| Splunk Development & Testing Platforms | Amazon Elastic Kubernetes Service (EKS), Google Kubernetes Engine (GKE) |
| Customer Reported Platforms | Microsoft Azure Kubernetes Service (AKS), Red Hat OpenShift |
| Partner Tested Platforms | HPE Ezmeral |
| Other Platforms | CNCF certified distribution |
**Warning:** Setting environment variables used by Splunk or Ansible will affect Splunk installation and operation | +| schedulerName | string | Name of [Scheduler](https://kubernetes.io/docs/concepts/scheduling/kube-scheduler/) to use for pod placement (default: `default-scheduler`) | +| affinity | [Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#affinity-v1-core) | [Kubernetes Affinity](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity) rules that control how pods are assigned to particular nodes | +| resources | [ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#resourcerequirements-v1-core) | The settings for allocating [compute resource requirements](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) to use for each pod instance. The default settings should be considered for demo/test purposes.
Please see [Hardware Resource Requirements](/installation/Prerequisites#hardware-resources-requirements) for production values. | +| serviceTemplate | [Service](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#service-v1-core) | Template used to create Kubernetes [Services](https://kubernetes.io/docs/concepts/services-networking/service/) | +| topologySpreadConstraint | [TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#topologyspreadconstraint-v1-core) | Template used to create Kubernetes [TopologySpreadConstraint](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/) | + +```yaml +apiVersion: enterprise.splunk.com/v4 +kind: Standalone +metadata: + name: s1 + namespace: splunk +spec: + image: splunk/splunk-operator:latest + imagePullPolicy: Always + livenessInitialDelaySeconds: 400 + readinessInitialDelaySeconds: 390 + extraEnv: + - name: ADDITIONAL_ENV_VAR_1 + value: "test_value_1" + - name: ADDITIONAL_ENV_VAR_2 + value: "test_value_2" + schedulerName: "default-scheduler" + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: topology.kubernetes.io/zone + operator: In + values: + - antarctica-east1 + - antarctica-west1 + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + preference: + matchExpressions: + - key: another-node-label-key + operator: In + values: + - another-node-label-value + resources: + requests: + memory: "512Mi" + cpu: "0.1" + limits: + memory: "8Gi" + cpu: "4" + serviceTemplate: + spec: + type: LoadBalancer + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: zone + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + foo: bar +``` + + +## Common Spec Parameters for Splunk Enterprise Resources + +The following additional configuration parameters may be used for all Splunk Enterprise resources, including: + - `Standalone` + - `LicenseManager` + - `SearchHeadCluster` + - `ClusterManager` + - `IndexerCluster` + +| Key | Type | Description | +| ---------------------- | ----------------- | ----------------------------------------------------------------------------- | +| etcVolumeStorageConfig | StorageClassSpec | Storage class spec for Splunk etc volume as described in [StorageClass](/configuration/StorageClass) | +| varVolumeStorageConfig | StorageClassSpec | Storage class spec for Splunk var volume as described in [StorageClass](/configuration/StorageClass) | +| volumes | [Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#volume-v1-core) | List of one or more [Kubernetes volumes](https://kubernetes.io/docs/concepts/storage/volumes/). These will be mounted in all container pods as as `/mnt/
+
When using TLS for Ingress, we recommend you add an additional port for secure communication. By default, port 9997 will be assigned for non-encrypted traffic and you can use any other available port for secure communications.
@@ -379,21 +389,24 @@ spec:
number: 9998
```
-*Note*: this TLS example requires that `outputs.conf` on your forwarders includes the setting `tlsHostname = splunk.example.com`. Istio requires the TLS header to be defined so it to know which indexers to forward the traffic to. If this parameter is not defined, your forwarder connections will fail.
+{: .note }
+This TLS example requires that `outputs.conf` on your forwarders includes the setting `tlsHostname = splunk.example.com`. Istio requires the TLS header to be defined so it to know which indexers to forward the traffic to. If this parameter is not defined, your forwarder connections will fail.
If you only have one indexer cluster that you would like to use as the destination for all S2S traffic, you can optionally replace `splunk.example.com` in the above examples with the wildcard `*`. When you use this wildcard, you do not have to set the `tlsHostname` parameter in `outputs.conf` on your forwarders.
-4. Deploy an app to the standalone instance with the inputs.conf settings needed to open port 9998 and configure the relevant TLS settings. For details on app management using the Splunk Operator, see [Using Apps for Splunk Configuration](https://splunk.github.io/splunk-operator/Examples.html#installing-splunk-apps).
