GitHub puppet-splunk

Manage Splunk servers and forwarders using Puppet

This pull request add the option service_ensure, to make it possible to stop the service in case.

<!--
Thank you for contributing to this project!

• This project has a Contributor Code of Conduct: https://voxpupuli.org/coc/
• Please check that here is no existing issue or PR that addresses your problem.
• Our vulnerabilities reporting process is at https://voxpupuli.org/security/

-->

Pull Request (PR) description

<!--
The root url is described as puppet:///modules/splunk This means the illustration of the directory structure for the products path starts in the root of the module, which has caused confusion to some users
-->

This Pull Request (PR) fixes the following issues

<!--
Fixes #257
-->

implement the manage_dependencies variable to manage external dependencies for forwarder and entreprise.

Solving issue #275

Pull Request (PR) description

The function "is_global?" should be named "global?".

Reference: https://github.com/puppetlabs/puppetlabs-inifile/blob/main/lib/puppet/util/ini_file/section.rb#L28-L30

This Pull Request (PR) fixes the following issues

n/a

Pull Request (PR) description

This PR adds support to use a given proxy for install the forwarder and enterprise Splunk. It simply passes the options to puppet-archive.

This Pull Request (PR) fixes the following issues

Pull Request (PR) description

Pull request fixes a resource override scoping issue in splunk::forwarder::install.

When being installed on a machine with no existing installation of the net-tools package, the generic override of::

puppet
Package {
source => $splunk::forwarder::package_provider ? {
'chocolatey' => undef,
default => $splunk::forwarder::manage_package_source ? {
true => pick($_staged_package, $_package_source),
false => $_package_source,
}
},
}


Results in a net-tools resource of:

puppet
package { 'net-tools':
ensure => 'present',
source => $splunk::forwarder::manage_package_source,
before => Package[splunkforwarder],
}


This Pull Request (PR) fixes the following issues

n/a.

<!--
Thank you for contributing to this project!

• This project has a Contributor Code of Conduct: https://voxpupuli.org/coc/
• Please check that here is no existing issue or PR that addresses your problem.
• Our vulnerabilities reporting process is at https://voxpupuli.org/security/

-->

Pull Request (PR) description

<!--
Replace this comment with a description of your pull request.
-->

This Pull Request (PR) fixes the following issues

<!--
Replace this comment with the list of issues or n/a.
Use format:
Fixes #123
Fixes #124
-->

• Moved defaults to module data, and removed the params class
• Privatized all splunk::enterprise:: and splunk::forwarder:: install, config, and service classes
• Added a $release param, which replaces the $version param
  • For ensurable package_providers, the release is used as the Splunk package ensure, if specified
  • The release no longer defaults to a specific version and build, instead, the Splunk package resource defaults ensure to 'installed'
  • Added a Splunk::Release type
• Added a service_ensure param, per #249
• Modified splunk*_version facts to be part of splunkforwarder and splunkenterprise fact hashes
• Removed init.pp, which only served to confuse
• $[enterprise,forwarder]_package_src and $package_source params renamed to $managed_package_source and $unmanaged_package_source, for clarity
• Fixed: enterprise and forwarder password classes cross-referenced params

Fixed #230
Fixed #232
Fixed #235
Fixed #249

This allows upgrading splunkforwarder by bumping version/build passed to this module. As a workaround more or less for https://github.com/voxpupuli/puppet-splunk/issues/125.

Changing the version/build parameters to splunk::params results in:

Notice: /Stage[main]/Splunk::Forwarder/Package[splunkforwarder]/ensure: ensure changed '6.5.1-f74036626f0c' to '6.6.2'


Only implemented for splunkforwarder and tested on CentOS right now. If there's interest I can expand it to support splunk and test on other distributions.

• Change "ensure" to an explicit version (otherwise only the file in /opt/staging will be added when $version is bumped)
• Extra handling of accepting the license

ensure => absent for the ftr file might even completely replace Exec['license_splunkforwarder'] eventually (untested, however)

<!--
Thank you for contributing to this project!

• This project has a Contributor Code of Conduct: https://voxpupuli.org/coc/
• Please check that here is no existing issue or PR that addresses your problem.
• Our vulnerabilities reporting process is at https://voxpupuli.org/security/

-->

Without this the upgrade from v8 to v9 forwarder would timeout on the stop command as it ends up forwarding start/stop to systemd so the start will actually start the service with v9.

I could really use a second pair of 👀 on this. I was sifting through the issues on github for this module and noticed someone having a problem a RHEL 7. While i was not able to reproduce their issue specifically ( i assume it's fixed ) i did notice the idempotence test for the forwarder is failing when run under beaker. I know pretty much nothing about se_linux on RHEL 7 but what i do know is the following attribute on the file resource solves the forwarder idempotence test. Could anyone verify this fix is indeed valid?

FYI. Here is the failing beaker test without this change.

