selectorsyncset.yml

---
apiVersion: hive.openshift.io/v1alpha1
kind: SelectorSyncSet
metadata:
  name: splunk-deployer
spec:
  clusterDeploymentSelector:
    matchLabels:
      api.openshift.com/testing-cluster: "true"
      #api.openshift.com/managed: "true"
  resourceApplyMode: sync
  resources:
#################################################
#                   Namespaces                  #
#################################################
  - apiVersion: v1
    kind: Namespace
    metadata:
      annotations:
        openshift.io/node-selector: ""
      name: openshift-security
#################################################
#                 End Namespaces                #
#################################################

# TODO - Make privileged user

#################################################
#                 Config Maps                   #
#################################################

# Begin osd-monitored-logs config maps
  - apiVersion: v1
    kind: ConfigMap
    metadata:
      name: osd-monitored-logs-local
      namespace: openshift-security
    data:
      inputs.conf: |
[monitor:///host/var/log/openshift-apiserver/audit.log]
sourcetype = _json
index = openshift_managed_audit
disabled = false
whitelist = \.log$

[monitor:///host/var/log/containers/*/*debug*.log]
sourcetype = debug_log
index = openshift_managed_debug_node
disabled = false
whitelist = \.log$
      app.conf: |
[install]
state = enabled

[package]
check_for_updates = false

[ui]
is_visible = false
is_manageable = false

  - apiVersion: v1
    kind: ConfigMap
    metadata:
      name: osd-monitored-logs-metadata
      namespace: openshift-security
    data:
      local.meta: |
[]
access = read : [ * ], write : [ admin ]
export = system
# End osd-monitored-logs config maps

#################################################
#               End Config Maps                 #
#################################################
  - apiVersion: v1
    kind: Secret
    metadata:
      name: splunk-auth-default
      namespace: openshift-security
    type: Opaque
    data:
      app.conf: <nope>
      limits.conf: <nope>
      osdsecuritylogs_cacert.pem: <nope>
      osdsecuritylogs_server.pem: <nope>
      outputs.conf: <nope>
  - apiVersion: v1
    kind: Secret
    metadata:
      name: splunk-auth-default
      namespace: openshift-security
    type: Opaque
    data:
      outputs.conf: <nope>
  - apiVersion: v1
    kind: Secret
    metadata:
      name: splunk-auth-metadata
      namespace: openshift-security
    type: Opaque
    data:
      local.meta: <nope>

#################################################
#                 Daemon Sets                   #
#################################################
  - apiVersion: extensions/v1beta1
    kind: DaemonSet
    metadata:
      name: splunk-forwarder
    spec:
      selector:
        matchLabels:
          name: splunk-forwarder
      template:
        metadata:
          labels:
            name: splunk-forwarder
        spec:
          nodeSelector:
            beta.kubernetes.io/os: linux
          env:
          - CLUSTER_NAME: MY_CLUSTER_REPLACE_ME
          containers:
          - image: quay.io/repository/whearn/splunk-forwarder:7.3.2
            imagePullPolicy: Always
            name: splunk-uf
            ports:
            - containerPort: 8089
              protocol: TCP
            resources: {}
            terminationMessagePath: /dev/termination-log
            volumeMounts:
            - name: splunk-auth-default
              mountPath: /opt/splunkforwarder/etc/splunk/apps/splunkauth/default
            - name: splunk-auth-local
              mountPath: /opt/splunkforwarder/etc/splunk/apps/splunkauth/local
            - name: splunk-auth-metadata
              mountPath: /opt/splunkforwarder/etc/splunk/apps/splunkauth/metadata

            - name: osd-monitored-logs-local
              mountPath: /opt/splunkforwarder/etc/splunk/apps/osd_monitored_logs/local
            - name: osd-monitored-logs-metadata
              mountPath: /opt/splunkforwarder/etc/splunk/apps/osd_monitored_logs/metadata

            - name: host
              mountPath: /host
            securityContext:
              privileged: true
              runAsUser: 0
          volumes:
          - name: splunk-auth-default
            secret:
              secretName: splunk-auth-default
          - name: splunk-auth-local
            secret:
              secretName: splunk-auth-local
          - name: splunk-auth-metadata
            secret:
              secretName: splunk-auth-metadata

          - name: osd-monitored-logs-local
            configMap:
              name: osd-monitored-logs-local
          - name: osd-monitored-logs-metadata
            configMap:
              name: osd-monitored-logs-metadata

          - name: host
            hostPath:
              path: /
              type: Directory
          serviceAccount: default
          terminationGracePeriodSeconds: 10
          tolerations:
          - operator: Exists
#################################################
#               End Daemon Sets                 #
#################################################