+4. Deploy an app to the standalone instance with the inputs.conf settings needed to open port 9998 and configure the relevant TLS settings. For details on app management using the Splunk Operator, see [Using Apps for Splunk Configuration](/configuration/Examples#installing-splunk-apps).
Configure the Forwarder's outputs.conf and the Indexer's inputs.conf using the documentation [Configure Secure Forwarding](https://docs.splunk.com/Documentation/Splunk/latest/Security/Aboutsecuringdatafromforwarders)
-#### Splunk Forwarder data with TLS Gateway Termination
+##### Splunk Forwarder data with TLS Gateway Termination
-In this configuration, Istio is terminating the encryption at the Gateway and forwarding the decrypted traffic to Splunk Enterprise. Note that in this case the Forwarder's outputs.conf should be configured for TLS, while the Indexer's input.conf should be configured to accept non-encrypted traffic.
+In this configuration, Istio is terminating the encryption at the Gateway and forwarding the decrypted traffic to Splunk Enterprise.
+{: .note }
+In this case the Forwarder's outputs.conf should be configured for TLS, while the Indexer's input.conf should be configured to accept non-encrypted traffic.
-
+
1. Create a TLS secret with the certificates needed to decrypt traffic. These are the same commands used on your Indexer to terminate TLS:
@@ -445,7 +458,8 @@ spec:
number: 9997
host: splunk-standalone-standalone-service
```
-Note that the Virtual Service no longer handles TLS since it has been terminated at the gateway.
+{: .note }
+The Virtual Service no longer handles TLS since it has been terminated at the gateway.
4. Configure your Forwarder and Indexer or Standalone certificates using the documentation: [Securing data from forwarders](https://docs.splunk.com/Documentation/Splunk/latest/Security/Aboutsecuringdatafromforwarders).
@@ -457,7 +471,8 @@ Istio is a popular choice for its Service Mesh capabilities. However, Service Me
## Configuring Ingress Using NGINX
-**NOTE**: There are at least 3 flavors of the Nginx Ingress controller.
+{: .note }
+There are at least 3 flavors of the Nginx Ingress controller.
- Kubernetes Ingress Nginx (open source)
- Nginx Ingress Open Source (F5's open source version)
@@ -558,7 +573,8 @@ There are a few important configurations to be aware of in the TLS configuration
* The `nginx.ingress.kubernetes.io/backend-protocol:` annotation requires `"HTTPS"` when TLS is configured on the backend services.
* The secretName must reference a [valid TLS secret](https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets).
-Note: This example assumes that https is enabled for Splunk Web.
+{: .note }
+This example assumes that https is enabled for Splunk Web.
```
apiVersion: networking.k8s.io/v1beta1
@@ -607,7 +623,8 @@ spec:
### Configuring Ingress NGINX for Splunk Forwarders with End-to-End TLS
-Note: In this example we used port 9997 for non-encrypted communication, and 9998 for encrypted.
+{: .note }
+In this example we used port 9997 for non-encrypted communication, and 9998 for encrypted.
Update the default Ingress NGINX configuration to add the ConfigMap and Service ports:
@@ -682,7 +699,7 @@ The Nginx Ingress Controller is an open source version of the F5 product. Please
We followed the product's Helm Chart installation guide. It requires a cluster with internet access.
[NGINX Ingress Controller Helm Installation]( https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-helm/)
-#### Setup Helm
+##### Setup Helm
```shell
# clone the repo and check out the current production branch
@@ -698,7 +715,7 @@ $ helm repo update
$ kubectl create -f crds/
```
-#### Install Ingress
+##### Install Ingress
```shell
cd deployments/helm-chart
@@ -715,7 +732,7 @@ splunk-nginx default 5 2020-10-29 15:03:47.6 EDT deployed nginx-ingr
helm upgrade splunk-nginx nginx-stable/nginx-ingress
```
-#### Configure Ingress services
+##### Configure Ingress services
##### Configure Ingress for Splunk Web and HEC
@@ -771,7 +788,6 @@ status:
Enable the global configuration to setup a listener and transport server
1. Create the GlobalConfiguration:
-
```yaml
apiVersion: k8s.nginx.org/v1alpha1
kind: GlobalConfiguration
@@ -800,19 +816,17 @@ spec:
```
2. Edit the service to establish a node-port for the port being setup as the listener:
- 1. List the service:
-
-```yaml
-kubectl get svc
-NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
-splunk-nginx-nginx-ingress LoadBalancer 172.20.195.54 aa725344587a4443b97c614c6c78419c-1675645062.us-east-2.elb.amazonaws.com 80:31452/TCP,443:30402/TCP,30403:30403/TCP 7d1h
-```
-
- 2. Edit the service and add the Splunk Forwarder ingress port:
-
-```
-kubectl edit service splunk-nginx-nginx-ingress
-```
+ 1. List the service:
+ ```yaml
+ kubectl get svc
+ NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
+ splunk-nginx-nginx-ingress LoadBalancer 172.20.195.54 aa725344587a4443b97c614c6c78419c-1675645062.us-east-2.elb.amazonaws.com 80:31452/TCP,443:30402/TCP,30403:30403/TCP 7d1h
+ ```
+
+ 2. Edit the service and add the Splunk Forwarder ingress port:
+ ```
+ kubectl edit service splunk-nginx-nginx-ingress
+ ```
Example Service:
```yaml
@@ -997,7 +1011,8 @@ spec:
- "license-manager.splunk.example.com"
```
-Note that the `credentialName` references the same `secretName` created and managed by the Certificate object.
