Update GitHub Actions workflows to use environment variables for S3 credentials

kubabuczak · kubabuczak · commit 730e606ade6b · 2025-11-26T16:48:45.000+01:00
- Added environment variables TEST_S3_ACCESS_KEY_ID and TEST_S3_SECRET_ACCESS_KEY to multiple workflows for integration and smoke tests, allowing for optional overrides of AWS credentials.
- Updated test scripts to utilize these environment variables when creating S3 secrets, enhancing flexibility and security in credential management.
diff --git a/.github/workflows/arm-AL2023-build-test-push-workflow-AL2023.yml b/.github/workflows/arm-AL2023-build-test-push-workflow-AL2023.yml
@@ -235,6 +235,9 @@ jobs:
       - name: Run smoke test
         id: smoketest
         timeout-minutes: 240
+        env:
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           make int-test
       - name: Collect Test Logs
diff --git a/.github/workflows/arm-AL2023-int-test-workflow.yml b/.github/workflows/arm-AL2023-int-test-workflow.yml
@@ -183,6 +183,9 @@ jobs:
           cp /snap/bin/kustomize ./bin/kustomize
       - name: Run Integration test
         timeout-minutes: 240
+        env:
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           make int-test
       - name: Collect Test Logs
diff --git a/.github/workflows/arm-RHEL-build-test-push-workflow.yml b/.github/workflows/arm-RHEL-build-test-push-workflow.yml
@@ -183,6 +183,9 @@ jobs:
           cp /snap/bin/kustomize ./bin/kustomize
       - name: Run Integration test
         timeout-minutes: 240
+        env:
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           make int-test
       - name: Collect Test Logs
diff --git a/.github/workflows/arm-RHEL-int-test-workflow.yml b/.github/workflows/arm-RHEL-int-test-workflow.yml
@@ -183,6 +183,9 @@ jobs:
           cp /snap/bin/kustomize ./bin/kustomize
       - name: Run Integration test
         timeout-minutes: 240
+        env:
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           make int-test
       - name: Collect Test Logs
diff --git a/.github/workflows/arm-Ubuntu-build-test-push-workflow.yml b/.github/workflows/arm-Ubuntu-build-test-push-workflow.yml
@@ -235,6 +235,9 @@ jobs:
       - name: Run smoke test
         id: smoketest
         timeout-minutes: 240
+        env:
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           make int-test
       - name: Collect Test Logs
diff --git a/.github/workflows/arm-Ubuntu-int-test-workflow.yml b/.github/workflows/arm-Ubuntu-int-test-workflow.yml
@@ -183,6 +183,9 @@ jobs:
           cp /snap/bin/kustomize ./bin/kustomize
       - name: Run Integration test
         timeout-minutes: 240
+        env:
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           make int-test
       - name: Collect Test Logs
diff --git a/.github/workflows/build-test-push-workflow.yml b/.github/workflows/build-test-push-workflow.yml
@@ -290,6 +290,9 @@ jobs:
       - name: Run smoke test
         id: smoketest
         timeout-minutes: 240
+        env:
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           make int-test
       - name: Collect Test Logs
diff --git a/.github/workflows/distroless-build-test-push-workflow.yml b/.github/workflows/distroless-build-test-push-workflow.yml
@@ -289,6 +289,9 @@ jobs:
       - name: Run smoke test
         id: smoketest
         timeout-minutes: 240
+        env:
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           make int-test
       - name: Collect Test Logs
diff --git a/.github/workflows/distroless-int-test-workflow.yml b/.github/workflows/distroless-int-test-workflow.yml
@@ -182,6 +182,9 @@ jobs:
           cp /snap/bin/kustomize ./bin/kustomize
       - name: Run Integration test
         timeout-minutes: 240
+        env:
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           make int-test
       - name: Collect Test Logs
diff --git a/.github/workflows/helm-test-workflow.yml b/.github/workflows/helm-test-workflow.yml
@@ -203,6 +203,8 @@ jobs:
           AWS_S3_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
           TEST_S3_BUCKET: ${{ secrets.TEST_BUCKET }}
           TEST_VPC_ENDPOINT_URL: ${{ secrets.TEST_VPC_ENDPOINT_URL }}
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           kubectl kuttl test --config kuttl/kuttl-test-helm.yaml --report xml
       - name: Publish Results
diff --git a/.github/workflows/int-test-workflow.yml b/.github/workflows/int-test-workflow.yml
@@ -182,6 +182,9 @@ jobs:
           cp /snap/bin/kustomize ./bin/kustomize
       - name: Run Integration test
         timeout-minutes: 240
+        env:
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           make int-test
       - name: Collect Test Logs
diff --git a/.github/workflows/manual-int-test-workflow.yml b/.github/workflows/manual-int-test-workflow.yml
@@ -137,6 +137,9 @@ jobs:
           cp /snap/bin/kustomize ./bin/kustomize
