Secure REST APIs using certificates

Configure TLS for Splunk REST APIs on Kubernetes.

Deploy certificates and configuration to a Splunk Enterprise instance and configure the Kubernetes Ingress controller to allow inbound communications on port 8089 (Splunk Management). The method to secure communications for REST API access is similar to the Splunk Web procedure.

  1. Configure server.conf to enable encryption using your certificates.

    Create the configuration file using the steps in Secure clients with SSL.

  2. Create an app with both certificates and the pre-configured server.conf file.

    In the following example, the app named myapp includes the certificates and the minimum configuration files required to enable the app and SSL/TLS communications:

    CODE 
    myapp
├── default
│   ├── app.conf
│   └── server.conf
└── mycerts
    ├── mySplunkCertificate.pem
    └── mySplunkPrivateKey.key

    Sample app.conf:

    CODE 
    [install]
is_configured = 0

[ui]
is_visible = 1
label = MyCertificatesApp

[launcher]
author = Splunk
description = My Splunk App for Custom Configuration
version = 1.0

    Sample server.conf:

    CODE 
    [sslConfig]
sslVersions = *,-ssl2
serverCert = $SPLUNK_HOME/etc/apps/myapp/mycerts/mySplunkAWSCertificate.pem
sslRootCAPath = $SPLUNK_HOME/etc/apps/myapp/mycerts/myCACertificate.pem
sslPassword = <password>
  3. Create the Ingress configuration to allow access to port 8089.

    This configuration creates a gateway and virtual service for passing the traffic through to the Splunk Enterprise instance:

    CODE 
    apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: splunk-api
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 8089
      name: mgmt
      protocol: TCP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: splunk-api
spec:
  hosts:
  - "splunk.example.com"
  gateways:
  - "splunk-api"
  tcp:
  - match:
    - port: 8089
    route:
    - destination:
        port:
          number: 8089
        host: splunk-standalone-standalone-service
  4. Apply the patch to allow external communication to port 8089:
    JSON 
    kubectl patch -n istio-system service istio-ingressgateway --patch '{"spec":{"ports":[{"name":"splunk-api","port":8089,"protocol":"TCP"}]}}'
  5. Verify the management port is using your certificates.

    Use the curl command and the path to the client-side certificates to authenticate:

    CODE 
    curl --cacert <PathTomyCACertificate.pem> -s -u admin -L "https://<domain:8089>/<api>"
    Note: You can avoid entering your password in the curl command by using a session key. To learn more about the different forms of authentication, see REST authentication methods.

    Learn more about the available APIs in the REST API Reference Manual.