+{: .note }
+The `credentialName` references the same `secretName` created and managed by the Certificate object.
3. If you are manually importing your certificates into separate Secrets for each hostname, you can reference these by instead using multiple `port` objects in your Gateway:
diff --git a/docs/_configuration/KubernetesQOS.md b/docs/_configuration/KubernetesQOS.md
new file mode 100644
index 000000000..2788dbb39
--- /dev/null
+++ b/docs/_configuration/KubernetesQOS.md
@@ -0,0 +1,76 @@
+---
+title: Kubernetes Quality of Service Classes
+nav_order: 27.1
+---
+
+## Using Kubernetes Quality of Service Classes (QoS)
+
+In addition to the guidelines provided in the [reference hardware](/installation/Prerequisites#hardware-resources-requirements), [Kubernetes QoS Classes](https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/) can be used to configure CPU/Mem resources allocations that map to your _service level objectives_. For further information on utilizing Kubernetes Quality of Service (QoS) classes, see the table below:
+
+
+| QoS | Summary| Description |
+| ---------- | ------- | ------- |
+| _Guaranteed_ | _CPU/Mem ```requests``` = CPU/Mem ```limits```_ | _When the CPU and memory ```requests``` and ```limits``` values are equal, the pod is given a QoS class of Guaranteed. This level of service is recommended for Splunk Enterprise ___production environments___._ |
+| _Burstable_ | _CPU/Mem ```requests``` < CPU/Mem ```limits```_ | _When the CPU and memory ```requests``` value is set lower than the ```limits``` the pod is given a QoS class of Burstable. This level of service is useful in a user acceptance testing ___(UAT) environment___, where the pods run with minimum resources, and Kubernetes allocates additional resources depending on usage._|
+| _BestEffort_ | _No CPU/Mem ```requests``` or ```limits``` are set_ | _When the ```requests``` or ```limits``` values are not set, the pod is given a QoS class of BestEffort. This level of service is sufficient for ___testing, or a small development task___._ |
+
+
+## Examples of Guaranteed and Burstable QoS
+
+### A Guaranteed QoS Class example:
+Set equal ```requests``` and ```limits``` values for CPU and memory to establish a QoS class of Guaranteed.
+
+{: .note }
+A pod will not start on a node that cannot meet the CPU and memory ```requests``` values.
+
+Example: The minimum resource requirements for a Standalone Splunk Enterprise instance in production are 24 vCPU and 12GB RAM.
+
+```yaml
+apiVersion: enterprise.splunk.com/v4
+kind: Standalone
+metadata:
+ name: example
+spec:
+ imagePullPolicy: Always
+ resources:
+ requests:
+ memory: "12Gi"
+ cpu: "24"
+ limits:
+ memory: "12Gi"
+ cpu: "24"
+```
+
+### A Burstable QoS Class example:
+Set the ```requests``` value for CPU and memory lower than the ```limits``` value to establish a QoS class of Burstable.
+
+Example: This Standalone Splunk Enterprise instance should start with minimal indexing and search capacity, but will be allowed to scale up if Kubernetes is able to allocate additional CPU and Memory up to the ```limits``` values.
+
+```yaml
+apiVersion: enterprise.splunk.com/v4
+kind: Standalone
+metadata:
+ name: example
+spec:
+ imagePullPolicy: Always
+ resources:
+ requests:
+ memory: "2Gi"
+ cpu: "4"
+ limits:
+ memory: "12Gi"
+ cpu: "24"
+```
+
+### A BestEffort QoS Class example:
+With no requests or limits values set for CPU and memory, the QoS class is set to BestEffort. The BestEffort QoS is not recommended for use with Splunk Operator.
