Using external license master fails after change of precedence in SPLUNK_DEFAULTS_URL

[romain-bellanger]

Hello,

In the develop branch, the feature of using an external license master is impacted by a change of precedence of ansible configuration in variable SPLUNK_DEFAULTS_URL, from PR #101.

We are following the provided example to define the general pass4SymmKey:

splunk:
  license_master_url: license-master.splunk.mydomain.com
  pass4SymmKey: P@ssw0rd

However, the pass4SymmKey generated randomly by the operator now takes precedence on the one which we provide as /mnt/splunk-secrets/default.yml is now placed at the end of environment variable SPLUNK_DEFAULTS_URL. When ansible runs and configures the license master connection on pods, it fails as the pass4SymmKey is incorrect and pods don't start.

[akondur]

Thanks for bringing this to our attention. I am currently working on revamping the Password management within the Operator, and it appears that the first commit has unfortunately indirectly broken the External License Master flow.

In the near future (after my next commit), the expected way of setting up external LM would be is:

• Set up a namespace scoped secret object with the desired pass4SymmKey
• Setup a LM secret but with just the license_master_url URL as per using an external license master
• Use defaultsUrl as part of the Custom resource

Expectation would be that the pass4Symmkey from the namespace scoped secret & license_master_url URL from LM secret are together applied to set up the Enterprise pod connected to the external LM. In the future, we may also consider having a better way of setting up the external LM URL

For the immediate situation though, I would request you to consider one of the following options

• Update the pass4SymmKey on each pod
• Temporarily move back to the develop version prior to commit 101

[romain-bellanger]

Thanks for your reply @akondur. I understand that using the develop branch is at our own risk and breaking changes should be expected. However I see that you have done some additional commits, but the documentation to use an external license master has not been updated. It would be very helpful to have the documentation updated together with that kind of change.

In the solution which you describe ("after my next commit"), could you please explain how the secret containing the pass4SymmKey is mounted to the servers? (as I understand defaultsUrl still can't be used for this because of the generated config having higher precedence)

[romain-bellanger]

Hello @akondur. I can see that documentation was added last Friday with #146, so I was finally able to define the pass4symmkey to connect to our license master and use the develop branch (I need the multisite cluster feature which is only in develop, and would like to avoid having to migrate later some new clusters which I have to deploy now). However, I wanted to bring to your attention that the documentation explaining how to connect to an external license master has not been updated.

[akondur]

Hi @romain-bellanger . I hope you are doing well. Thank you for testing out the external License Master implementation and the subsequent reply here. I have raised a PR for the same and I would appreciate a test/review of the same when you find some time(will be pushing this change very soon).

[akondur]

Closing the github issue as the external LM implementation works and documentation has been updated.