Use Workload Management on Kubernetes

Use workload management in Kubernetes deployments.

Splunk Enterprise version 10.4.0 and higher supports workload management on Kubernetes-based deployments. Workload management provides two modes: Advanced and Basic. Basic mode supports admission rules on systems such as Kubernetes where cgroups are not available.

Workload management modes

Mode Requirements Supported features
Advanced Linux systems with cgroups that have writable CPU and memory controllers. Full workload management feature set, including workload categories, workload pools, and all types of workload rules (placement, monitoring, and admission).
Basic Systems that do not have writable cgroups, such as Kubernetes and container deployments, or where Advanced mode prerequisites experience failures. Admission rules only.

Workload management detects the mode automatically. If your Linux system uses cgroups and both CPU and memory controllers are writable, workload management runs in Advanced mode by default. If your system does not meet the Advanced mode cgroups requirement, workload management runs in Basic mode.

Activate workload management on Kubernetes

The allow_basic setting in workload_pools.conf controls whether workload management uses Basic mode as a fallback when the environment cannot support Advanced mode. This setting is false by default.

To use workload management on Kubernetes, set allow_basic = true in workload_pools.conf:

CODE 
[general]
allow_basic = true
For more information, see workload_pools.conf.

Check workload management mode status

Run the splunk show workload-management-status CLI command to display the current mode. The output includes a Mode field that indicates whether workload management is running in Advanced or Basic mode.

The following example shows the output for Basic mode:

CODE 
Workload Management Status:
    Enabled: 1
    Supported: 1
    Mode: basic
    Error:

The following example shows the output for Advanced mode:

CODE 
Workload Management Status:
    Enabled: 1
    Supported: 1
    Mode: advanced
    Error:

In Advanced mode, the output also lists workload categories, pools, and associated details. In Basic mode, the output does not list categories and pools because workload management does not load them.

Admission rules in Basic mode

Admission rules work the same in Basic mode as in Advanced mode. You can use the same CLI commands to enable, disable, add, and remove admission rules.

When you list admission rules in Basic mode, you must specify the rule type:

CODE 
splunk list workload-rule -workload_rule_type search_filter

Basic mode blocks splunk list workload-rule without the -workload_rule_type flag because the command implies listing non-admission rule types that this mode does not support.

For details on creating and managing admission rules, see Configure admission rules to prefilter searches.

Splunk Web behavior in Basic mode

Admission rule management in Splunk Web works the same in Basic mode as in previous releases. The Health of Splunk Deployment page also behaves as before.

Important: Preflight checks report issues in Basic mode because those checks validate Advanced mode prerequisites such as cgroup availability. This behavior is expected and does not indicate a misconfiguration when you are running in Basic mode intentionally.