App Framework

Deploy and manage Splunk apps and add-ons using the App Framework.

The Splunk Operator supports Splunk app and add-on deployment using the App Framework, which provides configuration management using Splunk Enterprise custom resources (CR) for both clustered and standalone deployments. The Splunk Operator does not support deploying apps and add-ons outside the App Framework.

The App Framework detects the Splunk app or add-on archive files available in the App Source locations and deploys them to the CR instance path for local or cluster use.

The App Framework maintains a checksum for each app or add-on archive file in the App Source location in the form of the Etag of the remote storage object. The app name and checksum are recorded in the CR and compared to the deployed apps against the app archive files in the App Source location. The App Framework scans for changes to the App Source folders using the polling interval and deploys any updated apps to the instance. For the App Framework to detect that an app or add-on has changed, the updated app must use the same archive file name as the previously deployed one.

Important: Uploading the same app under different archive file names is not supported. If an app does not update after you upload a new version under the same archive file name, do not upload the app using a different archive file name. Instead, check the troubleshooting section for ways to debug the issue.

Prerequisites

  • One of the following remote storage providers:
    • An Amazon S3 or S3-API-compliant remote object storage location
    • Azure Blob storage
    • GCP Cloud Storage
  • The App Framework requires read-only access to the path used to host the apps. Do not give any other access to the operator to maintain the integrity of data in the S3 bucket, Azure Blob container, or GCP bucket.
  • Splunk apps and add-ons must be stored in a .tgz, .tar.gz, or .spl archive format.
  • Connections to the remote object storage endpoint must use a minimum version of TLS 1.2.
  • A persistent storage volume and path for the Operator pod.