Skip to content

CSPL-4201 use OIDC in GitHub pipelines #1630

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kubabuczak merged 10 commits into from
Dec 8, 2025
Merged

CSPL-4201 use OIDC in GitHub pipelines #1630

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
81a5a89
CSPL-4201 Update GitHub Actions workflows to use OIDC tokens instead …
kubabuczak Nov 17, 2025
480eba4
Update GitHub Actions workflows to include CSPL-4201-pipeline-tests-b…
kubabuczak Nov 17, 2025
d003727
CSPL-4201 Enhance GitHub Actions workflows with role duration and tim…
kubabuczak Nov 19, 2025
836c030
CSPL-4201 Update GitHub Actions workflow to add id-token permission
kubabuczak Nov 19, 2025
594ee3c
CSPL-4201 job timeouts - reduce them on step level and adjust it to o…
kubabuczak Nov 20, 2025
a84be41
Update GitHub Actions workflows to use environment variables for S3 c…
kubabuczak Nov 26, 2025
d472b2b
Update skipLogOutput setting in S3 bucket creation scripts for helm t…
kubabuczak Nov 27, 2025
7249a86
Fix: pipelines not passing on not-supported Ubuntu version.
kubabuczak Nov 28, 2025
bf1129a
Remove CSPL-4201-pipeline-tests-base branch from multiple GitHub Acti…
kubabuczak Nov 28, 2025
85bb593
Fix misspelled timeout minutes, remove trailing whhitespaces
kubabuczak Dec 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 14 additions & 8 deletions .github/workflows/arm-AL2023-build-test-push-workflow-AL2023.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,11 +89,12 @@ jobs:
sudo chmod +x operator-sdk_${OS}_${ARCH}
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand Down Expand Up @@ -211,11 +212,12 @@ jobs:
run: |
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand All @@ -240,6 +242,10 @@ jobs:
cp /snap/bin/kustomize ./bin/kustomize
- name: Run smoke test
id: smoketest
timeout-minutes: 240
env:
TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
run: |
make int-test
- name: Collect Test Logs
Expand Down
23 changes: 14 additions & 9 deletions .github/workflows/arm-AL2023-int-test-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ on:
jobs:
build-operator-image-arm-al2023:
runs-on: ubuntu-latest
timeout-minutes: 360
env:
SPLUNK_ENTERPRISE_IMAGE: ${{ secrets.ECR_PREFIX }}/${{ github.event.inputs.splunk_image_repository_tag }}
SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator
Expand All @@ -39,11 +38,12 @@ jobs:
sudo chmod +x operator-sdk_${OS}_${ARCH}
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand Down Expand Up @@ -161,11 +161,12 @@ jobs:
run: |
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand All @@ -189,6 +190,10 @@ jobs:
mkdir -p ./bin
cp /snap/bin/kustomize ./bin/kustomize
- name: Run Integration test
timeout-minutes: 240
env:
TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
run: |
make int-test
- name: Collect Test Logs
Expand Down
24 changes: 15 additions & 9 deletions .github/workflows/arm-RHEL-build-test-push-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ on:
jobs:
build-operator-image-arm-rhel:
runs-on: ubuntu-latest
timeout-minutes: 360
env:
SPLUNK_ENTERPRISE_IMAGE: ${{ secrets.ECR_PREFIX }}/${{ github.event.inputs.splunk_image_repository_tag }}
SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator
Expand All @@ -39,11 +38,12 @@ jobs:
sudo chmod +x operator-sdk_${OS}_${ARCH}
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand All @@ -55,6 +55,7 @@ jobs:
export IMG=${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA
make docker-buildx PLATFORMS=$PLATFORMS BASE_IMAGE=$BASE_IMAGE BASE_IMAGE_VERSION=$BASE_IMAGE_VERSION IMG=$IMG
smoke-tests-arm-rhel:
timeout-minutes: 240
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -161,11 +162,12 @@ jobs:
run: |
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand All @@ -189,6 +191,10 @@ jobs:
mkdir -p ./bin
cp /snap/bin/kustomize ./bin/kustomize
- name: Run smoke test
timeout-minutes: 240
env:
TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
run: |
make int-test
- name: Collect Test Logs
Expand Down
23 changes: 14 additions & 9 deletions .github/workflows/arm-RHEL-int-test-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ on:
jobs:
build-operator-image-arm-rhel:
runs-on: ubuntu-latest
timeout-minutes: 360
env:
SPLUNK_ENTERPRISE_IMAGE: ${{ secrets.ECR_PREFIX }}/${{ github.event.inputs.splunk_image_repository_tag }}
SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator
Expand All @@ -39,11 +38,12 @@ jobs:
sudo chmod +x operator-sdk_${OS}_${ARCH}
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand Down Expand Up @@ -161,11 +161,12 @@ jobs:
run: |
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand All @@ -189,6 +190,10 @@ jobs:
mkdir -p ./bin
cp /snap/bin/kustomize ./bin/kustomize
- name: Run Integration test
timeout-minutes: 240
env:
TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
run: |
make int-test
- name: Collect Test Logs
Expand Down
26 changes: 16 additions & 10 deletions .github/workflows/arm-Ubuntu-build-test-push-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,21 +89,22 @@ jobs:
sudo chmod +x operator-sdk_${OS}_${ARCH}
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
- name: Build and push Splunk Operator Image
run: |
export PLATFORMS=linux/arm64,linux/amd64
export BASE_IMAGE=ubuntu
export BASE_IMAGE_VERSION=24.10
export BASE_IMAGE_VERSION=24.04
Copy link
Collaborator

