splunk / splunk/docker-splunk

Splunk Upgrade Failing / Constant Container "Restarting"

Open
#499 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
549
Forks
277
Avg merge
3d 9h
Merged PRs (30d)
2

Description

I have an old Splunk image running 7.2.5 as a heavy forwarder I'm trying to upgrade to the latest image. The Docker is using swarm for the orchestrator. After starting the new image it never stays running but is constantly in a cycle of restarting. Looking at the tail of the logs I see

2021-07-07T16:55:00.359683553Z TASK [splunk_common : Check for existing splunk secret] ************************
2021-07-07T16:55:00.360186022Z fatal: [localhost]: FAILED! => {
2021-07-07T16:55:00.360196058Z     "changed": false
2021-07-07T16:55:00.360198998Z }
2021-07-07T16:55:00.360201373Z 
2021-07-07T16:55:00.360203750Z MSG:
2021-07-07T16:55:00.360206217Z 
2021-07-07T16:55:00.360208614Z Permission denied
2021-07-07T16:55:00.364253598Z 
2021-07-07T16:55:00.364270798Z PLAY RECAP *********************************************************************
2021-07-07T16:55:00.364497637Z localhost                  : ok=6    changed=0    unreachable=0    failed=1    skipped=3    rescued=0    ignored=0 

This looks similar to another issue I found here where the problem was with mounting the existing volumes, and the solution was to make some corrections in the kubernetes yaml. I'm not running kubernetes through and haven't found where to correct this issue yet.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reported container logs and the Docker Swarm service configuration, especially the existing volume mounts and permissions. Reproduce the upgrade from Splunk 7.2.5 and compare the mounts with the newer image; done means the container remains running without the permission-denied failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.