Skip to content

CSPL-4201 use OIDC in GitHub pipelines #1630

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 9 commits into
base: develop
Choose a base branch
from
Open

CSPL-4201 use OIDC in GitHub pipelines #1630

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
cc8f15e
CSPL-4201 Update GitHub Actions workflows to use OIDC tokens instead …
kubabuczak Nov 17, 2025
b6f9ed9
Update GitHub Actions workflows to include CSPL-4201-pipeline-tests-b…
kubabuczak Nov 17, 2025
75324c1
CSPL-4201 Enhance GitHub Actions workflows with role duration and tim…
kubabuczak Nov 19, 2025
f946bff
CSPL-4201 Update GitHub Actions workflow to add id-token permission
kubabuczak Nov 19, 2025
d44ef9d
CSPL-4201 job timeouts - reduce them on step level and adjust it to o…
kubabuczak Nov 20, 2025
730e606
Update GitHub Actions workflows to use environment variables for S3 c…
kubabuczak Nov 26, 2025
e6f148b
Update skipLogOutput setting in S3 bucket creation scripts for helm t…
kubabuczak Nov 27, 2025
091138e
Fix: pipelines not passing on not-supported Ubuntu version.
kubabuczak Nov 28, 2025
e6dd841
Remove CSPL-4201-pipeline-tests-base branch from multiple GitHub Acti…
kubabuczak Nov 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 14 additions & 8 deletions .github/workflows/arm-AL2023-build-test-push-workflow-AL2023.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,11 +89,12 @@ jobs:
sudo chmod +x operator-sdk_${OS}_${ARCH}
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand Down Expand Up @@ -203,11 +204,12 @@ jobs:
run: |
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand All @@ -232,6 +234,10 @@ jobs:
cp /snap/bin/kustomize ./bin/kustomize
- name: Run smoke test
id: smoketest
timeout-minutes: 240
env:
TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
run: |
make int-test
- name: Collect Test Logs
Expand Down
23 changes: 14 additions & 9 deletions .github/workflows/arm-AL2023-int-test-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ on:
jobs:
build-operator-image-arm-al2023:
runs-on: ubuntu-latest
timeout-minutes: 360
env:
SPLUNK_ENTERPRISE_IMAGE: ${{ secrets.ECR_PREFIX }}/${{ github.event.inputs.splunk_image_repository_tag }}
SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator
Expand All @@ -39,11 +38,12 @@ jobs:
sudo chmod +x operator-sdk_${OS}_${ARCH}
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand Down Expand Up @@ -153,11 +153,12 @@ jobs:
run: |
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand All @@ -181,6 +182,10 @@ jobs:
mkdir -p ./bin
cp /snap/bin/kustomize ./bin/kustomize
- name: Run Integration test
timeout-minutes: 240
env:
TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
run: |
make int-test
- name: Collect Test Logs
Expand Down
23 changes: 14 additions & 9 deletions .github/workflows/arm-RHEL-build-test-push-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ on:
jobs:
build-operator-image-arm-rhel:
runs-on: ubuntu-latest
timeout-minutes: 360
env:
SPLUNK_ENTERPRISE_IMAGE: ${{ secrets.ECR_PREFIX }}/${{ github.event.inputs.splunk_image_repository_tag }}
SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator
Expand All @@ -39,11 +38,12 @@ jobs:
sudo chmod +x operator-sdk_${OS}_${ARCH}
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand Down Expand Up @@ -153,11 +153,12 @@ jobs:
run: |
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand All @@ -181,6 +182,10 @@ jobs:
mkdir -p ./bin
cp /snap/bin/kustomize ./bin/kustomize
- name: Run Integration test
timeout-minutes: 240
env:
TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
run: |
make int-test
- name: Collect Test Logs
Expand Down
23 changes: 14 additions & 9 deletions .github/workflows/arm-RHEL-int-test-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ on:
jobs:
build-operator-image-arm-rhel:
