Secure Splunk Web using certificates

Configure TLS for Splunk Web on Kubernetes.

Deploy certificates and configuration to a Splunk Enterprise instance and configure the Kubernetes Ingress controller to allow inbound communications on port 8000 (Splunk Web).

  1. Configure web.conf to enable encryption on Splunk Web.

    Create your configuration file using the steps in Secure Splunk Web with TLS.

  2. Create an app with both certificates and the pre-configured web.conf file.

    In the following example, the app named myapp includes the certificates and the minimum configuration files required to enable the app and SSL/TLS communications:

    CODE 
    myapp
├── default
│   ├── app.conf
│   └── web.conf
└── mycerts
    ├── mySplunkCertificate.pem
    └── mySplunkPrivateKey.key

    Sample app.conf:

    CODE 
    [install]
is_configured = 0

[ui]
is_visible = 1
label = MyApp

[launcher]
author = Splunk
description = My Splunk App
version = 1.0

    Sample web.conf:

    CODE 
    [settings]
enableSplunkWebSSL = true
privKeyPath = $SPLUNK_HOME/etc/apps/myapp/mycerts/mySplunkPrivateKey.key
serverCert = $SPLUNK_HOME/etc/apps/myapp/mycerts/mySplunkCertificate.pem
  3. Deploy the app to the Splunk Enterprise instance.
  4. Create the Ingress configuration to allow access to port 8000.

    This configuration creates a gateway and virtual service for passing the traffic through to the Splunk Enterprise instance:

    CODE 
    apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: splunk-web
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 8000
      name: ui
      protocol: TCP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: splunk-web
spec:
  hosts:
  - "splunk.example.com"
  gateways:
  - "splunk-web"
  tcp:
  - match:
    - port: 8000
    route:
    - destination:
        host: splunk-standalone-standalone-service
        port:
          number: 8000
  5. Apply the patch to allow external communication to port 8000:
    JSON 
    kubectl patch -n istio-system service istio-ingressgateway --patch '{"spec":{"ports":[{"name":"splunk-web","port":8000,"protocol":"TCP"}]}}'
  6. Verify Splunk Web is now using SSL/TLS by prepending https:// to the URL you use to access Splunk Web.