Splunk Enterprise

Splunk Operator Kubernetes deployment ES package install "413 Request Entity Too Large nginx"

rphillips_splk
Splunk Employee
Splunk Employee

Uploading Splunk-Enterprise-Security package (800MB .spl file) from user machine to deployer via deployer web UI results in the following exception:
413 Request Entity Too Large
nginx

environment:

  1. Environment is Azure AKS

  2. Search Heads behind NGINX Ingress controller

  3. attempted to add the application via the Deployer instance Upload Page. Click Upload and it fails instantly with: 413 Request Entity Too Large nginx

0 Karma
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

resolution:
set on the ingress controller .yaml file
client_max_body_size and proxy-body-size to 1024m (1GB) (from default 100m)


Custom max body size
For NGINX, an 413 error will be returned to the client when the size in a request exceeds the maximum allowed size of the client request body. This size can be configured by the parameter client_max_body_size.
To configure this setting globally for all Ingress rules, the proxy-body-size value may be set in the NGINX ConfigMap. To use custom values in an Ingress rule define these annotation:

nginx.ingress.kubernetes.io/proxy-body-size: 1024m

 


example:
ingress.yml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/proxy-body-size: "1024m"
nginx.ingress.kubernetes.io/client-max-body-size: "1024m"
name: nginx-ingress
spec:
rules:
- host: example.com
http:
paths:
- backend:
serviceName: nginx-service
servicePort: 80
path: /

 


set on Splunk side:
web.conf
[settings]
max_upload_size = 1024


https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-max-bo...

https://stackoverflow.com/questions/64759983/nginx-ingress-returns-413-entity-too-large

View solution in original post

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

resolution:
set on the ingress controller .yaml file
client_max_body_size and proxy-body-size to 1024m (1GB) (from default 100m)


Custom max body size
For NGINX, an 413 error will be returned to the client when the size in a request exceeds the maximum allowed size of the client request body. This size can be configured by the parameter client_max_body_size.
To configure this setting globally for all Ingress rules, the proxy-body-size value may be set in the NGINX ConfigMap. To use custom values in an Ingress rule define these annotation:

nginx.ingress.kubernetes.io/proxy-body-size: 1024m

 


example:
ingress.yml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/proxy-body-size: "1024m"
nginx.ingress.kubernetes.io/client-max-body-size: "1024m"
name: nginx-ingress
spec:
rules:
- host: example.com
http:
paths:
- backend:
serviceName: nginx-service
servicePort: 80
path: /

 


set on Splunk side:
web.conf
[settings]
max_upload_size = 1024


https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-max-bo...

https://stackoverflow.com/questions/64759983/nginx-ingress-returns-413-entity-too-large

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...