fix(cluster_setup): stop reverting artifacts.yaml on repeat installs,… - #134

… runbook

- Step 2: verify port 8089 reachability from k0s cluster nodes, not laptop
- Step 3 Option B: fix saia_sok_url stanza to [saia_sok_configurations]
- Step 4: replace incorrect AIPlatform CR patch with direct ConfigMap edit;
  explain that splunkConfiguration.endpoint is the HEC endpoint (not the
  JWT issuer), and that the operator only fills missing ConfigMap keys so
  a direct SPLUNK_ISSUERS edit is safe and persistent

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…unk runbook

- fix(P3): broken Step 3 table anchor pointed at old Traefik heading;
  update to match actual Option B heading (TLS Termination via LB/Ingress)
- fix(P3): curl HTTPS check after disabling Splunk Web SSL expected
  "connection refused" but port 8000 stays open speaking HTTP — a TLS
  client gets a handshake/protocol error, not ECONNREFUSED; updated
  expected output to match TLS negotiation failure
- fix(P3): restart-as-owner instructions only covered the case where the
  SSH user IS the owner; added sudo -H -u <owner> form for the common
  case where admins log in as ec2-user but Splunk runs as 'splunk'
- fix(P2): Cleanup section still referenced an AIPlatform CR patch that
  was already corrected in Step 4; replaced with direct ConfigMap patch
  for the both-issuers case; also replaced stale AIService endpoint
  check with a direct SPLUNK_ISSUERS ConfigMap verification

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…nk runbook

- fix(P2): architecture diagram showed Browser→Splunk→SAIA implying Splunk
  proxies API calls; browser calls SAIA directly with the JWT token Splunk
  issued. Diagram and note now show the correct two-path flow: browser→Splunk
  for auth, browser→SAIA for all AI Assistant API calls. Firewall note added
  (SAIA must be reachable from browser network, not just from Splunk host)
- fix(P3): overview said allowlist is controlled via AIPlatform CR→AIService;
  the reconciler seeds SPLUNK_ISSUERS directly in the ConfigMap. Replaced
  the stale propagation chain with "ConfigMap <name>-saia-config" reference
  matching Step 4
- fix(P1): Step 4 patch examples used <PUBLIC_IP> — SPLUNK_ISSUERS must be
  the exact issuer_uri value (IP or FQDN) from authentication.conf; a
  mismatch causes persistent 401/issuer-not-allowed even after patching.
  Replaced with <EXACT_ISSUER_URI> and added an explanatory note

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…doc-v2

docs(cluster_setup): add external Splunk integration runbook

…o to v0.52.0

Addresses VULN-96668 (golang.org/x/net) and VULN-96647 (golang.org/x/crypto).
Also pulls in transitive upgrades: sys v0.45.0, term v0.43.0, text v0.37.0, tools v0.44.0.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… warn on mutable image tags

configure_images() snapshotted artifacts.yaml/splunk-operator-cluster.yaml
to a .original file on first run and restored from it on every subsequent
run before re-injecting image values. Since .original was never refreshed,
any legitimate change to those manifests (new operator release, new env
var, new sidecar) was silently reverted on every re-install after the
first. Drop the snapshot/restore step; the sed substitutions already only
touch their own named fields, so rewriting in place is idempotent.

Also warn in validate_image_config() when a configured image has no tag
or uses a mutable tag (:latest, :preview, :stable*, :dev, :nightly),
since imagePullPolicy: IfNotPresent means re-running install without a
new distinct tag will not actually upgrade the running image.

Three follow-up issues from PR review on the prior idempotency fix:

- Restore the tools/cluster_setup/*.original .gitignore rule (narrowed
  comment): eks_cluster_with_stack.sh still snapshots/restores .original
  backups, so deleting the rule left those EKS byproducts untracked in
  every checkout even though k0s_cluster_with_stack.sh no longer needs it.

- Parse the tag from the last path segment only in the mutable-tag check,
  not from the whole image string. A registry port (e.g.
  localhost:5000/team/saia-api) was previously read as the tag, so
  untagged images behind a ported registry silently skipped the
  no-tag warning.

- Extend the mutable-tag check to cover images.fluentBit.image and
  images.nginx.image (always patched via RELATED_IMAGE_FLUENT_BIT/
  RELATED_IMAGE_NGINX) and images.splunk.image (patched via
  RELATED_IMAGE_SPLUNK_ENTERPRISE, guarded by SPLUNK_MODE=internal since
  it's only deployed in that mode) — these were patched into the
  manifest but never checked for the same same-tag-rerun hazard.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add two unit-test suites to test_k0s_cluster_with_stack.sh:

- configure_images upgrade idempotency: reproduces the exact regression
  fixed in b07745c — a custom private-registry image containing none of
  "splunk"/"ai"/"operator" must be correctly overwritten on a second
  ("upgrade") run, not left stale.

- validate_image_config mutable-tag warnings: covers the registry-port
  tag-parsing fix and every RELATED_IMAGE_* field configure_images
  patches (operator, ray, weaviate, saia x3, fluentBit, nginx,
  otelCollector, splunk + splunk-operator under internal mode), so any
  future field added to one list without the other gets caught.

Track test_installer_dry_run.sh (previously untracked) and add a new
cluster-setup-tests.yml workflow that runs both bash test suites,
wired into main.yml alongside unit-tests. Neither suite needs a
cluster, kubectl, or network access.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>