|
1 | 1 | # Preparing an Orbstack instance |
2 | 2 |
|
3 | 3 | Click [**here**](https://splunk.github.io/observability-workshop/latest/en/resources/local-hosting/orbstack/index.html) for instructions on how to prepare an OrbStack instance. |
4 | | - |
5 | | -<!-- |
6 | | -**NOTE:** Please disable any VPNs or proxies before running the commands below e.g: |
7 | | -
|
8 | | -- ZScaler |
9 | | -- Cisco AnyConnect |
10 | | -
|
11 | | -These tools **will** prevent the instance from being created properly. |
12 | | -
|
13 | | -## 1. Pre-requisites |
14 | | -
|
15 | | -Install Orbstack: |
16 | | -
|
17 | | -``` bash |
18 | | -brew install orbstack |
19 | | -``` |
20 | | -
|
21 | | -If you plan to use your own Splunk Observability Cloud Suite Org, you may need to create a **Log Observer Connect** connection: |
22 | | -Follow the instructions found in the [documentation](https://docs.splunk.com/observability/en/logs/lo-connect-landing.html) for [Splunk Cloud](https://docs.splunk.com/observability/en/logs/scp.html#logs-scp) or [Splunk Enterprize](https://docs.splunk.com/observability/en/logs/set-up-logconnect.html). |
23 | | -
|
24 | | -Additional requirements for running your own **Log Observer Connect** connection are: |
25 | | -Create an index called **splunk4rookies-workshop** |
26 | | -Make sure the Service account user has access to the **splunk4rookies-workshop** index. (You can remove all other indexes, as all log data should go to this index) |
27 | | -
|
28 | | -
|
29 | | -## 2. Clone workshop repository |
30 | | -
|
31 | | -``` bash |
32 | | -git clone https://github.com/splunk/observability-workshop |
33 | | -``` |
34 | | -
|
35 | | -## 3. Change into Orbstack directory |
36 | | -
|
37 | | -```bash |
38 | | -cd observability-workshop/orbstack |
39 | | -``` |
40 | | -
|
41 | | -## 4. Create start.sh script |
42 | | -
|
43 | | -Copy the `start.sh.example` to `start.sh` and edit the file to set the required variables: |
44 | | -
|
45 | | -- ACCESS_TOKEN |
46 | | -- REALM |
47 | | -- HEC_TOKEN |
48 | | -- HEC_URL |
49 | | -
|
50 | | -``` bash |
51 | | -
|
52 | | -#!/bin/bash |
53 | | -echo "Building: $1"; |
54 | | -
|
55 | | -# Change these values below to match your environment and safe this file as start.sh |
56 | | -export ACCESS_TOKEN="<redacted>" |
57 | | -export REALM="eu0" |
58 | | -export RUM_TOKEN="<redacted>" |
59 | | -export HEC_TOKEN="<redacted>" |
60 | | -#export HEC_URL="https://http-inputs-o11y-workshop-eu0.splunkcloud.com:443/services/collector/event" |
61 | | -export HEC_URL="https://http-inputs-o11y-workshop-us1.splunkcloud.com:443/services/collector/event" |
62 | | -export INSTANCE=$1 |
63 | | -
|
64 | | -# Do not change anything below this line |
65 | | -orb create -c cloud-init.yaml -a arm64 ubuntu:jammy $INSTANCE |
66 | | -sleep 2 |
67 | | -ORBENV=ACCESS_TOKEN:REALM:RUM_TOKEN:HEC_TOKEN:HEC_URL:INSTANCE orb -m $INSTANCE -u splunk ansible-playbook /home/splunk/orbstack.yml |
68 | | -echo "ssh splunk@$INSTANCE@orb" |
69 | | -ssh splunk@$INSTANCE@orb |
70 | | -
|
71 | | -``` |
72 | | -
|
73 | | -Make sure your HEC_URL ends in https://[url]:[port]**/services/collector/event** as the raw endpoint does not process the logs as required. |
74 | | -
|
75 | | -Run the script and provide an instance name e.g.: `./start.sh my-instance`. |
76 | | -
|
77 | | -Once the instance has been successfully created (this can take several minutes), you will automatically be logged into the instance. If you exit you can SSH back in using the following command: |
78 | | -
|
79 | | -```bash |
80 | | -ssh splunk@<my_instance>@orb |
81 | | -``` |
82 | | -
|
83 | | -## 5. Validate instance |
84 | | -
|
85 | | -Once in the shell, you can validate that the instance is ready by running the following command: |
86 | | -
|
87 | | -```bash |
88 | | -kubectl version --output=yaml |
89 | | -``` |
90 | | -
|
91 | | -To get the IP address of the instance, run the following command: |
92 | | -
|
93 | | -```bash |
94 | | -ifconfig eth0 |
95 | | -``` |
96 | | -
|
97 | | -If you get an error please check that you have disabled any VPNs or proxies and try again e.g. ZScaler, Cisco AnyConnect. |
98 | | -
|
99 | | -To start again, delete the instance and re-run `start.sh my-instance`: |
100 | | -
|
101 | | -```bash |
102 | | -orb delete my-instance |
103 | | -``` |
104 | | -
|
105 | | -You can use Vscode with your new orb/container. |
106 | | -Make sure you have installed the remote ssh extension in vscode |
107 | | -
|
108 | | -here is a sample config for you ssh_config |
109 | | -
|
110 | | -```text |
111 | | -Host conf |
112 | | - Hostname 127.0.0.1 |
113 | | - Port 32222 |
114 | | - User splunk@orb-1 |
115 | | - # replace or symlink ~/.orbstack/ssh/id_ed25519 file to change the key |
116 | | - IdentityFile ~/.orbstack/ssh/id_ed25519 |
117 | | - # only use this key |
118 | | - IdentitiesOnly yes |
119 | | - ProxyCommand '/Applications/OrbStack.app/Contents/MacOS/../Frameworks/OrbStack Helper.app/Contents/MacOS/OrbStack Helper' ssh-proxy-fdpass 501 |
120 | | - ProxyUseFdpass yes |
121 | | - ``` |
122 | | ---> |
0 commit comments