From 4b5c9d6ec1318aeb399147f11992b4d1e8f4da6c Mon Sep 17 00:00:00 2001
From: Szymon Bylica <142112966+sbylica-splunk@users.noreply.github.com>
Date: Mon, 11 Aug 2025 14:16:23 +0200
Subject: [PATCH 1/2] Added docs for EKS deployment (#2785)

* Added docs for EKS deployment

* Changed some examples in Ansible documentation
---
 ansible/resources/env_file                   |   2 +-
 docs/gettingstarted/ansible-docker-podman.md |   8 +-
 docs/gettingstarted/ansible-docker-swarm.md  |   2 +-
 docs/gettingstarted/eks.md                   | 106 +++++++++++++++++++
 docs/resources/docker/sc4s_deployment.yaml   |  85 +++++++++++++++
 mkdocs.yml                                   |   2 +
 6 files changed, 199 insertions(+), 6 deletions(-)
 create mode 100644 docs/gettingstarted/eks.md
 create mode 100644 docs/resources/docker/sc4s_deployment.yaml

diff --git a/ansible/resources/env_file b/ansible/resources/env_file
index 9f73a6d46c..3eb4275e4d 100644
--- a/ansible/resources/env_file
+++ b/ansible/resources/env_file
@@ -1,4 +1,4 @@
-SC4S_DEST_SPLUNK_HEC_DEFAULT_URL=http://xxx.xxx.xxx.xxx:8088
+SC4S_DEST_SPLUNK_HEC_DEFAULT_URL=https://xxx.xxx.xxx.xxx:8088
 SC4S_DEST_SPLUNK_HEC_DEFAULT_TOKEN=xxxxxxxxxxxxxxxxxx
 #Uncomment the following line if using untrusted SSL certificates
 #SC4S_DEST_SPLUNK_HEC_DEFAULT_TLS_VERIFY=no
\ No newline at end of file
diff --git a/docs/gettingstarted/ansible-docker-podman.md b/docs/gettingstarted/ansible-docker-podman.md
index 3f890ffa7a..1de2f6fd6b 100644
--- a/docs/gettingstarted/ansible-docker-podman.md
+++ b/docs/gettingstarted/ansible-docker-podman.md
@@ -23,16 +23,16 @@ docker exec -it ansible_sc4s /bin/bash
 
 * To authenticate with username and password:
 ``` bash 
-ansible-playbook -i path/to/inventory.yaml -u <username> --ask-pass path/to/playbooks/docker.yml
+ansible-playbook -i ansible/inventory/inventory.yaml -u <username> --ask-pass ansible/playbooks/playbooks/docker.yml
 or
-ansible-playbook -i path/to/inventory.yaml -u <username> --ask-pass path/to/playbooks/podman.yml
+ansible-playbook -i ansible/inventory/inventory.yaml -u <username> --ask-pass ansible/playbooks/playbooks/podman.yml
 
 ```
 * To authenticate using a key pair:
 ``` bash 
-ansible-playbook -i path/to/inventory.yaml -u <username> --key-file <key_file> path/to/playbooks/docker.yml
+ansible-playbook -i ansible/inventory/inventory.yaml -u <username> --key-file <key_file> ansible/playbooks/playbooks/docker.yml
 or
-ansible-playbook -i path/to/inventory.yaml -u <username> --key-file <key_file> path/to/playbooks/podman.yml
+ansible-playbook -i ansible/inventory/inventory.yaml -u <username> --key-file <key_file> ansible/playbooks/playbooks/podman.yml
 ```
 
 # Step 3: Validate your configuration
diff --git a/docs/gettingstarted/ansible-docker-swarm.md b/docs/gettingstarted/ansible-docker-swarm.md
index a34f4c1336..39417f3d96 100644
--- a/docs/gettingstarted/ansible-docker-swarm.md
+++ b/docs/gettingstarted/ansible-docker-swarm.md
@@ -51,7 +51,7 @@ ansible-playbook -i path/to/inventory_swarm.yaml -u <username> --key-file <key_f
 |sc4s    | 1        | Swarm        |
 
 * To scale your number of services:
-```sudo docker service update --replicas 2 sc4s_sc4s```
+```sudo docker service update --replicas 2 SC4S_sc4s```
 
