Configure Ingress using Kubernetes Ingress Nginx

Set up Kubernetes Ingress Nginx for Splunk Enterprise on Kubernetes.

Configure the Kubernetes Ingress Nginx controller to provide access to Splunk Web, HEC, and Splunk Forwarder data.

Note: There are at least three flavors of the Nginx Ingress controller:
  • Kubernetes Ingress Nginx (open source)
  • Nginx Ingress Open Source (F5 open source version)
  • Nginx Ingress Plus (F5 paid version)

See the Nginx Comparison Chart for details. Confirm which Nginx Ingress controller you intend to implement, as they have different annotations and configurations.

For instructions on how to install and configure the NGINX Ingress Controller, see the NGINX Ingress Controller GitHub repository and the Installation Guide.

This ingress controller uses a ConfigMap to enable ingress access to the cluster. There is no support for TCP gateway termination. See Request 3087 and Ticket 636 for feature requests. Only HTTPS is supported for gateway termination.

For Splunk Forwarder communications over TCP, the only available configuration is end-to-end TLS termination.

For all configurations below, the standard YAML provided in the Installation Guide for AWS was used as a template: Ingress NGINX AWS Sample Deployment.

Configure ingress for Splunk Web

You can configure Nginx to provide direct access to Splunk Web.

Example Ingress configuration for a standalone:

CODE 
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-standalone
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/default-backend: splunk-standalone-standalone-service
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
spec:
  rules:
  - host: splunk.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: splunk-standalone-standalone-service
          servicePort: 8000

Example Ingress configuration for multiple hosts:

CODE 
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-standalone
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/default-backend: splunk-standalone-standalone-service
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
spec:
  rules:
  - host: splunk.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: splunk-example-search-head-service
          servicePort: 8000
      - path: /services/collector
        backend:
          serviceName: splunk-example-indexer-service
          servicePort: 8088
  - host: deployer.splunk.example.com
    http:
      paths:
      - backend:
          serviceName: splunk-example-deployer-service
          servicePort: 8000
  - host: cluster-manager.splunk.example.com
    http:
      paths:
      - backend:
          serviceName: splunk-example-cluster-manager-service
          servicePort: 8000

Example TLS-enabled Ingress configuration:

  • The nginx.ingress.kubernetes.io/backend-protocol annotation requires "HTTPS" when TLS is configured on the backend services.
  • The secretName must reference a valid TLS secret.
Note: This example assumes that HTTPS is enabled for Splunk Web.
CODE 
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/affinity-mode: "persistent"
    nginx.ingress.kubernetes.io/session-cookie-name: "route"
    nginx.ingress.kubernetes.io/session-cookie-expires: "172800"
    nginx.ingress.kubernetes.io/session-cookie-max-age: "172800"
    nginx.ingress.kubernetes.io/client-body-buffer-size: 100M
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/session-cookie-samesite: "true"
    nginx.ingress.kubernetes.io/session-cookie-path: "/en-US"
    cert-manager.io/cluster-issuer: selfsigned
  name: splunk-ingress
  namespace: default
spec:
  rules:
  - host: shc.example.com
    http:
      paths:
      - path: /en-US
        pathType: Prefix
        backend:
          serviceName: splunk-shc-search-head-service
          servicePort: 8000
  - host: hec.example.com
    http:
      paths:
      - path: /services/collector
        pathType: Prefix
        backend:
          serviceName: splunk-idc-indexer-service
          servicePort: 8088
  tls:
  - hosts:
    - shc.example.com
    - hec.example.com
    secretName: operator-tls

Configure Ingress Nginx for Splunk Forwarders with end-to-end TLS

Note: This example uses port 9997 for non-encrypted communication and 9998 for encrypted.

Update the default Ingress Nginx configuration to add the ConfigMap and Service ports:

  1. Create a ConfigMap to define the port-to-service routing:
    CODE 
    apiVersion: v1
kind: ConfigMap
metadata:
  name: tcp-services
  namespace: ingress-nginx
data:
  9997: "default/splunk-standalone-standalone-service:9997"
  9998: "default/splunk-standalone-standalone-service:9998"
  2. Add the two ports into the Service used to configure the load balancer:
    CODE 
    apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
    service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'
    service.beta.kubernetes.io/aws-load-balancer-type: nlb
  labels:
    helm.sh/chart: ingress-nginx-3.10.1
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/version: 0.41.2
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: http
    - name: https
      port: 443
      protocol: TCP
      targetPort: https
    - name: tcp-s2s
      port: 9997
      protocol: TCP
      targetPort: 9997
    - name: tls-s2s
      port: 9998
      protocol: TCP
      targetPort: 9998

Documentation tested on Ingress Nginx v1.19.4 and Kubernetes v1.17.

Sticky sessions

Follow the Ingress Nginx Sticky Sessions documentation to learn how to configure session stickiness for the Ingress Nginx controller.