Bring in sync

.env

@@ -1,19 +1,22 @@
 OPERATOR_SDK_VERSION=v1.31.0
-REVIEWERS=vivekr-splunk,rlieberman-splunk,patrykw-splunk,Igor-splunk,kasiakoziol
-GO_VERSION=1.23.0
+REVIEWERS=vivekr-splunk,rlieberman-splunk,patrykw-splunk,Igor-splunk,kasiakoziol,vavarshn
+GO_VERSION=1.25.0
 AWSCLI_URL=https://awscli.amazonaws.com/awscli-exe-linux-x86_64-2.8.6.zip
 KUBECTL_VERSION=v1.29.1
 AZ_CLI_VERSION=2.30.0
 EKSCTL_VERSION=v0.191.0
 EKS_CLUSTER_K8_VERSION=1.31
 EKS_INSTANCE_TYPE=m5.2xlarge
 EKS_INSTANCE_TYPE_ARM64=c6g.4xlarge
-SPLUNK_ENTERPRISE_RELEASE_IMAGE=splunk/splunk:9.4.1
-RELATED_IMAGE_SPLUNK_ENTERPRISE=splunk/splunk:9.2.3
+SPLUNK_ENTERPRISE_RELEASE_IMAGE=splunk/splunk:10.2.0
+RELATED_IMAGE_SPLUNK_ENTERPRISE=splunk/splunk:10.2.0
 RELATED_IMAGE_RAY_HEAD=667741767953.dkr.ecr.us-west-2.amazonaws.com/ml-platform/ray/ray-head:build-5
 RELATED_IMAGE_RAY_WORKER=667741767953.dkr.ecr.us-west-2.amazonaws.com/ml-platform/ray/ray-worker-gpu:build-6
 RELATED_IMAGE_WEAVIATE=semitechnologies/weaviate:stable-v1.28-007846a
 RELATED_IMAGE_POST_INSTALL_HOOK=667741767953.dkr.ecr.us-west-2.amazonaws.com/vivek/ml-platform/saia/ai-helm-post-hook:0.0.5
+RELATED_IMAGE_SAIA_API=667741767953.dkr.ecr.us-west-2.amazonaws.com/ml-platform/saia/saia-api:build-1
+RELATED_IMAGE_OTEL_COLLECTOR=otel/opentelemetry-collector-contrib:0.122.1
+SPLUNK_OPERATOR_FOR_KUBERNETES=3.0.0
 CLUSTER_NAME=sok-ml-platform
 MODEL_VERSION=v0.3.14-36-g1549f5a
 RAY_VERSION=2.44.0

.github/ISSUE_TEMPLATE/bug_report.md

@@ -12,7 +12,7 @@ A clear and concise description of what the bug is.
 
 ## Environment
 
-- **Operator Version**: [e.g., v0.1.0]
+- **Operator Version**: [e.g., v0.2.0]
 - **Kubernetes Version**: [e.g., v1.31.13]
 - **Cloud Provider**: [e.g., AWS EKS, GKE, AKS, k0s]
 - **OS**: [e.g., Ubuntu 22.04]

