Splunk Operator compatibility matrix
Compatibility matrix for Splunk Operator for Kubernetes (SOK), Splunk Enterprise, and Kubernetes versions.
Each Splunk Operator for Kubernetes (SOK) release supports a specific set of Splunk Enterprise and Kubernetes versions. Use this matrix to verify compatibility before you install or upgrade.
For detailed information on each release, including breaking changes, new features, known issues, and fixed issues, see the Splunk Operator for Kubernetes change log.
SOK to Splunk Enterprise version compatibility
| SOK version | Released | Kubernetes (K8s) | Splunk Enterprise versions | Notes |
|---|---|---|---|---|
| 3.2.0 | 2026-09-24 | 1.32-1.37 | 9.4.15-10.6.0 | Breaking change: Index & Ingestion Separation's Queue secret now uses `secretKeyRef` instead of the old `volList`. |
| 3.1.0 | 2026-03-30 | 1.25-1.34 | 10.2.0+, 10.4+ (K8s 1.25-1.33, indexing and ingestion separation) | |
| 3.1.0 | 2026-03-30 | 1.25-1.34 | 9.4.3-10.0.4 (K8s 1.25-1.33, no indexing and ingestion separation) | |
| 3.1.0 | 2026-03-30 | 1.25-1.34 | 9.4.9+, 10.0.4+, 10.4+ (K8s 1.34 only) | Required for K8s 1.34 (new IAM Roles for Service Accounts (IRSA) token format) |
| 3.0.0 | 2025-09-19 | 1.25-1.34 | 9.3.7-10.2.0 (K8s 1.25-1.33) | Breaking change: you must accept the Splunk General Terms (EULA) |
| 3.0.0 | 2025-09-19 | 1.25-1.34 | 9.4.9+, 10.0.4+ (K8s 1.34 only) | Required for K8s 1.34 |
| 2.8.1 | 2025-07-17 | 1.27+ | 9.4.3, 9.4.2, 9.3.5, 9.2.7 | |
| 2.8.0 | 2025-05-12 | 1.27+ | 9.4.2, 9.4.1, 9.4.0, 9.3.4, 9.3.3 | |
| 2.7.1 | 2025-02-05 | 1.27+ | 9.4.1, 9.4.0, 9.3.x, 9.2.x | |
| 2.7.0 | 2024-12-06 | 1.27+ | 9.4.0, 9.3.2, 9.2.4, 9.1.7 |
Kubernetes version support history
| Kubernetes | Minimum SOK | Maximum SOK |
|---|---|---|
| 1.37 | 3.2.0 | 3.2.0 |
| 1.36 | 3.2.0 | 3.2.0 |
| 1.35 | 3.2.0 | 3.2.0 |
| 1.34 | 3.0.0 | 3.2.0 |
| 1.25-1.33 | 2.4.0 (1.25+) | 3.2.0 |
| 1.27+ | 2.6.0 | 2.8.1 |
| 1.26+ | 2.5.0 | 2.5.2 |
| 1.25+ | 2.4.0 | 2.4.0 |
| 1.22+ | 1.0.5 | 1.x |
Important version-specific notes: SOK 3.x
- 3.1.0 and 3.0.0, Kubernetes 1.34 constraint: Kubernetes 1.34 changes the IAM Roles for Service Accounts (IRSA) token format. Older splunkd binaries are incompatible with this format. If you deploy on K8s 1.34, use Splunk Enterprise 9.4.9+ or 10.0.4+. SOK 3.1.0 also supports 10.4+ on K8s 1.34, but 3.0.0 doesn't.
- 3.1.0, indexing and ingestion separation: SOK 3.1.0 adds support for this feature, which requires Splunk Enterprise 10.2.0+ or 10.4+. SOK 3.1.0 also supports versions 9.4.3-10.0.4, but without this feature.
- 3.0.0, Splunk General Terms (EULA) acceptance required: This is a breaking change. You must accept the Splunk General Terms before you deploy or upgrade. For more information, see the Install guide.
Important version-specific notes: SOK 2.x
- 2.6.1 lists 9.3.0, 9.3.2, and 9.2.4. Both 9.3.0 and 9.3.2 appear in the list, which might indicate a re-certification of 9.3.0 alongside the newer 9.3.2 update.
Important version-specific notes: SOK 1.x / 0.x
- 1.0.5 adds Kubernetes 1.22+ compatibility by updating the ClusterRole apiVersion in cluster_role.yaml from
rbac.authorization.k8s.io/v1beta1tov1. The CRD apiVersion change fromapiextensions.k8s.io/v1beta1tov1occurs earlier, in 1.0.0-RC. - 0.2.0 through 0.2.2 (Beta) require the
splunk/splunk:edgenightly image or Splunk Enterprise 8.1.0+. - 0.1.0 (Alpha) requires
splunk/splunk:edgeor Splunk Enterprise 8.0.3+.
Upgrade path guidance
When you upgrade Splunk Enterprise alongside SOK, always upgrade SOK first, then Splunk Enterprise. SOK 2.5.0 introduces a Level-2 Upgrade Strategy that sequences pod upgrades to protect cluster availability.
SOK 3.0.0 introduces a breaking change that requires manual EULA acceptance before the upgrade proceeds. Before you upgrade from any 2.x version to a 3.x version, review the SplunkOperatorUpgrade.md guide.