Install Enterprise Security using the App Framework

Deploy Enterprise Security using the Splunk Operator App Framework.

Install Enterprise Security (ES) on Standalone, Search Head Cluster, and Indexer Cluster deployments using the Splunk Operator App Framework.

Considerations for using the App Framework

appSources scope

  • When deploying ES to a Standalone or to a Search Head Cluster, configure an appSources scope of premiumApps.
  • When deploying the Splunk_TA_ForIndexers app to an Indexer Cluster, configure an appSources scope of cluster.

SSL enablement

When you install ES versions 6.3.0 or higher, you must supply a value for the parameter ssl_enablement that the ES post-installation command essinstall requires. By default, if you do not set any value for ssl_enablement, the operator uses the value of strict, which requires Splunk to have SSL enabled in web.conf (refer to setting enableSplunkWebSSL). The following table describes the available values of SSL enablement.

SSL mode Description
strict Default mode. Ensure that SSL is enabled in the web.conf configuration file to use this mode. Otherwise, the installer exits with an error. For the SHC, the ES post-install command essinstall runs on the deployer and checks web.conf files under etc/shcapps to validate that enableSplunkWebSSL is set to true. This check assumes that you have already pushed a web.conf through etc/shcapps to all the SHC members.
auto Enables SSL in the etc/system/local/web.conf configuration file. SHC does not support this mode.
ignore Ignores whether SSL is enabled. This option can be useful if you do not want the operator and essinstall to check that SSL is enabled for Splunk Web and you want ES installation to continue without interruption. For example, you might have processes outside of the operator that already verify your Splunk deployment has Web SSL enabled.

The operator uses the following CR spec parameters to install the ES app on Splunk:

  • scope: use premiumApps
  • premiumAppsProps > type: use enterpriseSecurity
  • esDefaults > sslEnablement: possible values ignore, auto, or strict. See the SSL enablement values in the table above for more details.
CODE 
appSources:
        - name: esApp
          location: es_app/
          scope: premiumApps
          premiumAppsProps:
            type: enterpriseSecurity
            esDefaults:
              sslEnablement: ignore

Summary of installation steps

  1. Ensure that the ES app package is present in the specified AppFramework S3 location with the correct appSources scope. Additionally, if configuring an indexer cluster, ensure that the Splunk_TA_ForIndexers app is present in the ClusterManager AppFramework S3 location with the appSources cluster scope.
  2. Apply the specified custom resources. The Splunk Operator handles installation and the environment is ready to use once all pods are in the Ready state, which might take up to 30 minutes. Refer to the examples in the following sections for creating your YAML files.

Install ES on a Standalone Splunk instance

This example sets sslEnablement=ignore for a standalone CR. Change the setting to suit your requirements, either auto or strict. Before you use this example, copy the ES app package into the folder security-team-apps/es_app in your S3 bucket.

CODE 
apiVersion: enterprise.splunk.com/v4
kind: Standalone
metadata:
  name: example
  finalizers:
  - enterprise.splunk.com/delete-pvc
spec:
  replicas: 1
  appRepo:
    appsRepoPollIntervalSeconds: 60
    defaults:
      volumeName: volume_app_repo
      scope: local
    appSources:
      - name: esApp
        location: es_app/
        scope: premiumApps
        premiumAppsProps:
          type: enterpriseSecurity
          esDefaults:
             sslEnablement: ignore
    volumes:
      - name: volume_app_repo
        storageType: s3
        provider: aws
        path: security-team-apps/
        endpoint: https://s3-us-west-2.amazonaws.com
        region: us-west-2
        secretRef: splunk-s3-secret

To use strict mode for sslEnablement, enable SSL on splunkd using the extraEnv variable SPLUNK_HTTP_ENABLESSL:

CODE 
apiVersion: enterprise.splunk.com/v4
kind: Standalone
metadata:
  name: example
  finalizers:
  - enterprise.splunk.com/delete-pvc
spec:
  extraEnv:
    - name: SPLUNK_HTTP_ENABLESSL
      value : "true"
  replicas: 1
  appRepo:
    appsRepoPollIntervalSeconds: 60
    defaults:
      volumeName: volume_app_repo
      scope: local
    appSources:
      - name: esApp
        location: es_app/
        scope: premiumApps
        premiumAppsProps:
          type: enterpriseSecurity
          esDefaults:
             sslEnablement: strict
    volumes:
      - name: volume_app_repo
        storageType: s3
        provider: aws
        path: security-team-apps/
        endpoint: https://s3-us-west-2.amazonaws.com
        region: us-west-2
        secretRef: splunk-s3-secret

