Splunk Operator compatibility matrix

Compatibility matrix for Splunk Operator for Kubernetes (SOK), Splunk Enterprise, and Kubernetes versions.

Each Splunk Operator for Kubernetes (SOK) release supports a specific set of Splunk Enterprise and Kubernetes versions. Use this matrix to verify compatibility before you install or upgrade.

For detailed information, see the official release notes at splunk/splunk-operator releases. For a full list of new features, see the SOK change log.

SOK version to Splunk Enterprise versions

SOK release Released Kubernetes (K8s) Splunk Enterprise versions Notes
3.1.0 2026-03-30 1.25-1.34 10.2.0+, 10.4+ (K8s 1.25-1.33, indexing and ingestion separation)
3.1.0 2026-03-30 1.25-1.34 9.4.3-10.0.4 (K8s 1.25-1.33, no indexing and ingestion separation)
3.1.0 2026-03-30 1.25-1.34 9.4.9+, 10.0.4+, 10.4+ (K8s 1.34 only) Required for K8s 1.34 (new IAM Roles for Service Accounts (IRSA) token format)
3.0.0 2025-09-19 1.25-1.34 9.3.7-10.2.0 (K8s 1.25-1.33) Breaking change: you must accept the Splunk General Terms (EULA)
3.0.0 2025-09-19 1.25-1.34 9.4.9+, 10.0.4+ (K8s 1.34 only) Required for K8s 1.34
2.8.1 2025-07-17 1.27+ 9.4.3, 9.4.2, 9.3.5, 9.2.7
2.8.0 2025-05-12 1.27+ 9.4.2, 9.4.1, 9.4.0, 9.3.4, 9.3.3
2.7.1 2025-02-05 1.27+ 9.4.1, 9.4.0, 9.3.x, 9.2.x
2.7.0 2024-12-06 1.27+ 9.4.0, 9.3.2, 9.2.4, 9.1.7

Splunk Enterprise version to minimum SOK version

Splunk Enterprise Minimum SOK Maximum tested SOK Notes
10.4.x 3.1.0 3.1.0 K8s 1.25-1.33 or 1.34
10.2.0+ 3.0.0 3.1.0 K8s 1.25-1.33. Indexing and ingestion separation requires 3.1.0.
10.0.4+ 3.0.0 3.1.0 K8s 1.25-1.33 (also listed for K8s 1.34)
9.4.9+ 3.0.0 3.1.0 K8s 1.34 only
9.4.3 2.8.1 3.1.0
9.4.2 2.8.0 2.8.1
9.4.1 2.7.1 2.8.0
9.4.0 2.7.0 2.8.0

Kubernetes version support history

Kubernetes Minimum SOK Maximum tested SOK
1.34 3.0.0 3.1.0
1.25-1.33 2.4.0 (1.25+) 3.1.0
1.27+ 2.6.0 2.8.1
1.26+ 2.5.0 2.5.2
1.25+ 2.4.0 2.4.0
1.22+ 1.0.5 1.x

Important version-specific notes: SOK 3.x

  • 3.1.0 and 3.0.0, Kubernetes 1.34 constraint: Kubernetes 1.34 changes the IAM Roles for Service Accounts (IRSA) token format. Older splunkd binaries are incompatible with this format. If you deploy on K8s 1.34, use Splunk Enterprise 9.4.9+ or 10.0.4+. SOK 3.1.0 also supports 10.4+ on K8s 1.34, but 3.0.0 doesn't.
  • 3.1.0, indexing and ingestion separation: SOK 3.1.0 adds support for this feature, which requires Splunk Enterprise 10.2.0+ or 10.4+. SOK 3.1.0 also supports versions 9.4.3-10.0.4, but without this feature.
  • 3.0.0, Splunk General Terms (EULA) acceptance required: This is a breaking change. You must accept the Splunk General Terms before you deploy or upgrade. For more information, see the Install guide.

Important version-specific notes: SOK 2.x

  • 2.6.1 lists 9.3.0, 9.3.2, and 9.2.4. Both 9.3.0 and 9.3.2 appear in the list, which might indicate a re-certification of 9.3.0 alongside the newer 9.3.2 update.

Important version-specific notes: SOK 1.x / 0.x

  • 1.0.5 adds Kubernetes 1.22+ compatibility by updating the ClusterRole apiVersion in cluster_role.yaml from rbac.authorization.k8s.io/v1beta1 to v1. The CRD apiVersion change from apiextensions.k8s.io/v1beta1 to v1 occurs earlier, in 1.0.0-RC.
  • 0.2.0 through 0.2.2 (Beta) require the splunk/splunk:edge nightly image or Splunk Enterprise 8.1.0+.
  • 0.1.0 (Alpha) requires splunk/splunk:edge or Splunk Enterprise 8.0.3+.

Upgrade path guidance

When you upgrade Splunk Enterprise alongside SOK, always upgrade SOK first, then Splunk Enterprise. SOK 2.5.0 introduces a Level-2 Upgrade Strategy that sequences pod upgrades to protect cluster availability.

SOK 3.0.0 introduces a breaking change that requires manual EULA acceptance before the upgrade proceeds. Before you upgrade from any 2.x version to a 3.x version, review the SplunkOperatorUpgrade.md guide.