Installing Splunk Universal Forwarder Using Ansible

Sun, 07 Aug 2016 21:58:00 +0530

Here is an automated approach to installing and initializing the Splunk Universal Forwarder with Ansible.

Variables

splunk_home: /opt/splunkforwarder
splunk_exec: "{{ splunk_home }}/bin/splunk"

Playbook Tasks

- name: Install Splunk Universal Forwarder package
 yum:
 name: splunkforwarder
 state: latest
 become: yes

- name: Check for first-time-run marker file
 stat:
 path: "{{ splunk_home }}/ftr"
 register: result_splunk_ftr_stat

- name: Configure Splunk forwarder on initial installation
 block:
 - name: Ensure existing running splunkd process is stopped
 shell: ps aux | grep -v grep | grep splunkd && pkill -9 splunkd || true

 - name: Accept license agreement and start service
 shell: "{{ splunk_exec }} start --accept-license --answer-yes --no-prompt"

 - name: Enable Splunk forwarder boot-start service
 shell: "{{ splunk_exec }} enable boot-start"
 when: result_splunk_ftr_stat.stat.exists
 become: yes

Run the playbook, and your forwarder is initialized and configured to start on boot.

Adding Authorized SSH Keys Using Ansible

Wed, 22 Jun 2016 00:23:00 +0530

You can easily manage and deploy multiple public SSH keys per user using Jinja templating within an Ansible playbook.

Variable Definition (`vars.yml`)

vars:
 ssh_user_key:
 - user: ritesh
 exclusive: no
 keys:
 - ritesh.centos
 - ritesh.fedora

Ansible Task

- name: Upload user authorized SSH keys
 authorized_key:
 user: "{{ item.user }}"
 exclusive: "{{ item.exclusive if item.exclusive is defined else 'no' }}"
 key: "{% for file_name in item['keys'] %}{{ lookup('file', file_name) }}{% if not loop.last %}{{ '\n' }}{% endif %}{% endfor %}"
 become: yes
 become_user: "{{ item.user }}"
 with_items:
 - "{{ ssh_user_key }}"
 tags:
 - setup-user-ssh-client-key