topic Permissions issue in Docker container in Splunk Enterprise

Permissions issue in Docker container

thoyt — Wed, 10 Jun 2020 16:54:53 GMT

When splunk starts it seems to try and chown the config files (ie. web.conf) to whatever user splunk is currently running as. This causes an issue with Kubernetes deployments.

When you mount configuration files through a ConfigMap it mounts the volumes as read only owned by root. This would still allow non-root processes to read. However when splunk tries to start the chown fails, causing the container to fail as well.

Is there a flag to disable chown-ing config files on start, or is this something than can be put in a change request and removed form startup all together?

Re: Permissions issue in Docker container

codebuilder — Tue, 16 Apr 2019 15:46:24 GMT

See my response on this thread:

Re: Permissions issue in Docker container

jhomerlopez — Thu, 06 May 2021 08:34:44 GMT

I encounter this as well when running splunkforwarder on kubernetes cluster as daemonset. This was solved by mounting the volume to /opt/splunkforwarder-etc/ instead of /opt/splunkforwarder. It seems that all the local/custom configuration should be implemented on /opt/splunkforwarder-etc/