+
+### Pod Resources Management
+
+__CPU Throttling__
+
+Kubernetes starts throttling CPUs if a pod's demand for CPU exceeds the value set in the ```limits``` parameter. If your nodes have extra CPU resources available, leaving the ```limits``` value unset will allow the pods to utilize more CPUs.
+
+__POD Eviction - OOM__
+
+As oppose to throttling in case of CPU cycles starvation, Kubernetes will evict a pod from the node if the pod's memory demands exceeds the value set in the ```limits``` parameter.
diff --git a/docs/MultisiteExamples.md b/docs/_configuration/MultisiteExamples.md
similarity index 89%
rename from docs/MultisiteExamples.md
rename to docs/_configuration/MultisiteExamples.md
index 15139b57c..1ca316970 100644
--- a/docs/MultisiteExamples.md
+++ b/docs/_configuration/MultisiteExamples.md
@@ -1,18 +1,21 @@
+---
+title: Examples Multisite Deployments
+nav_order: 28.2
+#nav_exclude: true
+---
+
# Configuring Splunk Enterprise Multisite Deployments
+{: .no_toc }
+This document provides examples to configure a multisite cluster using the splunk-operator.
-This document provides examples to configure a multisite cluster using the splunk-operator.
+Please refer to the [Example Deployments](/configuration/Examples) for more information and examples about deploying the different Splunk resources in single site mode.
-- [Configuring Splunk Enterprise Multisite Deployments](#configuring-splunk-enterprise-multisite-deployments)
- - [Multisite Indexer Clusters in Kubernetes](#multisite-indexer-clusters-in-kubernetes)
- - [Multipart IndexerCluster](#multipart-indexercluster)
- - [Deploy the cluster-manager](#deploy-the-cluster-manager)
- - [Deploy the indexer sites](#deploy-the-indexer-sites)
- - [Connecting a search-head cluster to a multisite indexer-cluster](#connecting-a-search-head-cluster-to-a-multisite-indexer-cluster)
+#### Table of contents
+{: .no_toc }
+- TOC
+{:toc}
-Please refer to the [Configuring Splunk Enterprise Deployments Guide](Example.md)
-for more information and examples about deploying the different Splunk resources
-in single site mode.
## Multisite Indexer Clusters in Kubernetes
@@ -148,7 +151,7 @@ metadata:
- enterprise.splunk.com/delete-pvc
spec:
replicas: 3
- image: "splunk/splunk:9.0.3-a2"
+ image: "splunk/splunk:{{ page.splunk_enterprise_version }}"
clusterManagerRef:
name: example
defaults: |-
diff --git a/docs/PasswordManagement.md b/docs/_configuration/PasswordManagement.md
similarity index 80%
rename from docs/PasswordManagement.md
rename to docs/_configuration/PasswordManagement.md
index 1d886f23f..17ce88806 100644
--- a/docs/PasswordManagement.md
+++ b/docs/_configuration/PasswordManagement.md
@@ -1,38 +1,39 @@
+---
+title: Password Management
+nav_order: 26
+#nav_exclude: true
+---
+
# Password Management
+{: .no_toc }
-- [Password Management](#password-management)
- - [Global kubernetes secret object](#global-kubernetes-secret-object)
- - [Default behavior of global kubernetes secret object](#default-behavior-of-global-kubernetes-secret-object)
- - [Splunk Secret Tokens in the global secret object](#splunk-secret-tokens-in-the-global-secret-object)
- - [HEC Token](#hec-token)
- - [Default administrator password](#default-administrator-password)
- - [pass4Symmkey](#pass4symmkey)
- - [IDXC pass4Symmkey](#idxc-pass4symmkey)
- - [SHC pass4Symmkey](#shc-pass4symmkey)
- - [Information for Splunk Enterprise administrator](#information-for-splunk-enterprise-administrator)
- - [Secrets on Docker Splunk](#secrets-on-docker-splunk)
- - [SmartStore Access using AWS IAM Role for Service Account](#smartstore-access-using-aws-iam-role-for-service-account)
- - [Support for AWS IAM Role for Service Account in Splunk Operator Deployment](#support-for-aws-iam-role-for-service-account-in-splunk-operator-deployment)
-
-## Global kubernetes secret object
-A global kubernetes secret object acts as the source of secret tokens for a kubernetes namespace used by all Splunk Enterprise CR's. It's name follows the format `splunk-+ +#### Table of contents +{: .no_toc } +- TOC +{:toc} + ## Default behavior of global kubernetes secret object Upon the creation of the first Splunk Enterprise CR in a given namespace, the operator checks for the existence of a global kubernetes secret object: - If the object does not exist, - - It creates the global kubernetes secret object with name splunk-`