runs-on: ubuntu-latest
timeout-minutes: 360
env:
SPLUNK_ENTERPRISE_IMAGE: ${{ secrets.ECR_PREFIX }}/${{ github.event.inputs.splunk_image_repository_tag }}
SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator
Expand All @@ -39,11 +38,12 @@ jobs:
sudo chmod +x operator-sdk_${OS}_${ARCH}
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand Down Expand Up @@ -153,11 +153,12 @@ jobs:
run: |
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand All @@ -181,6 +182,10 @@ jobs:
mkdir -p ./bin
cp /snap/bin/kustomize ./bin/kustomize
- name: Run Integration test
timeout-minutes: 240
env:
TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
run: |
make int-test
- name: Collect Test Logs
Expand Down
24 changes: 15 additions & 9 deletions .github/workflows/arm-Ubuntu-build-test-push-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,19 +89,20 @@ jobs:
sudo chmod +x operator-sdk_${OS}_${ARCH}
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
- name: Build and push Splunk Operator Image
run: |
export PLATFORMS=linux/arm64,linux/amd64
export BASE_IMAGE=ubuntu
export BASE_IMAGE_VERSION=24.10
export BASE_IMAGE_VERSION=24.04
export IMG=${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA
make docker-buildx PLATFORMS=$PLATFORMS BASE_IMAGE=$BASE_IMAGE BASE_IMAGE_VERSION=$BASE_IMAGE_VERSION IMG=$IMG
- name: Sign Splunk Operator image with a key
Expand Down Expand Up @@ -203,11 +204,12 @@ jobs:
run: |
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand All @@ -232,6 +234,10 @@ jobs:
cp /snap/bin/kustomize ./bin/kustomize
- name: Run smoke test
id: smoketest
timeout-minutes: 240
env:
TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
run: |
make int-test
- name: Collect Test Logs
Expand Down
25 changes: 15 additions & 10 deletions .github/workflows/arm-Ubuntu-int-test-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ on:
jobs:
build-operator-image-arm-ubuntu:
runs-on: ubuntu-latest
timeout-minutes: 360
env:
SPLUNK_ENTERPRISE_IMAGE: ${{ secrets.ECR_PREFIX }}/${{ github.event.inputs.splunk_image_repository_tag }}
SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator
Expand All @@ -39,19 +38,20 @@ jobs:
sudo chmod +x operator-sdk_${OS}_${ARCH}
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
- name: Build and push Splunk Operator Image
run: |
export PLATFORMS=linux/arm64,linux/amd64
export BASE_IMAGE=ubuntu
export BASE_IMAGE_VERSION=24.10
export BASE_IMAGE_VERSION=24.04
export IMG=${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA
make docker-buildx PLATFORMS=$PLATFORMS BASE_IMAGE=$BASE_IMAGE BASE_IMAGE_VERSION=$BASE_IMAGE_VERSION IMG=$IMG
int-tests-arm-ubuntu:
Expand Down Expand Up @@ -153,11 +153,12 @@ jobs:
run: |
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand All @@ -181,6 +182,10 @@ jobs:
mkdir -p ./bin
cp /snap/bin/kustomize ./bin/kustomize
- name: Run Integration test
timeout-minutes: 240
env:
TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
run: |
make int-test
- name: Collect Test Logs
Expand Down
14 changes: 10 additions & 4 deletions .github/workflows/automated-release-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
name: Automated Release Workflow
permissions:
contents: read
packages: write
id-token: write
pull-requests: write
on:
workflow_dispatch:
inputs:
Expand Down Expand Up @@ -37,11 +42,12 @@ jobs:
uses: falti/dotenv-action@d4d12eaa0e1dd06d5bdc3d7af3bf4c8c93cb5359

- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}

- name: Login to Amazon ECR
id: login-ecr-public
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/bias-language-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,8 @@
name: Bias Language
permissions:
contents: read
packages: write
pull-requests: write
on: [push]
jobs:
biased_lang:
Expand Down
Loading
Loading