Storage provider options for the Splunk Operator

Storage providers and configuration options for the Splunk Operator.

Review the storage providers and configuration options available for use with the Splunk Operator for Kubernetes.

Performance considerations

The performance of Splunk Enterprise is highly dependent on the performance of your underlying storage infrastructure. Different Storage Class providers offer a wide range of performance characteristics, and how you configure and architect your storage infrastructure has a significant impact on the performance of Splunk Enterprise running in Kubernetes.

Amazon Elastic Kubernetes Service (EKS)

EKS users can create Storage Classes that use Amazon Elastic Block Store (EBS) as their Persistent Volumes. EKS automatically creates a default Storage Class named gp2 for all new clusters.

For additional Storage Class configuration options, such as enabling encryption and using provisioned IOPS, see the Kubernetes AWS EBS documentation.

Google Kubernetes Engine (GKE)

GKE users can create Storage Classes that use Google Persistent Disks (PD) as their Persistent Volumes. GKE automatically creates a default Storage Class named standard for all new clusters.

For additional Storage Class configuration options, see the Kubernetes GKE PD documentation.

Local Persistent Volumes

Kubernetes 1.14 or higher supports Local Persistent Volumes. Using local, direct attached storage can offer performance similar to running Splunk Enterprise on bare metal, at the cost of sacrificing the high availability provided by other storage options. The built-in clustering technologies provided by Splunk Enterprise can mitigate the cost by replicating your data across multiple instances.

If you are interested in using Local Persistent Volumes, consider one of these open source projects:

Additional storage providers

The introduction of the Kubernetes Container Storage Interface (CSI) makes it easy for new vendors to offer solutions for managing the persistence of containerized applications. Kubernetes 1.13 or higher users are encouraged to review the Kubernetes list of CSI Drivers.

Splunk has tested basic functionality of the Splunk Operator with the following storage options:

Splunk does not make specific recommendations or verify claims or comparisons regarding performance.