certmanager should be used for HEC and UI certificates

[ryanfaircloth]

Certmanager should provision certificates 8089 and 8000 communication

[mikedickey]

The ingress examples provided include cert-manager. We currently have no plans to automatically setup and manage ingress controllers (which typically will integrate with cert-manager), because this is very environmentally-specific. It's not clear to me what patterns exist here that could be productized. In the experiments I tried so far, it doesn't really simplify anything, but rather just shifts where you configure things.

[ryanfaircloth]

This is not specific to the ingress. When Splunk communicates with Splunk it should use TLS and non self signed certs. Splunk will auto generate self signed certs which is insecure. K8S-certmanager which is commonly deployed can be called instead to generate a valid cert. This cert should be mapped into server.conf/sslsettings

[jkoby]

Confirming: The Splunk API on port 8089 still uses self-signed certs by default. In a production environment customers would need a Kubernetes-native way to provision and replace these certificates with properly signed ones. Cert-manager is in widespread use for Ingress certificate management, but isn't limited to Ingresses.

[pogdin]

CSPL-1788