Ingress overview and requirements

Configure ingress controllers to access the Splunk Operator from outside Kubernetes.

Use Kubernetes Ingress Controllers to access your Splunk cluster from outside Kubernetes. The port-forward command is useful for testing, but production access to your Splunk cluster from outside the Kubernetes cluster requires an ingress controller.

The Splunk Operator automatically creates and manages Kubernetes Services for all relevant components. These services provide easy integration with most ingress controllers and configurations.

CODE 
$ kubectl get services -o name
service/splunk-cluster-cluster-manager-service
service/splunk-cluster-deployer-service
service/splunk-cluster-indexer-headless
service/splunk-cluster-indexer-service
service/splunk-cluster-license-manager-service
service/splunk-cluster-search-head-headless
service/splunk-cluster-search-head-service
service/splunk-standalone-standalone-headless
service/splunk-standalone-standalone-service

This documentation provides examples for configuring the following ingress controllers: Istio, Kubernetes Ingress Nginx, and NGINX Ingress Controller (Nginxinc).

Before deploying an example, review the YAML and replace example.com with the domain name you want to use, and replace example in the service names with the name of your custom resource object. You must also point your DNS for all desired hostnames to the IP addresses of your ingress load balancer.

Load balancer requirements

When configuring ingress for use with Splunk Forwarders, the configured ingress load balancer must resolve to two or more IPs. This is required so that the auto load balancing capability of the forwarders is preserved.

Splunk default network ports

When creating a new Splunk instance on Kubernetes, the default network ports are used for internal communication such as internal logs, replication, and others. Any change in how these ports are configured must be consistent across the cluster.

For ingress, use separate ports for encrypted and non-encrypted traffic. This documentation uses port 9998 for encrypted data coming from outside the cluster, while keeping the default 9997 for non-encrypted intra-cluster communication.

Indexer Discovery is not supported

Indexer Discovery is not supported on a Kubernetes cluster. Instead, the ingress controllers connect forwarders to peer nodes in indexer clusters.

Sticky sessions

When configuring ingress, ensure that the session is sticky to the specific Splunk instance. This is required for Splunk to work properly. Without sticky sessions, a blank page might appear when trying to access the Splunk instances.