Secrets and credential management

Manage secrets and credentials for the Splunk Operator.

A global Kubernetes secret object acts as the source of secret tokens for a Kubernetes namespace used by all Splunk Enterprise Custom Resources.

Global Kubernetes secret object

The name of the global secret object follows the format splunk-<namespace>-secret, where <namespace> represents the namespace you are operating in. The operator volume-mounts the contents of this object on all the pods within a Kubernetes namespace.

This approach:

  • Eliminates any mismatch between operator-generated secrets and admin-provided secrets, because the operator syncs all secrets into a common object.
  • Allows for dynamic adoption and modification of secrets.

Default behavior of global Kubernetes secret object

Upon the creation of the first Splunk Enterprise CR in a given namespace, the operator checks for the existence of a global Kubernetes secret object:

  • If the object does not exist:
    • The operator creates the global Kubernetes secret object with name splunk-<namespace>-secret.
    • The operator auto-generates, encodes, and stores all Splunk Enterprise secret tokens into the global Kubernetes secret object for the namespace. The operator does not generate SmartStore secret tokens. You must create them manually.
  • If the object exists:
    • The operator checks for the existence of the Splunk Enterprise secret tokens by key value.
    • The operator auto-generates, encodes, and stores a Splunk Enterprise secret token for any empty keys. The operator does not generate SmartStore secret tokens. You must create them manually.
Note: Before creating any Splunk deployments in the Kubernetes namespace, you can create a global Kubernetes secret object using the tokens described in the following section. The operator uses these pre-populated values to deploy.

Splunk secret tokens in the global secret object

The configurable Splunk secret tokens include:

HEC Token
Key name: hec_token. Used to authenticate clients sending data into Splunk Enterprise through HTTP connections.
Default administrator password
Key name: password. The default administrator password for Splunk.
pass4Symmkey
Key name: pass4Symmkey. An authentication token for inter-communication within Splunk Enterprise.
IDXC pass4Symmkey
Key name: idxc.secret. An authentication token for inter-communication specifically for indexer clustering in Splunk Enterprise.
SHC pass4Symmkey
Key name: shc.secret. An authentication token for inter-communication specifically for search head clustering in Splunk Enterprise.

For more information on managing Kubernetes secret objects, see Managing secrets using kubectl.

Information for Splunk Enterprise administrators

  • The default administrator account cannot be turned off on any Splunk Enterprise instance. The Kubernetes operator uses this account to interact with all Splunk Enterprise instances in the namespace.
  • Do not change the passwords managed through the global Kubernetes secret object using Splunk Enterprise tools (CLI, UI).
  • The default administrator account must use the global Kubernetes secret object for any password changes.
  • After you initiate an update or delete operation on the global secrets object, the operator requires time to finish applying the changes to all Splunk Enterprise instances in the namespace. Expect disruption of Splunk services while the secret updates are in progress. Perform a status check on all the Splunk Enterprise cluster tiers after the update completes.

Secrets on Docker Splunk

When Splunk Enterprise is deployed on a Docker container, Ansible playbooks set up Splunk. Ansible playbooks interpret the environment variable SPLUNK_DEFAULTS_URL in the container as the location to read the Splunk secret tokens from. Ansible uses the tokens to set up Splunk instances running on containers inside pods.