First Run

Info: Loading facts
Info: Loading facts
Warning: /etc/puppetlabs/puppet/hiera.yaml: Use of 'hiera.yaml' version 3 is deprecated. It should be converted to version 5
(in /etc/puppetlabs/puppet/hiera.yaml)
Notice: Compiled catalog for rhel-74-x64.attlocal.net in environment production in 0.46 seconds
Info: Applying configuration version '1507523793'
Notice: /Stage[main]/Archive::Staging/File[/opt/staging]/ensure: created
Notice: /Stage[main]/Splunk::Forwarder/Archive[/opt/staging/splunk/splunkforwarder-7.0.0-c8a78efdd40f-linux-2.6-x86_64.rpm]/ensure: download archive from https://download.splunk.com/products/universalforwarder/releases/7.0.0/linux/splunkforwarder-7.0.0-c8a78efdd40f-linux-2.6-x86_64.rpm to /opt/staging/splunk/splunkforwarder-7.0.0-c8a78efdd40f-linux-2.6-x86_64.rpm with cleanup
Notice: /Stage[main]/Splunk::Forwarder/Package[splunkforwarder]/ensure: created
Notice: /Stage[main]/Splunk::Forwarder/Splunkforwarder_input[default_host]/ensure: created
Info: /Stage[main]/Splunk::Forwarder/Splunkforwarder_input[default_host]: Scheduling refresh of Service[splunk]
Notice: /Stage[main]/Splunk::Forwarder/Splunkforwarder_output[tcpout_defaultgroup]/ensure: created
Info: /Stage[main]/Splunk::Forwarder/Splunkforwarder_output[tcpout_defaultgroup]: Scheduling refresh of Service[splunk]
Notice: /Stage[main]/Splunk::Forwarder/Splunkforwarder_output[defaultgroup_server]/ensure: created
Info: /Stage[main]/Splunk::Forwarder/Splunkforwarder_output[defaultgroup_server]: Scheduling refresh of Service[splunk]
Notice: /Stage[main]/Splunk::Forwarder/Splunkforwarder_web[forwarder_splunkd_port]/ensure: created
Info: /Stage[main]/Splunk::Forwarder/Splunkforwarder_web[forwarder_splunkd_port]: Scheduling refresh of Service[splunk]
Notice: /Stage[main]/Splunk::Forwarder/File[/opt/splunkforwarder/etc/system/local/deploymentclient.conf]/ensure: created
Notice: /Stage[main]/Splunk::Forwarder/File[/opt/splunkforwarder/etc/system/local/inputs.conf]/mode: mode changed '0644' to '0600'
Notice: /Stage[main]/Splunk::Forwarder/File[/opt/splunkforwarder/etc/system/local/inputs.conf]/seluser: seluser changed 'unconfined_u' to 'system_u'
Notice: /Stage[main]/Splunk::Forwarder/File[/opt/splunkforwarder/etc/system/local/outputs.conf]/mode: mode changed '0644' to '0600'
Notice: /Stage[main]/Splunk::Forwarder/File[/opt/splunkforwarder/etc/system/local/outputs.conf]/seluser: seluser changed 'unconfined_u' to 'system_u'
Notice: /Stage[main]/Splunk::Forwarder/File[/opt/splunkforwarder/etc/system/local/web.conf]/mode: mode changed '0644' to '0600'
Notice: /Stage[main]/Splunk::Forwarder/File[/opt/splunkforwarder/etc/system/local/web.conf]/seluser: seluser changed 'unconfined_u' to 'system_u'
Notice: /Stage[main]/Splunk::Forwarder/File[/opt/splunkforwarder/etc/system/local/limits.conf]/ensure: created
Notice: /Stage[main]/Splunk::Forwarder/File[/opt/splunkforwarder/etc/system/local/server.conf]/ensure: created
Notice: /Stage[main]/Splunk::Platform::Posix/Exec[license_splunkforwarder]/returns: executed successfully
Notice: /Stage[main]/Splunk::Platform::Posix/Exec[enable_splunkforwarder]/returns: executed successfully
Info: /Stage[main]/Splunk::Platform::Posix/Exec[enable_splunkforwarder]: Scheduling refresh of Service[splunk]
Notice: /Stage[main]/Splunk::Virtual/Service[splunk]/ensure: ensure changed 'stopped' to 'running'
Info: /Stage[main]/Splunk::Virtual/Service[splunk]: Unscheduling refresh on Service[splunk]
Info: Creating state file /opt/puppetlabs/puppet/cache/state/state.yaml
Notice: Applied catalog in 10.79 seconds


Second run
```
Info: Loading facts
Info: Loading facts
Warning: /etc/puppetlabs/puppet/hiera.yaml: Use of 'hiera.yaml' version 3 is deprecated. It should be converted to version 5
(in /etc/puppetlabs/puppet/hiera.yaml)
Notice: Compiled catalog for rhel-74-x64.attlocal.net in environment production in 0.44 seconds
Info: Applying configuration version '1507523806'
Notice: /Stage[main]/Splunk::Forwarder/File[/opt/splunkforwarder/etc/system/local/server.conf]/seluser: seluser changed 'unconfinedu' to 'systemu'
Notice: Applied catalog in 0.17 seconds

```

Pull Request (PR) description

This will allow for creating a blank new addon to manage if not using a source.

This Pull Request (PR) fixes the following issues

Fixes #386

Pull Request (PR) description

Adding support for installing/configuring/managing the Edge Processor from Splunk.

This Pull Request (PR) fixes the following issues

Fixes #388

On windows we need to set delayed for the service

Pull Request (PR) description

Issue_383: Make the ensure and enable parameter of the splunk forwarder service configurable
We need to set enable to delayed on windows servers

This Pull Request (PR) fixes the following issues

Fixes #383