By Splunk July 19, 2018
Our friends at AWS made their highly-anticipated Elastic Container Service for Kubernetes (EKS) available earlier this month, making this the perfect time for Splunkers, Splunk customers and IT practitioners alike to get familiar with the phenomena that is Kubernetes. Why are we so excited about this? Because it means we can start taking advantage of a fully-managed service that makes it easy to deploy, manage and scale containerized applications using Kubernetes on AWS.
EKS makes it simple to jump into exploring a highly-available, production-ready implementation of the Kubernetes API without having to learn or manage the Kubernetes Control Plane ourselves. (Don’t worry, Kelsey – I promise to walk through “Kubernetes the Hard Way” in future labs!). ;)
This is also a chance to check out how Splunk can help collect your Kubernetes logs, metrics and metadata—all in one place—with Splunk Connect for Kubernetes!
Splunk Connect for Kubernetes is a collection of Helm charts that will deploy a Splunk-supported deployment of Fluentd* to your Kubernetes cluster, complete with a Splunk-built Fluentd HEC plugin to ship logs and metadata, and a metrics deployment that will capture your cluster metrics into Splunk’s Metric Store for use with our new analysis workspace.
In this walkthrough, EKS will provide the elements in the “Kubernetes Master” box pictured below, while we'll run the “Kubernetes Minions” (aka Worker Nodes or simply “Nodes”).
To follow along with us, you'll need the following:
A valid AWS account to deploy EKS with (OR an already functioning Kubernetes cluster so you can skip right to deploying Splunk Connect for Kubernetes in your flavor of Kubernetes)
3 Splunk Indexes (one for logs, one for meta, one for metrics; feel free to combine the logs and meta into one index if you want)
A valid HEC token
After this walkthrough, we'll end up with a Kubernetes environment that looks like this:
That's a beauty of an ITSI glass table candidate, if I’ve ever seen one… :) Stay tuned for more in a future lab!
Getting Started
I have prepared screencasts of my journey through the EKS setup guide to help guide you on your way!
In this first lab, we cover creating an EKS cluster, connecting with kubectl and deploying a sample app—Guestbook.
Now that you have a brand new EKS cluster, part 2 of the lab guides you through shipping logs, metadata, and metrics to Splunk Enterprise!
In this video we cover:
Ensuring our Splunk Indexes are created – In my screencast, I’ve already set up the indexes for logs, optional separate metadata index, and metrics, but you can read a step-by-step guide in the Splunk documentation.
Validate HEC Token(s) are created
Create a namespace for Splunk Connect for Kubernetes
kubectl create ns splunk-connect-k8s
Deploy Tiller
helm init --service-account tiller --tiller-namespace splunk-connect-k8s
Create values.yaml
Install Splunk Connect for Kubernetes
helm install --name
--tiller-namespace splunk-connect-k8s --namespace splunk-connect-k8s -f values.yaml https://github.com/splunk/splunk-connect-for-kubernetes/releases/download/v1.0.1/splunk-connect-for-kubernetes-1.0.1.tgz
Wrap Up
You are now the Captain of your very own, Splunk-instrumented, EKS cluster!
This is just the beginning of our voyage into the vast topic of containers and container orchestration, but with Splunk as your first mate, it should be smooth sailing from here on out!
We want to hear from you!
Are you looking to monitor Kubernetes clusters or other container environments? Looking to run Splunk in a containerized environment?
Join us on:
- Slack – #docker #kubernetes #openshift
- Splunk Answers
- Splunk GitHub
- Splunk Docker Hub
*You must have a valid support contract
----------------------------------------------------
Thanks!
Matthew Modestino
Join the Discussion