ago

I dont believe you would want to run a standalone instance with replicas: 3, which is probably why you are seeing issues. Splunk is a legacy application being adapted to run in a container and not natively built for that sort of architecture so running with 3 replicas basically creates three separate Splunk instances with different logs and different running configs loaded into memory. The service serving the application would load balance to each and you would get very different search results and log splitting.

pogdin commented 2 years ago

No, it's ok @satellite-no , the use case for having multiple replicas on standalone is the Heavyweight Forwarder scenario. How are you trying to log in @hausanstreicha ? Just using kubectl port-forward <pod-name> 8000 should give you the Splunk Web UI for that instance.

hausanstreicha commented 2 years ago

I'm using Traefik (Ingressroute) for that:

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: splunk
  namespace: splunk
spec:
  entrypoint:
  - websecure
  routes:
  - kind: Rule
    match: Host(`example.com`)
    middlewares:
    - name: hsts
      namespace: splunk
    services:
    - name: splunk-standalone-standalone-service
      namespace: splunk
      port: 8000
  tls:
    options:
      name: defaulttlsoptions
      namespace: splunk
    secretName: splunk-le-secret

Just to be clear: I'm able to access the site, but if I enter the credentials and want to login, I'm getting a white screen and then the site is just reloading and I'm back at the login screen. I can login normally when replica is set to 1.

Edit: It works, when I'm using port forward. So the problem seems to be traefik related. Sorry for the inconvenience and thanks your help.