+Before the creation of any Splunk deployments in the kubernetes namespace, the admin can create a global kubernetes secret object using the tokens mentioned below. The operator will use these pre-populated values to deploy. ### Splunk Secret Tokens in the global secret object The configurable Splunk Secret Tokens include: @@ -57,13 +58,13 @@ The configurable Splunk Secret Tokens include: **Key name in global kubernetes secret object**: `shc.secret` **Description**: shc.secret is an authentication token for inter-communication specifically for search head clustering in Splunk Enterprise. -For examples of performing CRUD operations on the global secrets object, see [examples](Examples.md#managing-global-kubernetes-secret-object). For more information on managing kubernetes secret objects refer [kubernetes.io managing secrets](https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kubectl/) +For examples of performing CRUD operations on the global secrets object, see [examples](/configuration/Examples#managing-global-kubernetes-secret-object). For more information on managing kubernetes secret objects refer [kubernetes.io managing secrets](https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kubectl/) ## Information for Splunk Enterprise administrator - The default administrator account cannot be disabled on any Splunk Enterprise instance. The kubernetes operator uses this account to interact with all Splunk Enterprise instances in the namespace. - The passwords managed using the global kubernetes secret object should never be changed using Splunk Enterprise tools (CLI, UI.) -- The default administrator account must use the global kubernetes secret object for any password changes. See [managing global kubernetes secret object](Examples.md#managing-global-kubernetes-secret-object) +- The default administrator account must use the global kubernetes secret object for any password changes. See [managing global kubernetes secret object](/configuration/Examples#managing-global-kubernetes-secret-object) - After initiating a update/delete operation on the global secrets object, the operator will require time to finish setting the changes on the all Splunk Enterprise instances in the namespace during which disruption of splunk services can be expected while the secret updates are happening. A status check on all the Splunk Enterprise cluster tiers is required. ## Secrets on Docker Splunk @@ -90,7 +91,7 @@ Below Example explains the steps required for setting up IAM Service Account Once the Service Account is created, make sure it is annotated with specific IAM Role. Once everything looks good, add service account to splunk custom resource. here is the example for adding it to `Standalone` instance -``` +```yaml apiVersion: enterprise.splunk.com/v4 kind: Standalone metadata: @@ -130,7 +131,7 @@ Make sure the token file mentioned in AWS_WEB_IDENTITY_TOKEN_FILE location is on Follow the steps mentioned above for creating AWS IAM Service Account. Make sure IAM Role only has least amount of privilege necessary reading apps from S3 bucket. Once the service account is created, map this service account to `splunk-operator` deployment. Below is the example -``` +```yaml apiVersion: apps/v1 kind: Deployment metadata: diff --git a/docs/PremiumApps.md b/docs/_configuration/PremiumApps.md similarity index 97% rename from docs/PremiumApps.md rename to docs/_configuration/PremiumApps.md index 16263bb38..dafa81544 100644 --- a/docs/PremiumApps.md +++ b/docs/_configuration/PremiumApps.md @@ -1,3 +1,9 @@ +--- +title: Premium Apps Installation +nav_order: 22 +#nav_exclude: true +--- + # Premium Apps Installation Guide The Splunk Operator automates the installation of Enterprise Security (ES) with support for other premium apps coming in the future releases. This page documents the prerequisites, installation steps, troublshooting steps, and limitations of deploying premium apps using the Splunk Operator. @@ -6,11 +12,11 @@ The Splunk Operator automates the installation of Enterprise Security (ES) with ### Before you begin -* You need the ability to utilize the Splunk Operator [app framework](https://splunk.github.io/splunk-operator/AppFramework.html) method of installation. +* You need the ability to utilize the Splunk Operator [app framework](/configuration/AppFramework) method of installation. * You need the access to the [Splunk ES](https://splunkbase.splunk.com/app/263/) app package. * ES support in Splunk Operator is starting from Splunk Operator Release `2.2.0` which requires Splunk Enterprise `9.0.3-a2` or later. Per the [Splunk Enterprise and Enterprise Security version compatibility matrix](https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/CompatMatrix), Splunk ES versions `7.1.0, 7.0.2, 7.0.1, 7.0.0 or 6.6.2` are supported currently. * You need to make sure pod resource specs meet the [ES hardware requirements](https://docs.splunk.com/Documentation/ES/latest/Install/DeploymentPlanning#Hardware_requirements). -* In the following sections, AWS S3 remote bucket is used for placing the splunk apps, but as given in the [app framework doc](https://splunk.github.io/splunk-operator/AppFramework.html), you can use Azure Blob remote buckets also. +* In the following sections, AWS S3 remote bucket is used for placing the splunk apps, but as given in the [app framework doc](/configuration/AppFramework), you can use Azure Blob remote buckets also. * You need to deploy add-ons to forwarders manually (or through your own methods). * You