 * To see services running in a given stack: 
 ```sudo docker stack services sc4s```
diff --git a/docs/gettingstarted/eks.md b/docs/gettingstarted/eks.md
new file mode 100644
index 0000000000..8672eef97c
--- /dev/null
+++ b/docs/gettingstarted/eks.md
@@ -0,0 +1,106 @@
+You can install SC4S on AWS with EKS. To do this, you can use a deployment file and a basic configuration information.
+
+Refer to AWS [documentation](https://docs.aws.amazon.com/eks/latest/userguide/sample-deployment.html) on how to set up your AWS environment. 
+
+Before you begin you also need to have `kubectl` installed.
+
+# Prepare your initial configuration
+1. First create a file named `/opt/sc4s/env_file` and add the following environment variables and values:
+
+``` dotenv
+--8<---- "ansible/resources/env_file"
+```
+Then create a configmap with variables provided in the file
+```
+kubectl create configmap sc4s-config --from-env-file=/opt/sc4s/env_file -n sc4s
+```
+
+2. Create a deployment configuration file based on this:
+``` yaml
+--8<---- "docs/resources/docker/sc4s_deployment.yaml"
+```
+
+Please note that this file may need to be modified based on your requirements, such as the ports being used.
+You can view the default range of ports opened by the nodePort [here](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport).
+
+3. (Optioinal) To use local filters you have to load them into a configmap, and uncomment parts of the deployment file related to them:
+
+```
+kubectl create configmap sc4s-local-filter-config \                  
+  --from-file=/opt/sc4s/local/config/app_parsers  -n sc4s
+```
+
+This loads files from app_parsers directory only, [here](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#create-configmaps-from-files) is the documentation explaining other use cases.
+
+# Deploy SC4S with your configuration
+1. To run SC4S simply run this command in the directory where your deployment file is located:
+```bash
+kubectl apply -f sc4s_deployment.yaml
+```
+
+You can use a load balancer with SC4S, to set it up properly refer to our [documentation](../architecture/lb/index.md).
+
+2. You can use following commands to check if SC4S deployment and NodePort service is running.
+
+To get pods:
+```bash
+kubectl get pods -n sc4s
+```
+
+To get NodePort service:
+```bash
+kubectl get services -n sc4s
+```
+
+Check the logs using this command:
+```bash
+kubectl logs {your_pod_name} -n sc4s
+```
+
+You should see something like this:
+```ini
+SC4S_ENV_CHECK_HEC: Splunk HEC connection test successful to index=main for sourcetype=sc4s:fallback...
+SC4S_ENV_CHECK_HEC: Splunk HEC connection test successful to index=main for sourcetype=sc4s:events...
+syslog-ng checking config
+sc4s version=3.37.0
+Configuring the health check port to: 8080
+[2025-08-01 17:40:50 +0000] [130] [INFO] Starting gunicorn 23.0.0
+[2025-08-01 17:40:50 +0000] [130] [INFO] Listening at: http://0.0.0.0:8080 (130)
+[2025-08-01 17:40:50 +0000] [130] [INFO] Using worker: sync
+[2025-08-01 17:40:50 +0000] [133] [INFO] Booting worker with pid: 133
+starting syslog-ng
+```
+
+If the pod does not start you can debug it with this command:
+```bash
+kubectl describe pod {your_pod_name} -n sc4s
+```
+
+3. You can use following commands to check if SC4S deployment and NodePort service is running.
+
+
+# Validate your configuration
+
+SC4S performs checks to ensure that the container starts properly and that the syntax of the underlying syslog-ng
+configuration is correct. Once the checks are complete, validate that SC4S properly communicate with Splunk.
+To do this, execute the following search in Splunk:
+
+```ini
+index=* sourcetype=sc4s:events "starting up"
+```
+
+# Update SC4S 
+Whenever the image is upgraded or when you want your configuration changes to be applied, run the command:
+
+```bash
+kubectl apply -f sc4s_deployment.yaml
+```
+
+Kubectl will detect if there are any changes to be made and rollout new pods if necessary.
