Secure Splunk Operator deployments
Secure Splunk Enterprise deployments in Kubernetes.
Before creating new deployments in Kubernetes, consider the security aspects of your environment. You can secure your deployment using the Operator and Splunk Enterprise configurations. Splunk Enterprise provides a range of security frameworks that are also available in your Kubernetes deployment. Familiarize yourself with these frameworks in the Securing the Splunk Platform manual.
Your deployment might require communication with Splunk Enterprise instances running outside of Kubernetes. For example, forwarders outside of the Kubernetes cluster can send data into an Indexer Cluster running in Kubernetes. You can accomplish this using an Ingress Controller such as Istio or Nginx. This documentation uses Istio for the examples.
The procedures to secure your deployment are the same regardless of your choice of Ingress Controller. The following table lists the ingress communications the Operator supports:
| Outside Kubernetes | SSL/TLS Configuration | Supported |
|---|---|---|
| Forwarders | Gateway Termination | Yes |
| Forwarders | End-to-End Termination | Yes |
| Splunk Web | End-to-End Termination | Yes |
| REST API | End-to-End Termination | Yes |
| Splunk Web | Gateway Termination | No |
| REST API | Gateway Termination | No |
Prerequisites
Learn about securing communication channels
Use SSL/TLS certificates to secure the communication between Splunk platform instances. See Secure Splunk with SSL.
Prepare your certificates
For information on how to create your own certificates or how to sign third-party certificates, see How to sign certificates.
Securing forwarders
For examples on configuring the Ingress controller to accept data from forwarders and securing the data in Kubernetes, see the Ingress documentation.
Password management
In Kubernetes, store sensitive information such as passwords, OAuth tokens, and SSH keys using Secrets objects. For information on how to manage your passwords for Splunk Enterprise deployments, see the password management documentation.
Using a FIPS 140-3 enabled cluster
The Splunk Operator for Kubernetes is fully certified to run on FIPS 140-3 compliant clusters. No modifications to the provided container images are required. To get started, create a Kubernetes cluster with FIPS-compliant nodes and follow the standard installation guide to deploy the operator.