need to deploy Stream App manually * For ES version 7.1 or higher, [Behavioral Analytics Service](https://docs.splunk.com/Documentation/ES/7.1.0/User/BehavioralAnalyticsIntro#Provision_behavioral_analytics_service_with_Splunk_Enterprise_Security_7.1.0_or_higher) is unavailable for containerized Splunk deployments (supported for cloud releases only) @@ -46,7 +52,7 @@ When installing ES in an indexer clustering environment through the Splunk Opera When crafting your Custom Resource(CR) to create a Splunk Enterprise Deployment it is necessary to take the following configurations into account. -##### [appSources](https://splunk.github.io/splunk-operator/AppFramework.html#appsources) scope +##### [appSources](/configuration/AppFramework) scope - When deploying ES to a Standalone or to a Search Head Cluster, it must be configured with an appSources scope of "premiumApps". - When deploying the Splunk_TA_ForIndexers app to an Indexer Cluster, it must be configured with an appSources scope of "cluster". @@ -357,5 +363,5 @@ Check the pod log (e.g deployer pod) in case you want to monitor the pod while i Common issues that may be encountered are : * ES installation failed as you used default sslEnablement mode ("strict") - enable Splunk Web SSL in web.conf. See the section [Special consideration while using ssl enabled mode of strict in SHC](#special-consideration-while-using-ssl-enabled-mode-of-strict-in-shc) * Ansible task timeouts - raise associated timeout (splunkdConnectionTimeout in web.conf, rcv_timeout, send_timeeout, cxn_timeeout etc values in server.conf) -* Pod Recycles - raise livenessProbe value. More details on this at [Health Check doc](HealthCheck.md) +* Pod Recycles - raise livenessProbe value. More details on this at [Health Check doc](/troubleshooting/HealthCheck) diff --git a/docs/Security.md b/docs/_configuration/Security.md similarity index 94% rename from docs/Security.md rename to docs/_configuration/Security.md index 8fdd85210..e95f92c10 100644 --- a/docs/Security.md +++ b/docs/_configuration/Security.md @@ -1,3 +1,9 @@ +--- +title: Secure Splunk deployments +nav_order: 27 +#nav_exclude: true +--- + # Secure Splunk deployments in Kubernetes Before creating new deployments in Kubernetes, it is important you consider the security aspects of your environment. This document describes how to secure your deployment using the Operator and Splunk Enterprise configurations, and provides examples for some common scenarios. @@ -19,7 +25,7 @@ The procedures to secure your deployment are the same regardless of your choice |Splunk Web | Gateway Termination | NO | |REST API | Gateway Termination | NO | -For more information about how to setup Ingress Controllers using the Operator visit [Ingress Documentation](https://github.com/splunk/splunk-operator/blob/develop/docs/Ingress.md). +For more information about how to setup Ingress Controllers using the Operator visit [Ingress Documentation](/configuration/Ingress). ## Prerequisites @@ -74,7 +80,7 @@ privKeyPath = $SPLUNK_HOME/etc/apps/myapp/mycerts/mySplunkPrivateKey.key serverCert = $SPLUNK_HOME/etc/apps/myapp/mycerts/mySplunkCertificate.pem ``` -* Deploy the app to the Splunk Enterprise instance. See [Install Apps using Splunk Operator](https://github.com/splunk/splunk-operator/blob/develop/docs/Examples.md#installing-splunk-apps). +* Deploy the app to the Splunk Enterprise instance. See [Install Apps using Splunk Operator](/configuration/Examples#installing-splunk-apps). * Create the Ingress configuration to allow access to port 8000. This configuration creates a gateway and virtual service for passing the traffic through to the Splunk Enterprise instance. @@ -219,9 +225,9 @@ Learn more about APIs available here: [REST Manual](https://docs.splunk.com/Docu ## Securing Forwarders -For examples on configuring the Ingress controller to accept data from Forwarders, and securing the data in Kubernetes, see: [Secure Forwarding](https://github.com/splunk/splunk-operator/blob/develop/docs/Ingress.md) +For examples on configuring the Ingress controller to accept data from Forwarders, and securing the data in Kubernetes, see: [Secure Forwarding](/configuration/Ingress) ## Password Management -In Kubernetes, sensitive information such as passwords, OAuth tokens, and ssh keys should be stored using the Secrets objects. Learn how to manage your passwords for Splunk Enterprise deployments in: [Password Management](https://github.com/splunk/splunk-operator/blob/develop/docs/PasswordManagement.md) +In Kubernetes, sensitive information such as passwords, OAuth tokens, and ssh keys should be stored using the Secrets objects. Learn how to manage your passwords for Splunk Enterprise deployments in: [Password Management](/configuration/PasswordManagement) diff --git a/docs/SmartStore.md b/docs/_configuration/SmartStore.md similarity index 60% rename from docs/SmartStore.md rename to docs/_configuration/SmartStore.md index