Configure ingress using Nginxinc

Set up NGINX Ingress Controller (Nginxinc) for Splunk Enterprise on Kubernetes.

Install and configure the NGINX Ingress Controller (Nginxinc) to provide access to Splunk Web, HEC, and Splunk Forwarder data. The NGINX Ingress Controller is an open source version of the F5 product. Review the following documentation for more details:

Install the Nginx Helm Chart

Follow the NGINX Ingress Controller Helm Installation guide. It requires a cluster with internet access.

Set up Helm:

CODE 
git clone https://github.com/nginxinc/kubernetes-ingress/
cd kubernetes-ingress/deployments/helm-chart
git checkout v1.9.0

helm repo add nginx-stable https://helm.nginx.com/stable
helm repo update

kubectl create -f crds/

Install Ingress:

CODE 
cd deployments/helm-chart

helm install splunk-nginx nginx-stable/nginx-ingress

helm list

NAME            NAMESPACE   REVISION    UPDATED             STATUS      CHART               APP VERSION
splunk-nginx  default     5  2020-10-29 15:03:47.6 EDT    deployed    nginx-ingress-0.7.0 1.9.0

helm upgrade splunk-nginx  nginx-stable/nginx-ingress

Configure ingress for Splunk Web and HEC

The following Ingress example configures Splunk Web as well as HEC as an operator-installed service. This example exposes HEC through SSL and Splunk Web without SSL.

  • Configure TLS to the ingress controller in the tls: section of the YAML. The secretName must reference a valid TLS secret.
  • For any backend service that has TLS enabled, you must add a corresponding nginx.org/ssl-services annotation.
JSON 
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    certmanager.k8s.io/cluster-issuer: letsencrypt-prod
    nginx.org/client-body-buffer-size: 100M
    nginx.org/client-max-body-size: "0"
    nginx.org/server-snippets: |
      client_body_buffer_size 100m;
    nginx.org/ssl-services: splunk-standalone-standalone-headless
  name: splunk-ingress
  namespace: default
spec:
  ingressClassName: nginx
  rules:
  - host: splunk.example.com
    http:
      paths:
      - backend:
          serviceName: splunk-standalone-standalone-service
          servicePort: 8000
        path: /en-US
        pathType: Prefix
      - backend:
          serviceName: splunk-standalone-standalone-headless
          servicePort: 8088
        path: /services/collector
        pathType: Prefix
      - backend:
          serviceName: splunk-standalone-standalone-headless
          servicePort: 8089
        path: /.well-known
        pathType: Prefix
  tls:
  - hosts:
    - splunk.example.com
    secretName: operator-tls
status:
  loadBalancer: {}

Configure ingress for Splunk Forwarders

Enable the global configuration to set up a listener and transport server.

  1. Create the GlobalConfiguration:
    CODE 
    apiVersion: k8s.nginx.org/v1alpha1
kind: GlobalConfiguration
metadata:
  name: nginx-configuration
  namespace: default
spec:
  listeners:
  - name: s2s-tcp
    port: 30403
    protocol: TCP
apiVersion: k8s.nginx.org/v1alpha1
kind: TransportServer
metadata:
  name: s2s-tcp
spec:
  listener:
    name: s2s-tcp
    protocol: TCP
  upstreams:
  - name: s2s-app
    service: splunk-standalone-standalone-service
    port: 9997
      action:
    pass: s2s-app
  2. Edit the service to establish a node port for the listener port:

    List the service:

    CODE 
    kubectl get svc

    Edit the service and add the Splunk Forwarder ingress port:

    CODE 
    kubectl edit service splunk-nginx-nginx-ingress

    Example Service:

    CODE 
    apiVersion: v1
kind: Service
metadata:
  annotations:
    meta.helm.sh/release-name: splunk-nginx
    meta.helm.sh/release-namespace: default
  labels:
    app.kubernetes.io/instance: splunk-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: splunk-nginx-nginx-ingress
    helm.sh/chart: nginx-ingress-0.7.0
  name: splunk-nginx-nginx-ingress
  namespace: default
spec:
  clusterIP: 172.20.195.54
  externalTrafficPolicy: Local
  ports:
  - name: http
    nodePort: 31452
    port: 80
    protocol: TCP
    targetPort: 80
  - name: https
    nodePort: 30402
    port: 443
    protocol: TCP
    targetPort: 443
  - name: s2s
    nodePort: 30403
    port: 30403
    protocol: TCP
    targetPort: 30403
  selector:
    app: splunk-nginx-nginx-ingress
  sessionAffinity: None
  type: LoadBalancer

Documentation tested on Nginx Ingress Controller v1.9.0 and Kubernetes v1.18.

Sticky sessions

Follow the Nginx Ingress Controller Sticky Sessions documentation to learn how to configure session stickiness for the Nginx Ingress Controller.