CSPL-4360 Fixing failing tests due to incorrect secret ref

kasiakoziol · kasiakoziol · commit 47d1a354b402 · 2026-01-09T16:37:55.000+01:00
diff --git a/.github/workflows/arm-AL2023-build-test-push-workflow-AL2023.yml b/.github/workflows/arm-AL2023-build-test-push-workflow-AL2023.yml
@@ -146,6 +146,8 @@ jobs:
       DEPLOYMENT_TYPE: ""
       ARM64: "true"
       GRAVITON_TESTING: "true"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Chekcout code
         uses: actions/checkout@v2
diff --git a/.github/workflows/arm-AL2023-int-test-workflow.yml b/.github/workflows/arm-AL2023-int-test-workflow.yml
@@ -94,6 +94,8 @@ jobs:
       DEPLOYMENT_TYPE: ""
       ARM64: "true"
       GRAVITON_TESTING: "true"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-
diff --git a/.github/workflows/arm-RHEL-build-test-push-workflow.yml b/.github/workflows/arm-RHEL-build-test-push-workflow.yml
@@ -94,6 +94,8 @@ jobs:
       DEPLOYMENT_TYPE: ""
       ARM64: "true"
       GRAVITON_TESTING: "true"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-
diff --git a/.github/workflows/arm-RHEL-int-test-workflow.yml b/.github/workflows/arm-RHEL-int-test-workflow.yml
@@ -94,6 +94,8 @@ jobs:
       DEPLOYMENT_TYPE: ""
       ARM64: "true"
       GRAVITON_TESTING: "true"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-
diff --git a/.github/workflows/arm-Ubuntu-build-test-push-workflow.yml b/.github/workflows/arm-Ubuntu-build-test-push-workflow.yml
@@ -146,6 +146,8 @@ jobs:
       DEPLOYMENT_TYPE: ""
       ARM64: "true"
       GRAVITON_TESTING: "true"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Chekcout code
         uses: actions/checkout@v2
diff --git a/.github/workflows/arm-Ubuntu-int-test-workflow.yml b/.github/workflows/arm-Ubuntu-int-test-workflow.yml
@@ -94,6 +94,8 @@ jobs:
       DEPLOYMENT_TYPE: ""
       ARM64: "true"
       GRAVITON_TESTING: "true"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-
diff --git a/.github/workflows/build-test-push-workflow.yml b/.github/workflows/build-test-push-workflow.yml
@@ -190,6 +190,8 @@ jobs:
       EKS_SSH_PUBLIC_KEY: ${{ secrets.EKS_SSH_PUBLIC_KEY }}
       CLUSTER_WIDE: "true"
       DEPLOYMENT_TYPE: ""
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Chekcout code
         uses: actions/checkout@v2
diff --git a/.github/workflows/distroless-build-test-push-workflow.yml b/.github/workflows/distroless-build-test-push-workflow.yml
@@ -191,6 +191,8 @@ jobs:
       EKS_SSH_PUBLIC_KEY: ${{ secrets.EKS_SSH_PUBLIC_KEY }}
       CLUSTER_WIDE: "true"
       DEPLOYMENT_TYPE: ""
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Chekcout code
         uses: actions/checkout@v2
diff --git a/.github/workflows/distroless-int-test-workflow.yml b/.github/workflows/distroless-int-test-workflow.yml
@@ -88,6 +88,8 @@ jobs:
       S3_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
       CLUSTER_WIDE: "true"
       DEPLOYMENT_TYPE: ""
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-
diff --git a/.github/workflows/helm-test-workflow.yml b/.github/workflows/helm-test-workflow.yml
@@ -65,6 +65,8 @@ jobs:
       HELM_REPO_PATH: "../../../../helm-chart"
       INSTALL_OPERATOR: "true"
       TEST_VPC_ENDPOINT_URL: ${{ secrets.TEST_VPC_ENDPOINT_URL }}
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - uses: chrisdickinson/setup-yq@3d931309f27270ebbafd53f2daee773a82ea1822
       - name: Checking YQ installation
diff --git a/.github/workflows/int-test-workflow.yml b/.github/workflows/int-test-workflow.yml
@@ -84,6 +84,8 @@ jobs:
       S3_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
       CLUSTER_WIDE: "true"
       DEPLOYMENT_TYPE: ""
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-
diff --git a/.github/workflows/manual-int-test-workflow.yml b/.github/workflows/manual-int-test-workflow.yml
@@ -45,6 +45,8 @@ jobs:
       PRIVATE_REGISTRY: ${{ secrets.ECR_REPOSITORY }}
       S3_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
       CLUSTER_WIDE: ${{ github.event.inputs.CLUSTER_WIDE }}
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-
diff --git a/.github/workflows/namespace-scope-int-workflow.yml b/.github/workflows/namespace-scope-int-workflow.yml
@@ -40,6 +40,8 @@ jobs:
       PRIVATE_REGISTRY: ${{ secrets.ECR_REPOSITORY }}
       S3_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
       CLUSTER_WIDE: "false"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-
diff --git a/.github/workflows/nightly-int-test-workflow.yml b/.github/workflows/nightly-int-test-workflow.yml
@@ -81,6 +81,8 @@ jobs:
       PRIVATE_REGISTRY: ${{ secrets.ECR_REPOSITORY }}
       S3_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
       CLUSTER_WIDE: "true"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-
diff --git a/kuttl/tests/helm/index-and-ingest-separation/01-assert.yaml b/kuttl/tests/helm/index-and-ingest-separation/01-assert.yaml
@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: s3-secret
+  name: index-ing-sep-secret
diff --git a/kuttl/tests/helm/index-and-ingest-separation/01-create-s3-secret.yaml b/kuttl/tests/helm/index-and-ingest-separation/01-create-s3-secret.yaml
@@ -2,6 +2,6 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestStep
 commands:
-  - script: kubectl create secret generic s3-secret --from-literal=s3_access_key=$AWS_ACCESS_KEY_ID --from-literal=s3_secret_key=$AWS_SECRET_ACCESS_KEY --namespace $NAMESPACE
+  - script: kubectl create secret generic index-ing-sep-secret --from-literal=s3_access_key=$AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID --from-literal=s3_secret_key=$AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY --namespace $NAMESPACE
     background: false
     skipLogOutput: true
diff --git a/kuttl/tests/helm/index-and-ingest-separation/splunk_index_ingest_sep.yaml b/kuttl/tests/helm/index-and-ingest-separation/splunk_index_ingest_sep.yaml
@@ -16,7 +16,7 @@ queue:
     dlq: index-ingest-separation-test-dlq
     volumes:
       - name: helm-bus-secret-ref-test
-        secretRef: s3-secret
+        secretRef: index-ing-sep-secret
 