c36944540..eda664015 100644 --- a/docs/SmartStore.md +++ b/docs/_configuration/SmartStore.md @@ -1,8 +1,15 @@ +--- +title: SmartStore +nav_order: 24 +#nav_exclude: true +--- + # SmartStore Resource Guide -*NOTE: The below method is a temporary way of installing SmartStore configuration & indexes. Starting from the Splunk Operator release 1.0.2, an enhanced App installation framework is introduced which is the recommended method to install SmartStore indexes & configuration. The below method may still be used to specify the S3 access keys, which avoids storing them in the S3 buckets (via the App installation framework)* +{: .note } +The below method is a temporary way of installing SmartStore configuration & indexes. Starting from the Splunk Operator release 1.0.2, an enhanced App installation framework is introduced which is the recommended method to install SmartStore indexes & configuration. The below method may still be used to specify the S3 access keys, which avoids storing them in the S3 buckets (via the App installation framework) -The Splunk Operator includes a method for configuring a SmartStore remote storage volume with index support using a [Custom Resource](https://splunk.github.io/splunk-operator/CustomResources.html). The SmartStore integration is not implemented as a StorageClass. This feature and its settings rely on support integrated into Splunk Enterprise. See [SmartStore](https://docs.splunk.com/Documentation/Splunk/latest/Indexer/AboutSmartStore) for information on the feature and implementation considerations. +The Splunk Operator includes a method for configuring a SmartStore remote storage volume with index support using a [Custom Resource](/configuration/CustomResources). The SmartStore integration is not implemented as a StorageClass. This feature and its settings rely on support integrated into Splunk Enterprise. See [SmartStore](https://docs.splunk.com/Documentation/Splunk/latest/Indexer/AboutSmartStore) for information on the feature and implementation considerations. * SmartStore configuration is supported on these Custom Resources: Standalone and ClusterManager. * SmartStore support in the Splunk Operator is limited to Amazon S3 & S3-API-compliant object stores only if you are using the CRD configuration for S3 as described below." @@ -64,7 +71,8 @@ spec: The SmartStore parameters will be placed into the required .conf files in an app. The app is named as `splunk-operator`. In the case of a standalone deployment, the app is located at `/opt/splunk/etc/apps/` -Note: Custom apps with higher precedence can potentially overwrite the index and volume configuration in the splunk-operator app. Hence, care should be taken to avoid conflicting SmartStore configuration in custom apps. See [Configuration file precedence order](https://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles#How_Splunk_determines_precedence_order) +{: .note } +Custom apps with higher precedence can potentially overwrite the index and volume configuration in the splunk-operator app. Hence, care should be taken to avoid conflicting SmartStore configuration in custom apps. See [Configuration file precedence order](https://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles#How_Splunk_determines_precedence_order) @@ -76,7 +84,7 @@ Note: Custom apps with higher precedence can potentially overwrite the index and 3. Confirm the name of the Splunk indexes being used with the SmartStore volume. 4. Create/Update the Cluster Manager custom resource specification with volume and index configuration (see Example below) 5. Apply the custom resource specification: kubectl -f apply Clustermanager.yaml -6. Follow the rest of the steps to Create an Indexer Cluster. See [Examples](Examples.md) +6. Follow the rest of the steps to Create an Indexer Cluster. See [Example Deployments](/configuration/Examples) Example. Clustermanager.yaml: @@ -111,127 +119,12 @@ spec: The SmartStore parameters will be placed into the required .conf files in an app. The app is named as `splunk-operator`. In case of a Indexer cluster deployment, the app is located on Cluster manager at `/opt/splunk/etc/manager-apps/`. Once the SmartStore configuration is populated to Cluster Manager's `splunk-operator` app, Operator issues a bundle push command to Cluster Manager, so that the SmartStore configuration is distributed to all the peers in that indexer cluster -Note: Custom apps with higher precedence can potentially overwrite the index and volume configuration in the splunk-operator app. Hence, care should be taken to avoid conflicting SmartStore configuration in custom apps. See [Configuration file precedence order](https://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles#How_Splunk_determines_precedence_order) +{: .note } +Custom apps with higher precedence can potentially overwrite the index and volume configuration in the splunk-operator app. Hence, care should be taken to avoid conflicting