.github/ISSUE_TEMPLATE/dependency-updates-tracking.md

@@ -0,0 +1,151 @@
+---
+name: Dependency Updates Tracking
+about: Track batch dependency updates for a release
+title: 'Dependency Updates for v[VERSION]'
+labels: dependencies, enhancement
+assignees: ''
+
+---
+
+## Overview
+
+Track dependency updates to be included in release v[VERSION].
+
+## High Priority Updates
+
+These should be reviewed and updated soon:
+
+### Kubernetes Core Dependencies
+- [ ] `k8s.io/api`: [current] → [target]
+- [ ] `k8s.io/apimachinery`: [current] → [target]
+- [ ] `k8s.io/apiextensions-apiserver`: [current] → [target]
+- [ ] `k8s.io/client-go`: [current] → [target]
+
+**Impact:** Core Kubernetes compatibility
+**Testing Required:** Full operator test suite, E2E tests
+
+### Controller Runtime
+- [ ] `sigs.k8s.io/controller-runtime`: [current] → [target]
+
+**Impact:** Operator framework updates
+**Testing Required:** Controller reconciliation, webhook functionality
+
+### Certificate Manager
+- [ ] `github.com/cert-manager/cert-manager`: [current] → [target]
+
+**Impact:** Certificate management functionality
+**Testing Required:** TLS certificate generation, webhook certificates
+
+## Medium Priority Updates
+
+Can be included if time permits:
+
+### Cloud Provider SDKs
+- [ ] `github.com/Azure/azure-sdk-for-go/sdk/azidentity`: [current] → [target]
+- [ ] `github.com/aws/aws-sdk-go-v2/*`: [current] → [target]
+
+**Impact:** Cloud provider integration
+**Testing Required:** Cloud-specific features (if any)
+
+### Observability
+- [ ] `github.com/prometheus/client_golang`: [current] → [target]
+- [ ] `sigs.k8s.io/yaml`: [current] → [target]
+
+**Impact:** Metrics and configuration parsing
+**Testing Required:** Metrics endpoint, YAML parsing tests
+
+## Low Priority Updates
+
+Nice to have, but not critical:
+
+### Testing Dependencies
+- [ ] `github.com/stretchr/testify`: [current] → [target]
+- [ ] `github.com/go-logr/logr`: [current] → [target]
+
+**Impact:** Test functionality only
+**Testing Required:** Existing test suite
+
+## Update Process
+
+### 1. Create Update Branch
+```bash
+git checkout -b chore/dependency-updates-v[VERSION]
+```
+
+### 2. Update Go Modules
+```bash
+# Update all dependencies
+go get -u ./...
+
+# Or update specific packages
+go get -u k8s.io/api@v0.34.2
+go get -u k8s.io/apimachinery@v0.34.2
+# ... etc
+
+# Tidy up
+go mod tidy
+```
+
+### 3. Test Changes
+```bash
+# Run unit tests
+make test
+
+# Run lint
+make lint
+
+# Build operator
+make build
+
+# Test deployment (local cluster)
+make deploy IMG=controller:latest
+```
+
+### 4. Update Compatibility Matrix
+Update `compatibility-matrix.yaml` with new versions:
+```yaml
+platform:
+  kubernetes:
+    minVersion: "X.Y.Z"  # Update if changed
+    maxVersion: "X.Y.Z"  # Update if changed
+```
+
+### 5. Generate New BOM
+```bash
+make generate-bom VERSION=[VERSION]
+```
+
+### 6. Create PR
+- Reference this tracking issue
+- Include test results
+- Note any breaking changes
+
+## Testing Checklist
+
+Before merging:
+
+- [ ] All unit tests pass (`make test`)
+- [ ] Linter passes (`make lint`)
+- [ ] Operator builds successfully (`make build`)
+- [ ] Operator deploys to test cluster
+- [ ] Sample CRDs can be created
+- [ ] Webhooks function correctly
+- [ ] No regression in existing functionality
+- [ ] Compatibility matrix updated
+- [ ] BOM regenerated
+
+## Breaking Changes
+
+Document any breaking changes here:
+
+- None expected (minor/patch updates only)
+
+## References
+
+- Dependabot configuration: `.github/dependabot.yml`
+- Related Dependabot issues: #[numbers]
+- Testing guide: `docs/testing.md`
+
+## Notes
+
+Add any additional notes or concerns here.

.github/ct-config.yaml

@@ -10,6 +10,7 @@ chart-repos:
   - prometheus-community=https://prometheus-community.github.io/helm-charts
   - opentelemetry=https://open-telemetry.github.io/opentelemetry-helm-charts
   - kuberay=https://ray-project.github.io/kuberay-helm
+  - splunk=https://splunk.github.io/splunk-operator/
 