 objectStorage:
   enabled: true
diff --git a/test/index_and_ingestion_separation/index_and_ingestion_separation_test.go b/test/index_and_ingestion_separation/index_and_ingestion_separation_test.go
@@ -81,7 +81,7 @@ var _ = Describe("indingsep test", func() {
 			// testcaseEnvInst.CreateServiceAccount(serviceAccountName)
 
 			// Secret reference
-			volumeSpec := []enterpriseApi.VolumeSpec{testenv.GenerateQueueVolumeSpec("queue-secret-ref-volume", testcaseEnvInst.GetIndexSecretName())}
+			volumeSpec := []enterpriseApi.VolumeSpec{testenv.GenerateQueueVolumeSpec("queue-secret-ref-volume", testcaseEnvInst.GetIndexIngestSepSecretName())}
 			queue.SQS.VolList = volumeSpec
 			updateQueue.SQS.VolList = volumeSpec
 
@@ -160,7 +160,7 @@ var _ = Describe("indingsep test", func() {
 			// testcaseEnvInst.CreateServiceAccount(serviceAccountName)
 
 			// Secret reference
-			volumeSpec := []enterpriseApi.VolumeSpec{testenv.GenerateQueueVolumeSpec("queue-secret-ref-volume", testcaseEnvInst.GetIndexSecretName())}
+			volumeSpec := []enterpriseApi.VolumeSpec{testenv.GenerateQueueVolumeSpec("queue-secret-ref-volume", testcaseEnvInst.GetIndexIngestSepSecretName())}
 			queue.SQS.VolList = volumeSpec
 			updateQueue.SQS.VolList = volumeSpec
 
@@ -271,7 +271,7 @@ var _ = Describe("indingsep test", func() {
 			// testcaseEnvInst.CreateServiceAccount(serviceAccountName)
 
