Skip to content

Commit 9b7bcdb

Browse files
nwang92nwang92
authored
Adding test and docs to use image as root (#373)
1 parent a2b56b4 commit 9b7bcdb

File tree

2 files changed

+130
-44
lines changed

2 files changed

+130
-44
lines changed

‎docs/EXAMPLES.md‎

Lines changed: 56 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,14 @@ Note that for more complex scenarios, we will opt to use a [Docker compose file]
1515
* [...with a SplunkBase app](#create-standalone-with-splunkbase-app)
1616
* [...with SSL enabled](#create-standalone-with-ssl-enabled)
1717
* [...with a Splunk Free license](#create-standalone-with-splunk-free-license)
18+
* [Create sidecar forwarder running as root](#create-sidecar-root-forwarder)
1819
* [Create standalone and universal forwarder](#create-standalone-and-universal-forwarder)
1920
* [Create heavy forwarder](#create-heavy-forwarder)
2021
* [Create heavy forwarder and deployment server](#create-heavy-forwarder-and-deployment-server)
2122
* [Create indexer cluster](#create-indexer-cluster)
2223
* [Create search head cluster](#create-search-head-cluster)
2324
* [Create indexer cluster and search head cluster](#create-indexer-cluster-and-search-head-cluster)
2425
* [Enable root endpoint on SplunkWeb](#enable-root-endpoint-on-splunkweb)
25-
* [Create sidecar forwarder](#create-sidecar-forwarder)
2626
* [More](#more)
2727