SmartStore configuration in custom apps. See [Configuration file precedence order](https://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles#How_Splunk_determines_precedence_order) ## SmartStore Resource Spec Parameters -There are additional SmartStore settings available for tuning and storage management. The settings are equivalent to the SmartStore settings defined in indexes.conf and server.conf for Splunk Enterprise. The SmartStore resource applies to the `Standalone` and `ClusterManager` Custom Resources, and adds the following `Spec` configuration parameters: - - -```yaml -smartstore: - description: - Splunk Smartstore configuration. Refer to indexes.conf.spec and - server.conf.spec on docs.splunk.com - properties: - cacheManager: - description: Defines Cache manager settings - properties: - evictionPadding: - description: Additional size beyond 'minFreeSize' before eviction kicks in - type: integer - evictionPolicy: - description: Eviction policy to use - type: string - hotlistBloomFilterRecencyHours: - description: - Time period relative to the bucket's age, during which the bloom - filter file is protected from cache eviction - type: integer - hotlistRecencySecs: - description: - Time period relative to the bucket's age, during which the bucket is - protected from cache eviction - type: integer - maxCacheSize: - description: Max cache size per partition - type: integer - maxConcurrentDownloads: - description: - Maximum number of buckets that can be downloaded from remote storage - in parallel - type: integer - maxConcurrentUploads: - description: - Maximum number of buckets that can be uploaded to remote storage in - parallel - type: integer - type: object - defaults: - description: Default configuration for indexes - properties: - maxGlobalDataSizeMB: - description: - MaxGlobalDataSizeMB defines the maximum amount of space for warm and - cold buckets of an index - type: integer - maxGlobalRawDataSizeMB: - description: - MaxGlobalDataSizeMB defines the maximum amount of cumulative space - for warm and cold buckets of an index - type: integer - volumeName: - description: Remote Volume name - type: string - type: object - indexes: - description: List of Splunk indexes - items: - description: IndexSpec defines Splunk index name and storage path - properties: - hotlistBloomFilterRecencyHours: - description: - Time period relative to the bucket's age, during which the bloom - filter file is protected from cache eviction - type: integer - hotlistRecencySecs: - description: - Time period relative to the bucket's age, during which the bucket - is protected from cache eviction - type: integer - maxGlobalDataSizeMB: - description: - MaxGlobalDataSizeMB defines the maximum amount of space for warm - and cold buckets of an index - type: integer - maxGlobalRawDataSizeMB: - description: - MaxGlobalDataSizeMB defines the maximum amount of cumulative space - for warm and cold buckets of an index - type: integer - name: - description: Splunk index name - type: string - remotePath: - description: Index location relative to the remote volume path - type: string - volumeName: - description: Remote Volume name - type: string - type: object - type: array - volumes: - description: List of remote storage volumes - items: - description: VolumeSpec defines remote volume name and remote volume URI - properties: - endpoint: - description: Remote volume URI - type: string - name: - description: Remote volume name - type: string - path: - description: Remote volume path - type: string - secretRef: - description: Secret object name - type: string - type: object - type: array - type: object - -``` +There are additional SmartStore settings available for tuning and storage management. The settings are equivalent to the SmartStore settings defined in indexes.conf and server.conf for Splunk Enterprise. The SmartStore resource applies to the `Standalone` and `ClusterManager` Custom Resources. Refer to [Custom Resources Reference](/configuration/CustomResources#smartstore-resource-spec-parameters) for all settings. ## Following is the table that maps the Custom Resource SmartStore spec to the Splunk docs. @@ -247,11 +140,11 @@ See [indexes.conf](https://docs.splunk.com/Documentation/Splunk/latest/Admin/Ind | hotlistBloomFilterRecencyHours |hotlist_bloom_filter_recency_hours | [\
| Splunk Development & Testing Platforms | Amazon Elastic Kubernetes Service (EKS), Google Kubernetes Engine (GKE) |
| Customer Reported Platforms | Microsoft Azure Kubernetes Service (AKS), Red Hat OpenShift |
| Partner Tested Platforms | HPE Ezmeral |
| Other Platforms | CNCF certified distribution |
| Splunk Development & Testing Platforms | Amazon Elastic Kubernetes Service (EKS), Google Kubernetes Engine (GKE) |
| Customer Reported Platforms | Microsoft Azure Kubernetes Service (AKS), Red Hat OpenShift |
| Partner Tested Platforms | HPE Ezmeral |
| Other Platforms | CNCF certified distribution |