Users and roles

[splunklearner]

We have a deployment server which deploys apps (which contains configs) to Search head cluster (3 SH). I am not sure whether DS distributes apps directly to SH members or it will sent to deployer and from there deployer will distribute apps to SH members? Please clarify.

We have created a role in DS app which restricts to specific index. When we try to push it... That role is not reflecting in SH members? But when we are checking in Deployer that app is present under shcluster/apps and that role is updated. But it is not showing in SH UI. What is the problem?

Do we need to manually push the config from deployer to SH members everytime? We have config in Deployer as deployer_push_mode=merge_to_default... Is it means distribution is automated? If not how to push config from Deployer to SH members through Splunk web? We don't have access to backend server to give CLI command.

[PickleRick]

DS is not supposed to serve apps to clustered search heads directly. That's what deployer is for. If by any chance you managed to get clustered SHs to pull apps directly from DS, you're in for a possible loads of problems.

[splunklearner]

Can DS push apps to Deployer directly and there deployer will push to cluster SHs?  An you please explain how to push apps from deployer to SHs in splunk web?

[gcusello]

Hi @splunklearner ,

I usually avoid to use the DS to manage SHC-Deployer and Cluster Manager, even if it's possible do deploy apps to them.

You have to create a deploymentclient.conf file specialized for the CM or the SHCD adding

[deployment-client]
# NOTE: Because of a bug in the way the client works when installing apps
# outside of $SPLUNK_HOME/etc/apps, these apps aren't listed as "installed"
# by the deployment client, meaning that taking an app away from the cluster
# manager's serverclass won't remove it from the manager-apps directory. This
# would have to be done by hand. Updates to existing apps will transfer
# from the deployment server just fine, however.
repositoryLocation = $SPLUNK_HOME/etc/manager-apps
serverRepositoryLocationPolicy = rejectAlways

in this way the DS deploys apps not in the $SPLUNK_HOME/etc/apps folder but in the folders of the CM  (as in the example) or n the DS folder.

the real problem is how to run the push command: for the CM it's possible from GUI but it isn't possible for the SHCD, so it's easier to use a script.

And at least anyway, as also @PickleRick said, I'd avoid to search problems by myself!

Ciao.

Giuseppe

[isoutamo]

Hi

as other already said you could use DS to push apps to deployer and the it push those to SHC members, but we don’t encourage you to do it. DS’s main function is manage UF and just those. You could use it to manage also HFs and individual servers, but there are some things which you must know or otherwise there could be some side effects.

What is your issue which you are trying to solve with DS -> Deployer-> SHC solution? Maybe there is better way to solve it?

r. Ismo

[splunklearner]

Hello @isoutamo ,

We are trying to create a role (by using authorise.conf) in DS app under etc/deployment-apps and it will be  pushed to deployer under shcluster/apps. From there how do I need to push it to search head cluster members. There are 3 SHs. We don't have access to backend. From Splunk web I need to achieve this.? Because in SH when I am checking with roles section created role is not showing but in Deployer under shcluster/apps authorise.conf is updated when I push it from DS.

Please help me in this?

[PickleRick]

Your setup is a bit unusual as you seem to have some duties but don't have access typically associated with those duties or assistance of someone with such access. So as @isoutamo said - you should check your check your management processes and work on this issue with a party responsible for administering your environment.

[isoutamo]

Currently there seems to be too many open questions how your environment and it’s deployments are done. For that reason you should sit down with someone who are managed this environment and go through and document the correct way to deploy changes into different servers. I suppose that they already have some automation or some defined processes how this has done.

Of course we could told some technical tips and tricks to do a individual change etc but I’m quite sure that this is not the correct and long living solution for your problem!

[PickleRick]

@isoutamoLook into the opening post, they have no CLI access on the servers. I assume it's either an infrastructure managed by third party or they have a very strict duty separation policies in place.

[isoutamo]

Sorry I missed that part. 
I found this old post https://community.splunk.com/t5/Deployment-Architecture/What-is-the-curl-command-used-on-the-deploye...

I haven’t suitable test environment on my hand now, but maybe this is still valid?