2828
## Create standalone from CLI
@@ -221,6 +221,61 @@ $ docker run --name so1 --hostname so1 -p 8000:8000 \
221221
-it splunk/splunk:latest
222222
```
223223

224+
## Create sidecar root forwarder
225+
226+
<details><summary markdown='span'><code>k8s-sidecar.yml</code></summary><p></p>
227+
228+
```yaml
229+
apiVersion: v1
230+
kind: Pod
231+
metadata:
232+
name: example
233+
spec:
234+
securityContext:
235+
runAsUser: 0
236+
runAsGroup: 0
237+
containers:
238+
- name: splunk-uf
239+
image: splunk/universalforwarder:latest
240+
env:
241+
- name: SPLUNK_START_ARGS
242+
value: --accept-license
243+
- name: SPLUNK_USER
244+
value: root
245+
- name: SPLUNK_GROUP
246+
value: root
247+
- name: SPLUNK_PASSWORD
248+
value: helloworld
249+
- name: SPLUNK_CMD
250+
value: add monitor /var/log/
251+
- name: SPLUNK_STANDALONE_URL
252+
value: splunk.company.internal
253+
volumeMounts:
254+
- name: shared-data
255+
mountPath: /var/log
256+
- name: my-app
257+
image: my-app
258+
volumeMounts:
259+
- name: shared-data
260+
mountPath: /app/logs/
261+
volumes:
262+
- name: shared-data
263+
emptyDir: {}
264+
```
265+
</details><p></p>
266+
267+
Execute the following to bring up your deployment:
268+
```
269+
$ kubectl apply -f k8s-sidecar.yml
270+
```
271+
272+
Alternatively, if you're not using Kubernetes you can use the Docker CLI to bring up the Universal Forwarder under the `root` user with the following:
273+
```
274+
$ docker run -d -P --user root -e SPLUNK_START_ARGS=--accept-license -e SPLUNK_PASSWORD=helloworld -e SPLUNK_USER=root -e SPLUNK_GROUP=root splunk/universalforwarder:latest
275+
```
276+
277+
After your pod is ready, the universal forwarder will be reading the logs generated by your app via the shared volume mount. In the ideal case, your app is generating the logs while the forwarder is reading them and streaming the output to a separate Splunk instance located at splunk.company.internal.
278+
224279
## Create standalone and universal forwarder
225280
You can also enable distributed deployments. In this case, we can create a Splunk universal forwarder running in a container to stream logs to a Splunk standalone, also running in a container.
226281

@@ -855,48 +910,5 @@ $ SPLUNK_PASSWORD=<password> docker-compose up -d
855910

856911
Then, visit SplunkWeb on your browser with the root endpoint in the URL, such as `http://localhost:8000/splunkweb`.
857912

858-
## Create sidecar forwarder
859-
860-
<details><summary markdown='span'><code>k8s-sidecar.yml</code></summary><p></p>
861-
862-
```yaml
863-
apiVersion: v1
864-
kind: Pod
865-
metadata:
866-
name: example
867-
spec:
868-
containers:
869-
- name: splunk-uf
870-
image: splunk/universalforwarder:latest
871-
env:
872-
- name: SPLUNK_START_ARGS
873-
value: --accept-license
874-
- name: SPLUNK_PASSWORD
875-
value: helloworld
876-
- name: SPLUNK_CMD
877-
value: add monitor /var/log/
878-
- name: SPLUNK_STANDALONE_URL
879-
value: splunk.company.internal
880-
volumeMounts:
881-
- name: shared-data
882-
mountPath: /var/log
883-
- name: my-app
884-
image: my-app
885-
volumeMounts:
886-
- name: shared-data
887-
mountPath: /app/logs/
888-
volumes:
889-
- name: shared-data
890-
emptyDir: {}
891-
```
892-
</details><p></p>
893-
894-
Execute the following to bring up your deployment:
895-
```
896-
$ kubectl apply -f k8s-sidecar.yml
897-
```
898-
899-
After your pod is ready, the universal forwarder will be reading the logs generated by your app via the shared volume mount. In the ideal case, your app is generating the logs while the forwarder is reading them and streaming the output to a separate Splunk instance located at splunk.company.internal.
900-
901913
## More
902914
There are a variety of Docker compose scenarios in the `docker-splunk` repo [here](https://github.com/splunk/docker-splunk/tree/develop/test_scenarios). Feel free to use any of those for reference in deploying different topologies!

‎tests/test_docker_splunk.py‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1445,6 +1445,80 @@ def test_adhoc_1uf_bind_mount_apps(self):
14451445
except OSError:
14461446
pass
14471447

1448+
def test_adhoc_1so_run_as_root(self):
1449+
# Create a splunk container
1450+
cid = None
1451+
try:
1452+
splunk_container_name = generate_random_string()
1453+
cid = self.client.create_container(self.SPLUNK_IMAGE_NAME, tty=True, ports=[8089], name=splunk_container_name, user="root",
1454+
environment={
1455+
"DEBUG": "true",
1456+
"SPLUNK_START_ARGS": "--accept-license",
1457+
"SPLUNK_PASSWORD": self.password,
1458+
"SPLUNK_USER": "root",
1459+
"SPLUNK_GROUP": "root"
1460+
},
1461+
host_config=self.client.create_host_config(port_bindings={8089: ("0.0.0.0",)})
1462+
)
1463+
cid = cid.get("Id")
1464+
self.client.start(cid)
1465+
# Poll for the container to be ready
1466+
assert self.wait_for_containers(1, name=splunk_container_name)
1467+
# Check splunkd
1468+
splunkd_port = self.client.port(cid, 8089)[0]["HostPort"]
1469+
url = "https://localhost:{}/services/server/info".format(splunkd_port)
1470+
kwargs = {"auth": ("admin", self.password), "verify": False}
1471+
status, content = self.handle_request_retry("GET", url, kwargs)
1472+
assert status == 200
1473+
# Check that root owns the splunkd process
1474+
exec_command = self.client.exec_create(cid, "ps -u root", user="root")
1475+
std_out = self.client.exec_start(exec_command)
1476+
assert "entrypoint.sh" in std_out
1477+
assert "splunkd" in std_out
1478+
except Exception as e:
1479+
self.logger.error(e)
1480+
raise e
1481+
finally:
1482+
if cid:
1483+
self.client.remove_container(cid, v=True, force=True)
1484+
1485+
def test_adhoc_1uf_run_as_root(self):
1486+
# Create a uf container
1487+
cid = None
1488+
try:
1489+
splunk_container_name = generate_random_string()
1490+
cid = self.client.create_container(self.UF_IMAGE_NAME, tty=True, ports=[8089], name=splunk_container_name, user="root",
1491+
environment={
1492+
"DEBUG": "true",
1493+
"SPLUNK_START_ARGS": "--accept-license",
1494+
"SPLUNK_PASSWORD": self.password,
1495+
"SPLUNK_USER": "root",
1496+
"SPLUNK_GROUP": "root"
1497+
},
1498+
host_config=self.client.create_host_config(port_bindings={8089: ("0.0.0.0",)})
1499+
)
1500+
cid = cid.get("Id")
1501+
self.client.start(cid)
1502+
# Poll for the container to be ready
1503+
assert self.wait_for_containers(1, name=splunk_container_name)
1504+
# Check splunkd
1505+
splunkd_port = self.client.port(cid, 8089)[0]["HostPort"]
1506+
url = "https://localhost:{}/services/server/info".format(splunkd_port)
1507+
kwargs = {"auth": ("admin", self.password), "verify": False}
1508+
status, content = self.handle_request_retry("GET", url, kwargs)
1509+
assert status == 200
1510+
# Check that root owns the splunkd process
1511+
exec_command = self.client.exec_create(cid, "ps -u root", user="root")
1512+
std_out = self.client.exec_start(exec_command)
1513+
assert "entrypoint.sh" in std_out
1514+
assert "splunkd" in std_out
1515+
except Exception as e:
1516+
self.logger.error(e)
1517+
raise e
1518+
finally:
1519+
if cid:
1520+
self.client.remove_container(cid, v=True, force=True)
1521+
14481522
def test_adhoc_1so_hec_idempotence(self):
14491523
"""
14501524
This test is intended to check how the container gets provisioned with changing splunk.hec.* parameters

0 commit comments

Comments
 (0)