Install Humio Operator on Kubernetes

The Humio Operator creates a way to deploy and manage one or more Humio Clusters, as well as configure Humio components such as Repositories, Parsers and Ingest Tokens.

Running Humio with the Humio Operator reduces the overall cost of running Humio on Kubernetes by running a Humio-maintained controller that manages many of the cluster operations for you.

Features

  • Automates the installation of a Humio Cluster on Kubernetes

  • Automates the management of Humio Repositories, Parsers, and Ingest Tokens

  • Automates the management of Humio, such as partition balancing

  • Automates version upgrades of Humio

  • Automates configuration changes of Humio

  • Allows the use various storage mediums, including hostPath or storage class PVCs

  • Automates the cluster authentication and security such as pod-to-pod TLS, SAML and OAuth

Note

If you are looking for information about shipping data from a Kubernetes cluster to Humio without running Humio in Kubernetes, please see our Kubernetes platform documentation.

Installation using the Humio Operator

The easiest way to install Humio in Kubernetes is to use the offical Humio Operator. This document describes installing the Humio Operator. Once the Humio Operator is running, and number of Humio resources may then be created, including Humio Clusters, Repositories, Parsers and Ingest Tokens.

Pre-Requisites
Tooling

Platform

Services

  • A running Kafka cluster with network access from Kubernetes nodes to both Zookeeper and Kafka brokers

  • cert-manager v1.0+ (by default, but can be disabled with certmanager set to false)

  • NGINX Ingress Controller controller v0.34.1 (only required if configuring HumioCluster CR's with ingress.controller set to nginx)

Installing the CRD's

Obtain the version from Releases. Use the latest stable release.

logscale
export HUMIO_OPERATOR_VERSION=x.x.x
kubectl apply --server-side -f https://raw.githubusercontent.com/humio/humio-operator/humio-operator-${HUMIO_OPERATOR_VERSION}/config/crd/bases/core.humio.com_humioclusters.yaml
kubectl apply --server-side -f https://raw.githubusercontent.com/humio/humio-operator/humio-operator-${HUMIO_OPERATOR_VERSION}/config/crd/bases/core.humio.com_humioexternalclusters.yaml
kubectl apply --server-side -f https://raw.githubusercontent.com/humio/humio-operator/humio-operator-${HUMIO_OPERATOR_VERSION}/config/crd/bases/core.humio.com_humioingesttokens.yaml
kubectl apply --server-side -f https://raw.githubusercontent.com/humio/humio-operator/humio-operator-${HUMIO_OPERATOR_VERSION}/config/crd/bases/core.humio.com_humioparsers.yaml
kubectl apply --server-side -f https://raw.githubusercontent.com/humio/humio-operator/humio-operator-${HUMIO_OPERATOR_VERSION}/config/crd/bases/core.humio.com_humiorepositories.yaml
kubectl apply --server-side -f https://raw.githubusercontent.com/humio/humio-operator/humio-operator-${HUMIO_OPERATOR_VERSION}/config/crd/bases/core.humio.com_humioviews.yaml
kubectl apply --server-side -f https://raw.githubusercontent.com/humio/humio-operator/humio-operator-${HUMIO_OPERATOR_VERSION}/config/crd/bases/core.humio.com_humioalerts.yaml
kubectl apply --server-side -f https://raw.githubusercontent.com/humio/humio-operator/humio-operator-${HUMIO_OPERATOR_VERSION}/config/crd/bases/core.humio.com_humioactions.yaml

Note: It is possible to skip this step if not setting --skip-crds when installing the Helm Chart. This is not recommended because uninstalling the helm chart will remove the custom resources.

Installing the Operator Helm Chart

To install the chart with the release name humio-operator:

logscale
helm repo add humio-operator https://humio.github.io/humio-operator

For Helm v3 or higher:

logscale
helm install humio-operator humio-operator/humio-operator \
  --namespace logging \
  --create-namespace \
  --version="${HUMIO_OPERATOR_VERSION}" \
  --skip-crds

Note: By default, we expect cert-manager to be installed in order to configure TLS. If you do not have cert-manager installed, or if you know you do not want TLS, see the configuration section for how to disable this.

Note: By default, we expect a non-OpenShift installation, see the configuration section for how to enable OpenShift specific functionality.

The command deploys humio-operator on the Kubernetes cluster in the default configuration. The configuration section lists the parameters that can be configured during installation.

Tip

List all releases using helm list

Creating a Humio Cluster

A Humio Cluster can be created once the Humio Operator is running. Follow the instructions for creating a Humio Cluster resource.

Humio Operator Permissions

Note that by default, Kubernetes ServiceAccounts are created for the each container in the Humio pods. The Humio Operator will need the appropriate permissions to create ClusterRole, and ClusterRoleBinding resources, as well as Role and RoleBinding resources in the namespace in which the HumioCluster is created.

This can be bypassed by creating the ServiceAccounts prior to creating the HumioCluster resource and then configuring the HumioCluster to use them. See Custom Service Accounts.

If this is done, both operator.rbac.allowManageRoles and operator.rbac.allowManageClusterRoles can be set to false.

Uninstalling the Operator Helm Chart

To uninstall/delete the humio-operator deployment:

logscale
helm delete humio-operator --namespace logging

The command removes all the Kubernetes components associated with the chart and deletes the release.

Configuration

The following table lists the configurable parameters of the ingress-nginx chart and their default values.

Parameter Description Default
operator.image.pullSecrets Image pull secrets to pull the operator container image. []
operator.image.repository Operator container image repository. humio/humio-operator
operator.image.tag Operator container image tag. <latest release tag>
operator.rbac.allowManageRoles Configure RBAC resources to allow the humio-operator to manage Role resources. Can be disabled if all RBAC resources are created outside the humio-operator. true
operator.rbac.allowManageClusterRoles Configure RBAC resources to allow the humio-operator to manage ClusterRole resources. Can be disabled if init container is disabled on all HumioCluster resources, or if all RBAC resources are created outside the humio-operator. true
operator.rbac.create Automatically create operator RBAC resources. true
operator.resources Operator resources requests and limits. {requests: {cpu: 250m, memory: 200Mi}, limits: {cpu: 250m, memory: 200Mi}}
operator.watchNamespaces List of namespaces the operator will watch for resources (if empty, it watches all namespaces). NB: If this is non-empty, it requires the use of Custom Service Accounts. []
openshift Install additional RBAC resources specific to OpenShift. false
certmanager Whether cert-manager is present on the cluster, which will be used for TLS functionality. true

These parameters can be passed via Helm's --set option.

For example:

logscale
helm install humio-operator humio-operator/humio-operator \
  --namespace logging \
  --create-namespace \
  --version="${HUMIO_OPERATOR_VERSION}" \
  --skip-crds