 			// Secret reference
-			volumeSpec := []enterpriseApi.VolumeSpec{testenv.GenerateQueueVolumeSpec("queue-secret-ref-volume", testcaseEnvInst.GetIndexSecretName())}
+			volumeSpec := []enterpriseApi.VolumeSpec{testenv.GenerateQueueVolumeSpec("queue-secret-ref-volume", testcaseEnvInst.GetIndexIngestSepSecretName())}
 			queue.SQS.VolList = volumeSpec
 
 			// Deploy Queue
@@ -383,7 +383,7 @@ var _ = Describe("indingsep test", func() {
 			// testcaseEnvInst.CreateServiceAccount(serviceAccountName)
 
 			// Secret reference
-			volumeSpec := []enterpriseApi.VolumeSpec{testenv.GenerateQueueVolumeSpec("queue-secret-ref-volume", testcaseEnvInst.GetIndexSecretName())}
+			volumeSpec := []enterpriseApi.VolumeSpec{testenv.GenerateQueueVolumeSpec("queue-secret-ref-volume", testcaseEnvInst.GetIndexIngestSepSecretName())}
 			queue.SQS.VolList = volumeSpec
 			updateQueue.SQS.VolList = volumeSpec
 
diff --git a/test/testenv/testcaseenv.go b/test/testenv/testcaseenv.go
@@ -35,24 +35,25 @@ import (
 
 // TestCaseEnv represents a namespaced-isolated k8s cluster environment (aka virtual k8s cluster) to run test cases against
 type TestCaseEnv struct {
-	kubeClient          client.Client
-	name                string
-	namespace           string
-	serviceAccountName  string
-	roleName            string
-	roleBindingName     string
-	operatorName        string
-	operatorImage       string
-	splunkImage         string
-	initialized         bool
-	SkipTeardown        bool
-	licenseFilePath     string
-	licenseCMName       string
-	s3IndexSecret       string
-	Log                 logr.Logger
-	cleanupFuncs        []cleanupFunc
-	debug               string
-	clusterWideOperator string
+	kubeClient           client.Client
+	name                 string
+	namespace            string
+	serviceAccountName   string
+	roleName             string
+	roleBindingName      string
+	operatorName         string
+	operatorImage        string
+	splunkImage          string
+	initialized          bool
+	SkipTeardown         bool
+	licenseFilePath      string
+	licenseCMName        string
+	s3IndexSecret        string
+	indexIngestSepSecret string
+	Log                  logr.Logger
+	cleanupFuncs         []cleanupFunc
+	debug                string
+	clusterWideOperator  string
 }
 
 // GetKubeClient returns the kube client to talk to kube-apiserver
@@ -79,21 +80,22 @@ func NewTestCaseEnv(kubeClient client.Client, name string, operatorImage string,
 	}
 
 	testenv := &TestCaseEnv{
-		kubeClient:          kubeClient,
-		name:                name,
-		namespace:           name,
-		serviceAccountName:  name,
-		roleName:            name,
-		roleBindingName:     name,
-		operatorName:        "splunk-op-" + name,
-		operatorImage:       operatorImage,
-		splunkImage:         splunkImage,
-		SkipTeardown:        specifiedSkipTeardown,
-		licenseCMName:       name,
-		licenseFilePath:     licenseFilePath,
-		s3IndexSecret:       "splunk-s3-index-" + name,
-		debug:               os.Getenv("DEBUG"),
-		clusterWideOperator: installOperatorClusterWide,
+		kubeClient:           kubeClient,
+		name:                 name,
+		namespace:            name,
+		serviceAccountName:   name,
+		roleName:             name,
+		roleBindingName:      name,
+		operatorName:         "splunk-op-" + name,
+		operatorImage:        operatorImage,
+		splunkImage:          splunkImage,
+		SkipTeardown:         specifiedSkipTeardown,
+		licenseCMName:        name,
+		licenseFilePath:      licenseFilePath,
+		s3IndexSecret:        "splunk-s3-index-" + name,
+		indexIngestSepSecret: "splunk--index-ingest-sep-" + name,
+		debug:                os.Getenv("DEBUG"),
+		clusterWideOperator:  installOperatorClusterWide,
 	}
 
 	testenv.Log = logf.Log.WithValues("testcaseenv", testenv.name)
@@ -156,6 +158,7 @@ func (testenv *TestCaseEnv) setup() error {
 	switch ClusterProvider {
 	case "eks":
 		testenv.createIndexSecret()
+		testenv.createIndexIngestSepSecret()
 	case "azure":
 		testenv.createIndexSecretAzure()
 	case "gcp":
@@ -588,11 +591,41 @@ func (testenv *TestCaseEnv) createIndexSecretAzure() error {
 	return nil
 }
 
