Chapter 6. Configuring action log storage for Elasticsearch and Splunk

Procedure

1. Create a Splunk account by navigating to Splunk and entering the required credentials.
2. Navigate to the Splunk Enterprise Free Trial page, select your platform and installation package, and then click Download Now.
3. Install the Splunk software on your machine. When prompted, create a username, for example, splunk_admin and password.
4. After creating a username and password, a localhost URL will be provided for your Splunk deployment, for example, http://<sample_url>.remote.csb:8000/. Open the URL in your preferred browser.
5. Log in with the username and password you created during installation. You are directed to the Splunk UI.

Procedure

1. Open your Red Hat Quay config.yaml file and add the following configuration fields:

   # ...
   LOGS_MODEL: splunk
   LOGS_MODEL_CONFIG:
       producer: splunk
       splunk_config:
           host: http://<user_name>.remote.csb 1
           port: 8089 2
           bearer_token: <bearer_token> 3
           url_scheme: <http/https> 4
           verify_ssl: False 5
           index_prefix: <splunk_log_index_name> 6
           ssl_ca_path: <location_to_ssl-ca-cert.pem> 7
   # ...

   1

   String. The Splunk cluster endpoint.

   2

   Integer. The Splunk management cluster endpoint port. Differs from the Splunk GUI hosted port. Can be found on the Splunk UI under Settings → Server Settings → General Settings.

   3

   String. The generated bearer token for Splunk.

   4

   String. The URL scheme for access the Splunk service. If Splunk is configured to use TLS/SSL, this must be https.

   5

   Boolean. Whether to enable TLS/SSL. Defaults to true.

   6

   String. The Splunk index prefix. Can be a new, or used, index. Can be created from the Splunk UI.

   7

   String. The relative container path to a single .pem file containing a certificate authority (CA) for TLS/SSL validation.

2. If you are configuring ssl_ca_path, you must configure the SSL/TLS certificate so that Red Hat Quay will trust it.

   1. If you are using a standalone deployment of Red Hat Quay, SSL/TLS certificates can be provided by placing the certificate file inside of the extra_ca_certs directory, or inside of the relative container path and specified by ssl_ca_path.

   2. If you are using the Red Hat Quay Operator, create a config bundle secret, including the certificate authority (CA) of the Splunk server. For example:

      $ oc create secret generic --from-file config.yaml=./config_390.yaml --from-file extra_ca_cert_splunkserver.crt=./splunkserver.crt config-bundle-secret

      Specify the conf/stack/extra_ca_certs/splunkserver.crt file in your config.yaml. For example:

      # ...
      LOGS_MODEL: splunk
      LOGS_MODEL_CONFIG:
          producer: splunk
          splunk_config:
              host: ec2-12-345-67-891.us-east-2.compute.amazonaws.com
              port: 8089
              bearer_token: eyJra
              url_scheme: https
              verify_ssl: true
              index_prefix: quay123456
              ssl_ca_path: conf/stack/splunkserver.crt
      # ...

Procedure

1. Log in to your Red Hat Quay deployment.
2. Click on the name of the organization that you will use to create an action log for Splunk.
3. In the navigation pane, click Robot Accounts → Create Robot Account.
4. When prompted, enter a name for the robot account, for example spunkrobotaccount, then click Create robot account.
5. On your browser, open the Splunk UI.
6. Click Search and Reporting.

7. In the search bar, enter the name of your index, for example, <splunk_log_index_name> and press Enter.

   The search results populate on the Splunk UI. Logs are forwarded in JSON format. A response might look similar to the following:

   {
     "log_data": {
       "kind": "authentication",
       "account": "quayuser123",
       "performer": "John Doe",
       "repository": "projectQuay",
       "ip": "192.168.1.100",
       "metadata_json": {...},
       "datetime": "2024-02-06T12:30:45Z"
     }
   }