Splunk Operator Kubernetes deployment ES package install "413 Request Entity Too Large nginx"

[rphillips_splk]

Uploading Splunk-Enterprise-Security package (800MB .spl file) from user machine to deployer via deployer web UI results in the following exception:
413 Request Entity Too Large
nginx

environment:

1. Environment is Azure AKS

2. Search Heads behind NGINX Ingress controller

3. attempted to add the application via the Deployer instance Upload Page. Click Upload and it fails instantly with: 413 Request Entity Too Large nginx

[rphillips_splk · Accepted solution]

resolution:
set on the ingress controller .yaml file
client_max_body_size and proxy-body-size to 1024m (1GB) (from default 100m)

Custom max body size
For NGINX, an 413 error will be returned to the client when the size in a request exceeds the maximum allowed size of the client request body. This size can be configured by the parameter client_max_body_size.
To configure this setting globally for all Ingress rules, the proxy-body-size value may be set in the NGINX ConfigMap. To use custom values in an Ingress rule define these annotation:

nginx.ingress.kubernetes.io/proxy-body-size: 1024m

example:
ingress.yml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/proxy-body-size: "1024m"
nginx.ingress.kubernetes.io/client-max-body-size: "1024m"
name: nginx-ingress
spec:
rules:
- host: example.com
http:
paths:
- backend:
serviceName: nginx-service
servicePort: 80
path: /

set on Splunk side:
web.conf
[settings]
max_upload_size = 1024

https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-max-bo...

https://stackoverflow.com/questions/64759983/nginx-ingress-returns-413-entity-too-large