CSPL-4513 Events for Index & Ingestion separation

.biased_lang_exclude

@@ -19,6 +19,7 @@ config/examples/licensemaster/default.yaml
 config/rbac/licensemaster_editor_role.yaml
 config/rbac/licensemaster_viewer_role.yaml
 config/samples/enterprise_v3_licensemaster.yaml
+config/webhook/manifests.yaml
 tools/make_bundle.sh
 config/samples/kustomization.yaml
 config/manifests/bases/splunk-operator.clusterserviceversion.yaml

.env

@@ -1,6 +1,6 @@
-OPERATOR_SDK_VERSION=v1.39.0
-REVIEWERS=vivekr-splunk,rlieberman-splunk,patrykw-splunk,Igor-splunk,kasiakoziol,kubabuczak
-GO_VERSION=1.25.5
+OPERATOR_SDK_VERSION=v1.42.0
+REVIEWERS=vivekr-splunk,rlieberman-splunk,patrykw-splunk,Igor-splunk,kasiakoziol,kubabuczak,gabrielm-splunk,minjieqiu,qingw-splunk
+GO_VERSION=1.25.7
 AWSCLI_URL=https://awscli.amazonaws.com/awscli-exe-linux-x86_64-2.8.6.zip
 KUBECTL_VERSION=v1.29.1
 AZ_CLI_VERSION=2.79.0

.github/workflows/arm-AL2023-build-test-push-workflow-AL2023.yml

@@ -49,6 +49,7 @@ jobs:
      - name: Run Unit Tests
        run: make test
      - name: Run Code Coverage
+       if: ${{ secrets.COVERALLS_TOKEN != '' }}
        run: goveralls -coverprofile=coverage.out -service=circle-ci -repotoken ${{ secrets.COVERALLS_TOKEN }}
      - name: Upload Coverage artifacts
        uses: actions/upload-artifact@v4.4.0
@@ -121,6 +122,7 @@ jobs:
                 appframeworksS1,
                 managersecret,
                 managermc,
+                indingsep,
                ]
     runs-on: ubuntu-latest
     env:
@@ -146,6 +148,8 @@ jobs:
       DEPLOYMENT_TYPE: ""
       ARM64: "true"
       GRAVITON_TESTING: "true"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Chekcout code
         uses: actions/checkout@v2

.github/workflows/arm-AL2023-int-test-workflow.yml

@@ -68,6 +68,7 @@ jobs:
             managercrcrud,
             licensemanager,
             managerdeletecr,
+            indingsep,
           ]
     runs-on: ubuntu-latest
     needs: build-operator-image-arm-al2023
@@ -93,6 +94,8 @@ jobs:
       DEPLOYMENT_TYPE: ""
       ARM64: "true"
       GRAVITON_TESTING: "true"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-

.github/workflows/arm-RHEL-build-test-push-workflow.yml

@@ -69,6 +69,7 @@ jobs:
             managercrcrud,
             licensemanager,
             managerdeletecr,
+            indingsep,
           ]
     runs-on: ubuntu-latest
     needs: build-operator-image-arm-rhel
@@ -94,6 +95,8 @@ jobs:
       DEPLOYMENT_TYPE: ""
       ARM64: "true"
       GRAVITON_TESTING: "true"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-

.github/workflows/arm-RHEL-int-test-workflow.yml

@@ -68,6 +68,7 @@ jobs:
             managercrcrud,
             licensemanager,
             managerdeletecr,
+            indingsep,
           ]
     runs-on: ubuntu-latest
     needs: build-operator-image-arm-rhel
@@ -93,6 +94,8 @@ jobs:
       DEPLOYMENT_TYPE: ""
       ARM64: "true"
       GRAVITON_TESTING: "true"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-

.github/workflows/arm-Ubuntu-build-test-push-workflow.yml

@@ -49,6 +49,7 @@ jobs:
      - name: Run Unit Tests
        run: make test
      - name: Run Code Coverage
+       if: ${{ secrets.COVERALLS_TOKEN != '' }}
        run: goveralls -coverprofile=coverage.out -service=circle-ci -repotoken ${{ secrets.COVERALLS_TOKEN }}
      - name: Upload Coverage artifacts
        uses: actions/upload-artifact@v4.4.0
@@ -121,6 +122,7 @@ jobs:
                 appframeworksS1,
                 managersecret,
                 managermc,
+                indingsep,
               ]
     runs-on: ubuntu-latest
     env:
@@ -146,6 +148,8 @@ jobs:
       DEPLOYMENT_TYPE: ""
       ARM64: "true"
       GRAVITON_TESTING: "true"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Chekcout code
         uses: actions/checkout@v2

.github/workflows/arm-Ubuntu-int-test-workflow.yml

@@ -68,6 +68,7 @@ jobs:
             managercrcrud,
             licensemanager,
             managerdeletecr,
+            indingsep,
           ]
     runs-on: ubuntu-latest
     needs: build-operator-image-arm-ubuntu
@@ -93,6 +94,8 @@ jobs:
       DEPLOYMENT_TYPE: ""
       ARM64: "true"
       GRAVITON_TESTING: "true"
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-