       - name: Run Integration test
         timeout-minutes: 240
+        env:
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           export SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA
           make int-test
diff --git a/.github/workflows/namespace-scope-int-workflow.yml b/.github/workflows/namespace-scope-int-workflow.yml
@@ -134,6 +134,9 @@ jobs:
           cp /snap/bin/kustomize ./bin/kustomize
       - name: Run Integration test
         timeout-minutes: 240
+        env:
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           export SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA
           make int-test
diff --git a/.github/workflows/nightly-int-test-workflow.yml b/.github/workflows/nightly-int-test-workflow.yml
@@ -174,6 +174,9 @@ jobs:
           cp /snap/bin/kustomize ./bin/kustomize
       - name: Run Integration test
         timeout-minutes: 240
+        env:
+          TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
+          TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
         run: |
           export SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA
           make int-test
diff --git a/kuttl/tests/helm/c3-with-apps-private-link/02-create-s3-secret.yaml b/kuttl/tests/helm/c3-with-apps-private-link/02-create-s3-secret.yaml
@@ -3,7 +3,7 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestStep
 commands:
-  - script: kubectl create secret generic s3-secret --from-literal=s3_access_key=$AWS_ACCESS_KEY_ID --from-literal=s3_secret_key=$AWS_SECRET_ACCESS_KEY --namespace $NAMESPACE
+  - script: kubectl create secret generic s3-secret --from-literal=s3_access_key=${TEST_S3_ACCESS_KEY_ID:-$AWS_ACCESS_KEY_ID} --from-literal=s3_secret_key=${TEST_S3_SECRET_ACCESS_KEY:-$AWS_SECRET_ACCESS_KEY} --namespace $NAMESPACE
     background: false
     #namespaced: true
     skipLogOutput: true
diff --git a/kuttl/tests/helm/c3-with-apps/02-create-s3-secret.yaml b/kuttl/tests/helm/c3-with-apps/02-create-s3-secret.yaml
@@ -3,7 +3,7 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestStep
 commands:
-  - script: kubectl create secret generic s3-secret --from-literal=s3_access_key=$AWS_ACCESS_KEY_ID --from-literal=s3_secret_key=$AWS_SECRET_ACCESS_KEY --namespace $NAMESPACE
+  - script: kubectl create secret generic s3-secret --from-literal=s3_access_key=${TEST_S3_ACCESS_KEY_ID:-$AWS_ACCESS_KEY_ID} --from-literal=s3_secret_key=${TEST_S3_SECRET_ACCESS_KEY:-$AWS_SECRET_ACCESS_KEY} --namespace $NAMESPACE
     background: false
     #namespaced: true
     skipLogOutput: true
diff --git a/kuttl/tests/helm/s1-with-smartstore/02-create-s3-secret.yaml b/kuttl/tests/helm/s1-with-smartstore/02-create-s3-secret.yaml
@@ -3,7 +3,7 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestStep
 commands:
-  - script: kubectl create secret generic s3-secret --from-literal=s3_access_key=$AWS_ACCESS_KEY_ID --from-literal=s3_secret_key=$AWS_SECRET_ACCESS_KEY --namespace $NAMESPACE
+  - script: kubectl create secret generic s3-secret --from-literal=s3_access_key=${TEST_S3_ACCESS_KEY_ID:-$AWS_ACCESS_KEY_ID} --from-literal=s3_secret_key=${TEST_S3_SECRET_ACCESS_KEY:-$AWS_SECRET_ACCESS_KEY} --namespace $NAMESPACE
     background: false
     #namespaced: true
     skipLogOutput: true
diff --git a/test/README.md b/test/README.md
@@ -69,8 +69,8 @@ Note: To run a specific test, you can
 Smoke and integration tests will run on Github actions. This tests can be triggered on schedule or after a certain event occur depending of the content of the workflow files.
 To run the tests on different clusters platforms, you will need to define the following project environment variables.
 For AWS:
-AWS_ACCESS_KEY_ID
-AWS_SECRET_ACCESS_KEY
+TEST_S3_ACCESS_KEY_ID (optional, defaults to AWS_ACCESS_KEY_ID if not set)
+TEST_S3_SECRET_ACCESS_KEY (optional, defaults to AWS_SECRET_ACCESS_KEY if not set)
 CLUSTER_PROVIDER=[eks]
 ECR_REGISTRY
 
diff --git a/test/testenv/testcaseenv.go b/test/testenv/testcaseenv.go
@@ -518,8 +518,18 @@ func (testenv *TestCaseEnv) CreateServiceAccount(name string) error {
 func (testenv *TestCaseEnv) createIndexSecret() error {
 	secretName := testenv.s3IndexSecret
 	ns := testenv.namespace
-	data := map[string][]byte{"s3_access_key": []byte(os.Getenv("AWS_ACCESS_KEY_ID")),
-		"s3_secret_key": []byte(os.Getenv("AWS_SECRET_ACCESS_KEY"))}
+
+	accessKey := os.Getenv("TEST_S3_ACCESS_KEY_ID")
+	if accessKey == "" {
+		accessKey = os.Getenv("AWS_ACCESS_KEY_ID")
+	}
+	secretKey := os.Getenv("TEST_S3_SECRET_ACCESS_KEY")
+	if secretKey == "" {
+		secretKey = os.Getenv("AWS_SECRET_ACCESS_KEY")
+	}
+
+	data := map[string][]byte{"s3_access_key": []byte(accessKey),
+		"s3_secret_key": []byte(secretKey)}
 	secret := newSecretSpec(ns, secretName, data)
 	if err := testenv.GetKubeClient().Create(context.TODO(), secret); err != nil {
 		testenv.Log.Error(err, "Unable to create s3 index secret object")