 # Target branch for comparison (used in PRs)
 target-branch: main

.github/dependabot.yml

@@ -1,46 +1,142 @@
+# Dependabot configuration for Splunk AI Operator
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
 version: 2
 updates:
-  # Go dependencies
+  # Go module dependencies
   - package-ecosystem: "gomod"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"  # Reduced from weekly to reduce noise
       day: "monday"
       time: "09:00"
-    open-pull-requests-limit: 10
+      timezone: "America/Los_Angeles"
+    open-pull-requests-limit: 5  # Reduced from 10
+
+    # Group related updates together to reduce PR count
+    groups:
+      # Kubernetes core dependencies
+      kubernetes-core:
+        patterns:
+          - "k8s.io/api"
+          - "k8s.io/apimachinery"
+          - "k8s.io/client-go"
+          - "k8s.io/apiextensions-apiserver"
+        update-types:
+          - "minor"
+          - "patch"
+
+      # Kubernetes SIG dependencies
+      kubernetes-sigs:
+        patterns:
+          - "sigs.k8s.io/controller-runtime"
+          - "sigs.k8s.io/yaml"
+        update-types:
+          - "minor"
+          - "patch"
+
+      # Cloud provider SDKs
+      cloud-providers:
+        patterns:
+          - "github.com/Azure/azure-sdk-for-go/*"
+          - "github.com/aws/aws-sdk-go*"
+        update-types:
+          - "minor"
+          - "patch"
+
+      # Observability (metrics, logging)
+      observability:
+        patterns:
+          - "github.com/prometheus/*"
+          - "github.com/go-logr/*"
+        update-types:
+          - "minor"
+          - "patch"
+
+      # Testing dependencies
+      testing:
+        patterns:
+          - "github.com/stretchr/testify"
+          - "github.com/onsi/ginkgo*"
+          - "github.com/onsi/gomega"
+        update-types:
+          - "minor"
+          - "patch"
+
+      # Certificate management
+      cert-manager:
+        patterns:
+          - "github.com/cert-manager/*"
+        update-types:
+          - "minor"
+          - "patch"
+
+    # Ignore specific dependencies or update types
+    ignore:
+      # Ignore major version updates for manual review
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+      # Ignore Go toolchain updates (we manage Go version manually)
+      - dependency-name: "go"
+      - dependency-name: "golang.org/toolchain"
+
+    # Add labels to PRs for easy filtering
     labels:
       - "dependencies"
       - "go"
+      - "automated"
+
+    # Commit message configuration
     commit-message:
       prefix: "chore(deps)"
       include: "scope"
 
-  # GitHub Actions
+  # GitHub Actions (we pin to commit hashes, so less frequent updates needed)
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "quarterly"  # Reduced from weekly since we pin to commits
       day: "monday"
       time: "09:00"
-    open-pull-requests-limit: 10
+      timezone: "America/Los_Angeles"
+    open-pull-requests-limit: 3  # Reduced from 10
+
+    # Group all GitHub Actions updates together
+    groups:
+      github-actions-all:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+          - "minor"
+          - "patch"
+
     labels:
       - "dependencies"
       - "github-actions"
-    commit-message:
-      prefix: "chore(deps)"
-      include: "scope"
+      - "automated"
 
-  # Docker (for Dockerfiles)
-  - package-ecosystem: "docker"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "09:00"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-      - "docker"
     commit-message:
       prefix: "chore(deps)"
       include: "scope"
+
+  # Docker base images (Dockerfile)
+  # Disabled: Images reference private ECR repositories that Dependabot cannot access
+  # - package-ecosystem: "docker"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "monthly"  # Reduced from weekly
+  #     day: "monday"
+  #     time: "09:00"
+  #     timezone: "America/Los_Angeles"
+  #   open-pull-requests-limit: 2  # Reduced from 5
+  #
+  #   labels:
+  #     - "dependencies"
+  #     - "docker"
+  #     - "automated"
+  #
+  #   commit-message:
+  #     prefix: "chore(deps)"
+  #     include: "scope"

.github/workflows/codeql-analysis.yml

@@ -17,9 +17,9 @@ name: "CodeQL Advanced"
 
 on:
   push:
-    branches: [ "main", "develop" ]
+    branches: [ "main", "simplify-workflow-to-main-only" ]
   pull_request:
-    branches: [ "main", "develop" ]
+    branches: [ "main" ]
   schedule:
     - cron: '30 1 * * 1'  # Run every Monday at 1:30 AM UTC
 
@@ -42,10 +42,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@08bc0cf022445eacafaa248bf48da20f26b8fd40 # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -58,10 +58,8 @@ jobs:
           echo 'Manual build not required for Go with autobuild'
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@08bc0cf022445eacafaa248bf48da20f26b8fd40 # v4
         with:
           category: "/language:${{ matrix.language }}"
           output: sarif-results
-          upload: false  # Disabled: conflicts with default setup
-          # Set to 'true' after disabling GitHub's default CodeQL setup
-        continue-on-error: true  # Don't fail workflow if upload conflicts
+          upload: true  # Enabled to unblock PR merges