@kasiakoziol kasiakoziol Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do you decrease it?

Copy link
Collaborator Author

@kubabuczak kubabuczak Dec 4, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

24.04 is LTS (Long Term Support) release. The next LTS will be 26.04.
24.10 is not supported anymore (non-LTS are supported for 9 months)
more info: https://ubuntu.com/about/release-cycle

export IMG=${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA
make docker-buildx PLATFORMS=$PLATFORMS BASE_IMAGE=$BASE_IMAGE BASE_IMAGE_VERSION=$BASE_IMAGE_VERSION IMG=$IMG
make docker-buildx PLATFORMS=$PLATFORMS BASE_IMAGE=$BASE_IMAGE BASE_IMAGE_VERSION=$BASE_IMAGE_VERSION IMG=$IMG
- name: Sign Splunk Operator image with a key
run: |
cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:${{ github.sha }}
Expand Down Expand Up @@ -211,11 +212,12 @@ jobs:
run: |
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand All @@ -240,6 +242,10 @@ jobs:
cp /snap/bin/kustomize ./bin/kustomize
- name: Run smoke test
id: smoketest
timeout-minutes: 240
env:
TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
run: |
make int-test
- name: Collect Test Logs
Expand Down
25 changes: 15 additions & 10 deletions .github/workflows/arm-Ubuntu-int-test-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ on:
jobs:
build-operator-image-arm-ubuntu:
runs-on: ubuntu-latest
timeout-minutes: 360
env:
SPLUNK_ENTERPRISE_IMAGE: ${{ secrets.ECR_PREFIX }}/${{ github.event.inputs.splunk_image_repository_tag }}
SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator
Expand All @@ -39,19 +38,20 @@ jobs:
sudo chmod +x operator-sdk_${OS}_${ARCH}
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
- name: Build and push Splunk Operator Image
run: |
export PLATFORMS=linux/arm64,linux/amd64
export BASE_IMAGE=ubuntu
export BASE_IMAGE_VERSION=24.10
export BASE_IMAGE_VERSION=24.04
export IMG=${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA
make docker-buildx PLATFORMS=$PLATFORMS BASE_IMAGE=$BASE_IMAGE BASE_IMAGE_VERSION=$BASE_IMAGE_VERSION IMG=$IMG
int-tests-arm-ubuntu:
Expand Down Expand Up @@ -161,11 +161,12 @@ jobs:
run: |
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
Expand All @@ -189,6 +190,10 @@ jobs:
mkdir -p ./bin
cp /snap/bin/kustomize ./bin/kustomize
- name: Run Integration test
timeout-minutes: 240
env:
TEST_S3_ACCESS_KEY_ID: ${{ vars.TEST_S3_ACCESS_KEY_ID }}
TEST_S3_SECRET_ACCESS_KEY: ${{ secrets.TEST_S3_SECRET_ACCESS_KEY }}
run: |
make int-test
- name: Collect Test Logs
Expand Down
14 changes: 10 additions & 4 deletions .github/workflows/automated-release-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
name: Automated Release Workflow
permissions:
contents: read
packages: write
id-token: write
pull-requests: write
on:
workflow_dispatch:
inputs:
Expand Down Expand Up @@ -37,11 +42,12 @@ jobs:
uses: falti/dotenv-action@d4d12eaa0e1dd06d5bdc3d7af3bf4c8c93cb5359

- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4
uses: aws-actions/configure-aws-credentials@v5
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
role-session-name: github-${{ github.run_id }}
aws-region: ${{ vars.AWS_REGION }}
role-duration-seconds: ${{ vars.AWS_ROLE_DURATION_SECONDS }}

- name: Login to Amazon ECR
id: login-ecr-public
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/bias-language-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,8 @@
name: Bias Language
permissions:
contents: read
packages: write
pull-requests: write
on: [push]
jobs:
biased_lang:
Expand Down
Loading
Loading