+// CreateIndexIngestSepSecret creates secret object
+func (testenv *TestCaseEnv) createIndexIngestSepSecret() error {
+	secretName := testenv.indexIngestSepSecret
+	ns := testenv.namespace
+
+	data := map[string][]byte{"s3_access_key": []byte(os.Getenv("AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID")),
+		"s3_secret_key": []byte(os.Getenv("AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY"))}
+	secret := newSecretSpec(ns, secretName, data)
+
+	if err := testenv.GetKubeClient().Create(context.TODO(), secret); err != nil {
+		testenv.Log.Error(err, "Unable to create index and ingestion sep secret object")
+		return err
+	}
+
+	testenv.pushCleanupFunc(func() error {
+		err := testenv.GetKubeClient().Delete(context.TODO(), secret)
+		if err != nil {
+			testenv.Log.Error(err, "Unable to delete index and ingestion sep secret object")
+			return err
+		}
+		return nil
+	})
+	return nil
+}
+
 // GetIndexSecretName return index secret object name
 func (testenv *TestCaseEnv) GetIndexSecretName() string {
 	return testenv.s3IndexSecret
 }
 
+// GetIndexSecretName return index and ingestion separation secret object name
+func (testenv *TestCaseEnv) GetIndexIngestSepSecretName() string {
+	return testenv.indexIngestSepSecret
+}
+
 // GetLMConfigMap Return name of license config map
 func (testenv *TestCaseEnv) GetLMConfigMap() string {
 	return testenv.licenseCMName
diff --git a/test/testenv/testenv.go b/test/testenv/testenv.go
@@ -160,24 +160,25 @@ type cleanupFunc func() error
 
 // TestEnv represents a namespaced-isolated k8s cluster environment (aka virtual k8s cluster) to run tests against
 type TestEnv struct {
-	kubeAPIServer      string
-	name               string
-	namespace          string
-	serviceAccountName string
-	roleName           string
-	roleBindingName    string
-	operatorName       string
-	operatorImage      string
-	splunkImage        string
-	initialized        bool
-	SkipTeardown       bool
-	licenseFilePath    string
-	licenseCMName      string
-	s3IndexSecret      string
-	kubeClient         client.Client
-	Log                logr.Logger
-	cleanupFuncs       []cleanupFunc
-	debug              string
+	kubeAPIServer        string
+	name                 string
+	namespace            string
+	serviceAccountName   string
+	roleName             string
+	roleBindingName      string
+	operatorName         string
+	operatorImage        string
+	splunkImage          string
+	initialized          bool
+	SkipTeardown         bool
+	licenseFilePath      string
+	licenseCMName        string
+	s3IndexSecret        string
+	indexIngestSepSecret string
+	kubeClient           client.Client
+	Log                  logr.Logger
+	cleanupFuncs         []cleanupFunc
+	debug                string
 }
 
 func init() {
@@ -231,19 +232,20 @@ func NewTestEnv(name, commitHash, operatorImage, splunkImage, licenseFilePath st
 	}
 
 	testenv := &TestEnv{
-		name:               envName,
-		namespace:          envName,
-		serviceAccountName: envName,
-		roleName:           envName,
-		roleBindingName:    envName,
-		operatorName:       "splunk-op-" + envName,
-		operatorImage:      operatorImage,
-		splunkImage:        splunkImage,
-		SkipTeardown:       specifiedSkipTeardown,
-		licenseCMName:      envName,
-		licenseFilePath:    licenseFilePath,
-		s3IndexSecret:      "splunk-s3-index-" + envName,
-		debug:              os.Getenv("DEBUG"),
+		name:                 envName,
+		namespace:            envName,
+		serviceAccountName:   envName,
+		roleName:             envName,
+		roleBindingName:      envName,
+		operatorName:         "splunk-op-" + envName,
+		operatorImage:        operatorImage,
+		splunkImage:          splunkImage,
+		SkipTeardown:         specifiedSkipTeardown,
+		licenseCMName:        envName,
+		licenseFilePath:      licenseFilePath,
+		s3IndexSecret:        "splunk-s3-index-" + envName,
+		indexIngestSepSecret: "splunk--index-ingest-sep-" + name,
+		debug:                os.Getenv("DEBUG"),
 	}
 
 	testenv.Log = logf.Log.WithValues("testenv", testenv.name)