.github/workflows/build-test-push-workflow.yml

@@ -5,11 +5,17 @@ permissions:
   id-token: write
   pull-requests: write
 on:
-  pull_request: {}
+  pull_request:
+    paths-ignore:
+    - 'docs/**'
+    - '*.md'
   push:
     branches:
     - main
     - develop
+    paths-ignore:
+    - 'docs/**'
+    - '*.md'
 jobs:
   check-formating:
     runs-on: ubuntu-latest
@@ -23,12 +29,17 @@ jobs:
       with:
         go-version: ${{ steps.dotenv.outputs.GO_VERSION }}
     - name: Check Source formatting
-      run: make fmt && if [[ $? -ne 0 ]]; then false; fi
+      run: |
+        UNFORMATTED=$(gofmt -l .)
+        if [ -n "$UNFORMATTED" ]; then
+          echo "These files are not formatted:"
+          echo "$UNFORMATTED"
+          exit 1
+        fi
     - name: Lint source code
       run: make vet && if [[ $? -ne 0 ]]; then false; fi
   unit-tests:
     runs-on: ubuntu-latest
-    needs: check-formating
     steps:
       - uses: actions/checkout@v2
       - name: Dotenv Action
@@ -50,15 +61,16 @@ jobs:
         run: |
           make test
       - name: Run Code Coverage
-        run: goveralls -coverprofile=coverage.out -service=circle-ci -repotoken ${{ secrets.COVERALLS_TOKEN }}
+        if: ${{ secrets.COVERALLS_TOKEN != '' }}
+        run: goveralls -shallow -coverprofile=coverage.out -service=circle-ci -repotoken ${{ secrets.COVERALLS_TOKEN }}
       - name: Upload Coverage artifacts
         uses: actions/upload-artifact@v4.4.0
         with:
           name: coverage.out
           path: coverage.out
   build-operator-image:
     runs-on: ubuntu-latest
-    needs: unit-tests
+    needs: [check-formating, unit-tests]
     env:
       SPLUNK_ENTERPRISE_IMAGE: ${{ secrets.SPLUNK_ENTERPRISE_IMAGE }}
       SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator
@@ -174,6 +186,7 @@ jobs:
                 managerappframeworkm4,
                 managersecret,
                 managermc,
+                indingsep,
                ]
     runs-on: ubuntu-latest
     env:
@@ -197,6 +210,8 @@ jobs:
       EKS_SSH_PUBLIC_KEY: ${{ secrets.EKS_SSH_PUBLIC_KEY }}
       CLUSTER_WIDE: "true"
       DEPLOYMENT_TYPE: ""
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Chekcout code
         uses: actions/checkout@v2

.github/workflows/cla-check.yml

@@ -22,29 +22,33 @@ jobs:
           PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
         with:
           path-to-signatures: "signatures/version1/cla.json"
-          path-to-document: "https://github.com/splunk/cla-agreement/blob/main/CLA.md" # e.g. a CLA or a DCO document
+          path-to-document: "https://github.com/splunk/cla-agreement/blob/main/CLA.md"
           branch: "main"
           allowlist: dependabot[bot]
           remote-organization-name: splunk
           remote-repository-name: cla-agreement
+          custom-notsigned-prcomment: "<br/>Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our [Contribution License Agreement](${input.getPathToDocument()}) before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment with the exact sentence copied from below.<br/>"
+          custom-allsigned-prcomment: "⏳ **CLA signed** — now checking Code of Conduct status..."
   CodeOfConduct:
     runs-on: ubuntu-latest
+    # CLA and COC jobs both edit the same PR comment to show signing status.
+    # Run sequentially to avoid race conditions when updating the comment.
+    needs: ContributorLicenseAgreement
     steps:
       - name: "COC Assistant"
-        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the Code of Conduct and I hereby accept the Terms') || github.event_name == 'pull_request_target'
+        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the Code of Conduct and I hereby sign the COC') || github.event_name == 'pull_request_target'
         uses: cla-assistant/github-action@v2.1.3-beta
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
         with:
           path-to-signatures: "signatures/version1/coc.json"
-          path-to-document: "https://github.com/splunk/cla-agreement/blob/main/CODE_OF_CONDUCT.md" # e.g. a COC or a DCO document
+          path-to-document: "https://github.com/splunk/cla-agreement/blob/main/CODE_OF_CONDUCT.md"
           branch: "main"
           allowlist: dependabot[bot]
           remote-organization-name: splunk
           remote-repository-name: cla-agreement
-          custom-pr-sign-comment: "I have read the Code of Conduct and I hereby accept the Terms"
-          create-file-commit-message: "For example: Creating file for storing COC Signatures"
+          custom-pr-sign-comment: "I have read the Code of Conduct and I hereby sign the COC"
           signed-commit-message: "$contributorName has signed the COC in #$pullRequestNo"
-          custom-notsigned-prcomment: "All contributors have NOT signed the COC Document"
-          custom-allsigned-prcomment: "****CLA Assistant Lite bot**** All contributors have signed the COC  ✍️ ✅"
+          custom-notsigned-prcomment: "<br/>🎉 **CLA signed — one more step to go!**<br/><br/>Please also accept our [Code of Conduct](${input.getPathToDocument()}) by posting a comment with the exact sentence copied from below. This helps us maintain a welcoming community.<br/>"
+          custom-allsigned-prcomment: "All contributors have signed required documents ✍️ ✅"