Install ES on a Search Head Cluster and Indexer Cluster

Use the following steps to install ES on a Splunk deployment with a SHC integrated with Indexer Cluster:

  1. Download the ES app from Splunkbase and save the package in the S3 path security-team-apps/es-app.
  2. Use kubectl to apply the following YAML file.
  3. Wait for the SHC, CM, and Indexer pods to reach a ready state.
  4. Log in to a search head and verify that the ES app is installed.
  5. Extract the Splunk_TA_ForIndexers using the steps in Install technology add-ons.
  6. Upload the extracted Splunk_TA_ForIndexers package to the S3 bucket folder named es_app_indexer_ta.

The operator polls this bucket after the configured appsRepoPollIntervalSeconds interval and installs the Splunk_TA_ForIndexers.

The following example shows creating a Splunk deployment with a SHC, ClusterManager, and an IndexerCluster. Note the difference between the values of the scope property for the SHC and ClusterManager. For the SHC, scope is set to premiumApps, whereas for the ClusterManager, scope is set to cluster.

CODE 
apiVersion: enterprise.splunk.com/v4
kind: SearchHeadCluster
metadata:
  name: shc-es
  finalizers:
  - enterprise.splunk.com/delete-pvc
spec:
  appRepo:
    appsRepoPollIntervalSeconds: 60
    defaults:
      volumeName: volume_app_repo
      scope: local
    appSources:
      - name: esApp
        location: es_app/
        scope: premiumApps
        premiumAppsProps:
          type: enterpriseSecurity
          esDefaults:
             sslEnablement: ignore
    volumes:
      - name: volume_app_repo
        storageType: s3
        provider: aws
        path: security-team-apps/
        endpoint: https://s3-us-west-2.amazonaws.com
        region: us-west-2
        secretRef: splunk-s3-secret
  clusterManagerRef:
    name: cm-es
---
apiVersion: enterprise.splunk.com/v4
kind: ClusterManager
metadata:
  name: cm-es
  finalizers:
  - enterprise.splunk.com/delete-pvc
spec:
  appRepo:
    appsRepoPollIntervalSeconds: 60
    defaults:
      volumeName: volume_app_repo
      scope: local
    appSources:
      - name: esAppIndexer
        location: es_app_indexer_ta/
        scope: cluster
    volumes:
      - name: volume_app_repo
        storageType: s3
        provider: aws
        path: security-team-apps/
        endpoint: https://s3-us-west-2.amazonaws.com
        region: us-west-2
        secretRef: splunk-s3-secret
---
apiVersion: enterprise.splunk.com/v2
kind: IndexerCluster
metadata:
  name: idc-es
  finalizers:
  - enterprise.splunk.com/delete-pvc
spec:
  clusterManagerRef:
    name: cm-es
  replicas: 3

Enable strict mode for sslEnablement in SHC

When using strict mode, the following additional steps are required so that Splunk Web SSL is enabled for the SHC. Complete these steps before you install the ES app with the strict mode of sslEnablement. Alternatively, if you manage the enableSplunkWebSSL setting outside of the Operator scope by pushing an app bundle through the deployer, you can skip these steps.

  1. Create a SHC app (for example, shccoreapp.spl) that contains a local/web.conf setting with enableSplunkWebSSL=true.
  2. Place this app under security-team-apps/coreapps in your S3 bucket.
  3. Use the following YAML file as an example to deploy this app through the App Framework.

The following example enables Splunk Web SSL through the operator on SHC:

CODE 
apiVersion: enterprise.splunk.com/v4
kind: SearchHeadCluster
metadata:
  name: shcssl
  finalizers:
  - enterprise.splunk.com/delete-pvc
spec:
  extraEnv:
    - name: SPLUNK_HTTP_ENABLESSL
      value : "true"
  appRepo:
    appsRepoPollIntervalSeconds: 60
    defaults:
      volumeName: volume_app_repo
      scope: local
    appSources:
      - name: coreapps
        scope: cluster
        location: coreapps/
    volumes:
      - name: volume_app_repo
        storageType: s3
        provider: aws
        path: security-team-apps/
        endpoint: https://s3-us-west-2.amazonaws.com
        region: us-west-2
        secretRef: splunk-s3-secret