From 34d0f3cdb4943ea66f7ce02e997d03626c1b0b0a Mon Sep 17 00:00:00 2001 From: Gabriel J Mendoza Date: Wed, 27 May 2026 20:26:31 -0400 Subject: [PATCH] CSPL-4006: Fix SSL replication port deleted on first indexer cluster join Splunk's `edit cluster-config` REST API requires `-replication_port` even when SSL replication is configured. The previous fix (PR #903) omitted the flag for SSL deployments, causing the command to fail with "parameter=replication_port not present" and loop indefinitely. The correct approach: - Always pass `-replication_port` so the CLI command succeeds - Immediately re-apply the full server.conf stanza block after cluster join to restore the `[replication_port-ssl://PORT]` entry that the CLI overwrites SSL detection uses both explicit `splunk.idxc.replication_ssl: true` flag and auto-detection of `replication_port-ssl://` keys in splunk.conf.server.content, so customers don't need to add an extra flag if they only configure SSL via conf. Affects both single-site (indexer_clustering.yml) and multi-site (setup_multisite.yml) cluster join paths. Verified on Splunk Enterprise 10.4.0 on EKS: SSL stanza persists on first startup without manual pod restart. Jira: https://splunk.atlassian.net/browse/CSPL-4006 Co-Authored-By: Claude Sonnet 4.6 --- .../tasks/indexer_clustering.yml | 30 +++++---------- .../splunk_indexer/tasks/setup_multisite.yml | 38 ++++++------------- 2 files changed, 20 insertions(+), 48 deletions(-) diff --git a/roles/splunk_indexer/tasks/indexer_clustering.yml b/roles/splunk_indexer/tasks/indexer_clustering.yml index e7b2991e..2c825f1d 100644 --- a/roles/splunk_indexer/tasks/indexer_clustering.yml +++ b/roles/splunk_indexer/tasks/indexer_clustering.yml @@ -14,7 +14,10 @@ set_fact: use_ssl_replication: "{{ (splunk.idxc.replication_ssl | default(false) | bool) or (has_ssl_replication_port_in_conf | default(false) | bool) }}" -- name: Set current node as indexer cluster peer (non-SSL replication) +# CSPL-4006: Always pass -replication_port (Splunk REST API requires it regardless of SSL mode). +# For SSL deployments the -replication_port value gets overwritten by Splunk CLI into a non-SSL +# stanza; the re-apply task below restores the SSL stanza immediately after. +- name: Set current node as indexer cluster peer command: "{{ splunk.exec }} edit cluster-config -mode slave -master_uri '{{ cert_prefix }}://{{ splunk.cluster_master_url }}:{{ splunk.svc_port }}' -replication_port {{ splunk.idxc.replication_port }} -secret '{{ splunk.idxc.pass4SymmKey }}' -auth '{{ splunk.admin_user }}:{{ splunk.password }}'" become: yes become_user: "{{ splunk.user }}" @@ -23,29 +26,14 @@ until: task_result.rc == 0 retries: "{{ retry_num }}" delay: "{{ retry_delay }}" - when: not use_ssl_replication | bool ignore_errors: yes notify: - Restart the splunkd service no_log: "{{ hide_password }}" -- name: Set current node as indexer cluster peer (SSL replication) - command: "{{ splunk.exec }} edit cluster-config -mode slave -master_uri '{{ cert_prefix }}://{{ splunk.cluster_master_url }}:{{ splunk.svc_port }}' -secret '{{ splunk.idxc.pass4SymmKey }}' -auth '{{ splunk.admin_user }}:{{ splunk.password }}'" - become: yes - become_user: "{{ splunk.user }}" - register: task_result_ssl - changed_when: task_result_ssl.rc == 0 - until: task_result_ssl.rc == 0 - retries: "{{ retry_num }}" - delay: "{{ retry_delay }}" - when: use_ssl_replication | bool - ignore_errors: yes - notify: - - Restart the splunkd service - no_log: "{{ hide_password }}" - -# CSPL-4006: Re-apply SSL replication port config after cluster join -# This ensures the SSL config isn't lost if edit cluster-config modifies server.conf +# CSPL-4006: Re-apply SSL replication port config after cluster join. +# edit cluster-config overwrites the SSL stanza with a plain [replication_port://PORT] entry; +# this task restores the customer's SSL stanza so it persists on first startup. - name: Re-apply SSL replication port configuration include_tasks: ../../../roles/splunk_common/tasks/set_config_file.yml vars: @@ -53,9 +41,9 @@ conf_directory: "{{ splunk.home }}/etc/system/local" conf_stanzas: "{{ splunk.conf.server.content }}" when: - - has_ssl_replication_port_in_conf | default(false) | bool + - use_ssl_replication | bool - "'conf' in splunk" - "'server' in splunk.conf" - "'content' in splunk.conf.server" -#INFRA-38882: Update \ No newline at end of file +#INFRA-38882: Update diff --git a/roles/splunk_indexer/tasks/setup_multisite.yml b/roles/splunk_indexer/tasks/setup_multisite.yml index 7646e739..ffb47bf7 100644 --- a/roles/splunk_indexer/tasks/setup_multisite.yml +++ b/roles/splunk_indexer/tasks/setup_multisite.yml @@ -8,17 +8,17 @@ multisite_master_uri: "{{ cert_prefix }}://{{ splunk.multisite_master }}:{{ splunk.svc_port }}" # CSPL-4006: Check if SSL replication port is configured in server.conf -# If SSL port exists, we should NOT use -replication_port flag as it will overwrite the SSL config -- name: Check if SSL replication port is configured in server.conf (multisite) +- name: Check if SSL replication port is configured in server.conf set_fact: - has_ssl_replication_port_in_conf_multisite: "{{ 'conf' in splunk and 'server' in splunk.conf and 'content' in splunk.conf.server and (splunk.conf.server.content.keys() | select('match', '^replication_port-ssl://') | list | length > 0) }}" + has_ssl_replication_port_in_conf: "{{ 'conf' in splunk and 'server' in splunk.conf and 'content' in splunk.conf.server and (splunk.conf.server.content.keys() | select('match', '^replication_port-ssl://') | list | length > 0) }}" -# Determine if SSL replication should be used (either via flag or detected in config) -- name: Determine SSL replication mode (multisite) +- name: Determine SSL replication mode set_fact: - use_ssl_replication_multisite: "{{ (splunk.idxc.replication_ssl | default(false) | bool) or (has_ssl_replication_port_in_conf_multisite | default(false) | bool) }}" + use_ssl_replication: "{{ (splunk.idxc.replication_ssl | default(false) | bool) or (has_ssl_replication_port_in_conf | default(false) | bool) }}" -- name: Setup Peers with Associated Site (non-SSL replication) +# CSPL-4006: Always pass -replication_port (Splunk REST API requires it regardless of SSL mode). +# For SSL deployments the re-apply task below restores the SSL stanza after the CLI overwrites it. +- name: Setup Peers with Associated Site command: "{{ splunk.exec }} edit cluster-config -mode slave -site {{ splunk.site }} -master_uri {{ multisite_master_uri }} -replication_port {{ splunk.idxc.replication_port }} -auth {{ splunk.admin_user }}:{{ splunk.password }} -secret {{ splunk.idxc.pass4SymmKey }}" become: yes become_user: "{{ splunk.user }}" @@ -27,37 +27,21 @@ until: task_result.rc == 0 retries: "{{ retry_num }}" delay: "{{ retry_delay }}" - when: not use_ssl_replication_multisite | bool notify: - Restart the splunkd service no_log: "{{ hide_password }}" -- name: Setup Peers with Associated Site (SSL replication) - command: "{{ splunk.exec }} edit cluster-config -mode slave -site {{ splunk.site }} -master_uri {{ multisite_master_uri }} -auth {{ splunk.admin_user }}:{{ splunk.password }} -secret {{ splunk.idxc.pass4SymmKey }}" - become: yes - become_user: "{{ splunk.user }}" - register: task_result_ssl - changed_when: task_result_ssl.rc == 0 - until: task_result_ssl.rc == 0 - retries: "{{ retry_num }}" - delay: "{{ retry_delay }}" - when: use_ssl_replication_multisite | bool - notify: - - Restart the splunkd service - no_log: "{{ hide_password }}" - -# CSPL-4006: Re-apply SSL replication port config after cluster join -# This ensures the SSL config isn't lost if edit cluster-config modifies server.conf -- name: Re-apply SSL replication port configuration (multisite) +# CSPL-4006: Re-apply SSL replication port config after cluster join. +- name: Re-apply SSL replication port configuration include_tasks: ../../../roles/splunk_common/tasks/set_config_file.yml vars: conf_file: "server.conf" conf_directory: "{{ splunk.home }}/etc/system/local" conf_stanzas: "{{ splunk.conf.server.content }}" when: - - has_ssl_replication_port_in_conf_multisite | default(false) | bool + - use_ssl_replication | bool - "'conf' in splunk" - "'server' in splunk.conf" - "'content' in splunk.conf.server" -#INFRA-38882: Update \ No newline at end of file +#INFRA-38882: Update