.github/workflows/distroless-build-test-push-workflow.yml

@@ -5,11 +5,17 @@ permissions:
   id-token: write
   pull-requests: write
 on:
-  pull_request: {}
+  pull_request:
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
   push:
     branches:
-    - main
-    - develop
+      - main
+      - develop
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
 jobs:
   check-formating:
     runs-on: ubuntu-latest
@@ -49,7 +55,8 @@ jobs:
       - name: Run Unit Tests
         run: make test
       - name: Run Code Coverage
-        run: goveralls -coverprofile=coverage.out -service=circle-ci -repotoken ${{ secrets.COVERALLS_TOKEN }}
+        if: ${{ secrets.COVERALLS_TOKEN != '' }}
+        run: goveralls -shallow -coverprofile=coverage.out -service=circle-ci -repotoken ${{ secrets.COVERALLS_TOKEN }}
       - name: Upload Coverage artifacts
         uses: actions/upload-artifact@v4.4.0
         with:
@@ -174,6 +181,7 @@ jobs:
           managerappframeworkm4,
           managersecret,
           managermc,
+          indingsep,
         ]
     runs-on: ubuntu-latest
     env:
@@ -197,6 +205,8 @@ jobs:
       EKS_SSH_PUBLIC_KEY: ${{ secrets.EKS_SSH_PUBLIC_KEY }}
       CLUSTER_WIDE: "true"
       DEPLOYMENT_TYPE: ""
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Chekcout code
         uses: actions/checkout@v2

.github/workflows/distroless-int-test-workflow.yml

@@ -9,6 +9,9 @@ on:
     branches:
       - develop
       - main
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
 jobs:
   build-operator-image-distroless:
     runs-on: ubuntu-latest
@@ -69,6 +72,7 @@ jobs:
             managercrcrud,
             licensemanager,
             managerdeletecr,
+            indingsep,
           ]
     runs-on: ubuntu-latest
     needs: build-operator-image-distroless
@@ -92,6 +96,8 @@ jobs:
       S3_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
       CLUSTER_WIDE: "true"
       DEPLOYMENT_TYPE: ""
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - name: Set Test Cluster Nodes and Parallel Runs
         run: >-

.github/workflows/helm-test-workflow.yml

@@ -10,6 +10,9 @@ on:
       - develop
       - main
       - feature**
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
   workflow_dispatch:
 jobs:
   build-operator-image:
@@ -72,6 +75,8 @@ jobs:
       HELM_REPO_PATH: "../../../../helm-chart"
       INSTALL_OPERATOR: "true"
       TEST_VPC_ENDPOINT_URL: ${{ secrets.TEST_VPC_ENDPOINT_URL }}
+      AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID: ${{ secrets.AWS_INDEX_INGEST_SEP_ACCESS_KEY_ID }}
+      AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY: ${{ secrets.AWS_INDEX_INGEST_SEP_SECRET_ACCESS_KEY }}
     steps:
       - uses: chrisdickinson/setup-yq@3d931309f27270ebbafd53f2daee773a82ea1822
       - name: Checking YQ installation
@@ -113,8 +118,8 @@ jobs:
           version: ${{ steps.dotenv.outputs.KUBECTL_VERSION }}
       - name: Install kuttl
         run: |
-          sudo curl -LO https://github.com/kudobuilder/kuttl/releases/download/v0.12.0/kuttl_0.12.0_linux_x86_64.tar.gz
-          sudo tar -xvzf kuttl_0.12.0_linux_x86_64.tar.gz
+          sudo curl -LO https://github.com/kudobuilder/kuttl/releases/download/v0.22.0/kuttl_0.22.0_linux_x86_64.tar.gz
+          sudo tar -xvzf kuttl_0.22.0_linux_x86_64.tar.gz
           sudo chmod +x  kubectl-kuttl
           sudo mv kubectl-kuttl /usr/local/bin/kubectl-kuttl
       - name: Install Python

.github/workflows/int-test-azure-workflow.yml

@@ -8,6 +8,9 @@ on:
     branches:
       - develop
       - main
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
 jobs:
   build-operator-image:
     runs-on: ubuntu-latest