+
+# Stop SC4S
+
+To delete the deployment run this command in the directory where your deployment file is located:
+```bash
+kubectl delete -f sc4s_deployment.yaml
+```
diff --git a/docs/resources/docker/sc4s_deployment.yaml b/docs/resources/docker/sc4s_deployment.yaml
new file mode 100644
index 0000000000..9a3c555a2a
--- /dev/null
+++ b/docs/resources/docker/sc4s_deployment.yaml
@@ -0,0 +1,85 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sc4s-deployment
+  namespace: sc4s
+  labels:
+    app: sc4s-app
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sc4s-app
+  template:
+    metadata:
+      labels:
+        app: sc4s-app
+    spec:
+      volumes:
+      - name: config-volume
+        configMap:
+          name: sc4s-config
+      # Uncomment only if local parser used
+      # - name: local-filter-config
+      #   configMap:
+      #     name: sc4s-local-filter-config 
+
+      containers:
+      - name: sc4s
+        image: ghcr.io/splunk/splunk-connect-for-syslog/container3:latest
+        imagePullPolicy: IfNotPresent
+
+        resources:  
+          requests:
+            cpu: "500m"
+            memory: "512Mi"
+          limits:
+            cpu: "2000m"
+            memory: "2Gi"
+
+        envFrom:
+          - configMapRef:
+              name: sc4s-config
+
+        # Uncomment only if local parser used
+        # volumeMounts:
+        # - name: local-filter-config
+        #   mountPath: /etc/syslog-ng/conf.d/local/config/app_parsers
+        #   readOnly: true
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sc4s-nodeport-service
+  namespace: sc4s
+spec:
+  selector:
+    app: sc4s-app
+  type: NodePort 
+  ports:
+    - port: 514
+      targetPort: 514
+      name: "tcp514"
+      protocol: TCP
+      nodePort: 30514
+    - port: 514
+      targetPort: 514
+      name: "udp514"
+      protocol: UDP
+      nodePort: 30514
+    - port: 601
+      targetPort: 601
+      name: "tcp601"
+      protocol: TCP
+      nodePort: 30601
+    - port: 6514
+      targetPort: 6514
+      name: "tcp6514"
+      protocol: TCP
+      nodePort: 30515
+    - port: 8080
+      targetPort: 8080
+      name: "healthcheck"
+      protocol: TCP
+      nodePort: 30080
diff --git a/mkdocs.yml b/mkdocs.yml
index 450ef561c0..37026b3a67 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -64,6 +64,8 @@ nav:
           - Docker Swarm: "gettingstarted/ansible-docker-swarm.md"
           - Podman/Docker: "gettingstarted/ansible-docker-podman.md"
           - mk8s: "gettingstarted/ansible-mk8s.md"
+        - Cloud (Experimental):
+          - EKS (Experimental): "gettingstarted/eks.md"
   - Create a parser: "create-parser.md"
   - Configuration: "configuration.md"
   - Destinations: "destinations.md"

From 7c343f8bc6ea7f6ccec8ae1e0b2a0492c35357af Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 20 Aug 2025 00:47:57 +0000
Subject: [PATCH 2/2] chore(deps): update dependency flask to v3.1.2

---
 poetry.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/poetry.lock b/poetry.lock
index a6b91f6899..08237f5d94 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -512,14 +512,14 @@ files = [
 
 [[package]]
 name = "flask"
-version = "3.1.1"
+version = "3.1.2"
 description = "A simple framework for building complex web applications."
 optional = false
 python-versions = ">=3.9"
 groups = ["main"]
 files = [
-    {file = "flask-3.1.1-py3-none-any.whl", hash = "sha256:07aae2bb5eaf77993ef57e357491839f5fd9f4dc281593a81a9e4d79a24f295c"},
-    {file = "flask-3.1.1.tar.gz", hash = "sha256:284c7b8f2f58cb737f0cf1c30fd7eaf0ccfcde196099d24ecede3fc2005aa59e"},
+    {file = "flask-3.1.2-py3-none-any.whl", hash = "sha256:ca1d8112ec8a6158cc29ea4858963350011b5c846a414cdb7a954aa9e967d03c"},
+    {file = "flask-3.1.2.tar.gz", hash = "sha256:bf656c15c80190ed628ad08cdfd3aaa35beb087855e2f494910aa3774cc4fd87"},
 ]
 
 [package.dependencies]