Openshift Support for Splunk Universal Forwarder Docker Image

[_KD]

The splunk universal forwarder image currently is not compatible with OpenShift. The image architecture requires the usage of sudo to switch between users and to run as specific UIDs which are not compatible with OpenShift UIDs.

Are you planning to ever fix your image to make it compatible with OpenShift to run as a sidecar container?

[_KD · Accepted solution]

"Important: The Splunk Connect for Kubernetes will reach End of Support on January 1, 2024. After that date, this repository will no longer receive updates from Splunk and will no longer be supported by Splunk. Until then, only critical security fixes and bug fixes will be provided. Splunk recommends migrating to Splunk OpenTelemetry Collector for Kubernetes. Please refer to this migration guide for more details."

[livehybrid]

Hi @_KD 

I dont have specific details on future product roadmap or development timelines for the Splunk Universal Forwarder Docker image regarding OpenShift compatibility or sidecar usage.

The recommended approach for collecting data from Kubernetes and OpenShift environments is the official Splunk OpenTelemetry Collector project, which is designed to integrate with these platforms and their security models.

If the specific use case of running the Universal Forwarder Docker image as a sidecar is critical for your needs, we encourage you to provide this feedback through your Splunk account team or official support channels such as via https://www.splunk.com/support

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing