Splunk 9.1.3 has a regression on the SPLUNKD_SSL_ENABLE variable

[Amndeep7]

Running docker run -it --rm -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=Valid_password!" -e "SPLUNKD_SSL_ENABLE=false" -e GITHUB_ACTIONS=true -e CI=true -p 8089:8089 -p 8088:8088 -v "/$(pwd)/test/configs/splunk/server.conf":"/etc/system/local/server.conf" splunk/splunk:9.1.2 works w/r to spinning up a usable splunk instance.

Github actions run that contains the ansible output: https://github.com/mitre/heimdall2/actions/runs/7718282174/job/21039190919?pr=5410

var/log/splunkd.log output from a locally spun up container: https://gist.github.com/Amndeep7/9d65c8dedd0739cc82bc682295bcc6f0

Running docker run -it --rm -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=Valid_password!" -e "SPLUNKD_SSL_ENABLE=false" -e GITHUB_ACTIONS=true -e CI=true -p 8089:8089 -p 8088:8088 -v "/$(pwd)/test/configs/splunk/server.conf":"/etc/system/local/server.conf" splunk/splunk:latest causes the container to eventually timeout in an unhealthy state.

Github actions run that contains the ansible output: https://github.com/mitre/heimdall2/actions/runs/7716678293/job/21034050807?pr=5410

var/log/splunkd.log output from a locally spun up container: https://gist.github.com/Amndeep7/539aec96e2c1a02a40a9c863986f41bd

The server.conf file is extremely minimal.

test/configs/splunk/server.conf

$ cat test/configs/splunk/server.conf
#  List of the HTTP Origins for which to return Access-Control-Allow-* (CORS)
#   headers.
#  These headers tell browsers that web applications are trusted at those sites
#   to make requests to the REST interface.
#  The origin is passed as a URL without a path component (for example
#   "https://app.example.com:8000").
#  This setting can take a list of acceptable origins, separated
#   by spaces and/or commas.
#  Each origin can also contain wildcards for any part.  Examples:
#     *://app.example.com:*  (either HTTP or HTTPS on any port)
#     https://*.example.com  (any host under example.com, including
#     example.com itself)
#  An address can be prefixed with a '!' to negate the match, with
#   the first matching origin taking precedence.  For example,
#   "!*://evil.example.com:* *://*.example.com:*" to not avoid
#   matching one host in a domain
#  A single "*" can also be used to match all origins
#  No default.

[httpServer]
crossOriginSharingPolicy = *

[yarick]

Could this be related to the removal of Python2 support?

[Amndeep7]

Looking at the patch notes, it might also have been something that accidentally broke when work was done with the HEC envvars.

[Amndeep7]

Retrying on the latest splunk/splunk image, which I believe is 9.2.1, has worked. I believe this regression has been resolved, so I am closing this issue.