chore(ci): add test to verify loki able to flush to s3

[jasonwashburn]

Description

Adds test to EKS workflow to verify that Loki can flush to S3.

Related Issue

Relates to CORE-495

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Steps to Validate

• Happy Path - Successful workflow completion
• Sad Path - Break Loki write s3 permissions. Run workflow. Validate test fails as expected.
  • example failing run created by changing loki-write service account in commit 756131d - https://github.com/defenseunicorns/uds-core/actions/runs/26062032260/job/76624324060?pr=2673#step:16:102

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide followed

[jasonwashburn]

@greptileai review

[greptile-apps]

Greptile Summary

This PR adds a CI step to the EKS workflow that verifies Loki can successfully flush log chunks to S3 object storage, addressing a gap in end-to-end storage validation for cloud deployments. It also registers src/loki/tasks.yaml in the IaC path filter so changes to the new task trigger the EKS workflow.

• src/loki/tasks.yaml — New validate-object-storage-writes task that port-forwards to the Loki write service, pushes a tagged test log entry, triggers a flush, then polls S3 (up to 5 minutes) for a recently-written chunk object under fake/, with proper trap-based cleanup and inline diagnostics on failure.
• .github/workflows/test-eks.yaml — Adds the new validation step after Test UDS Core, passing provider=aws and the EKS IaC directory as inputs.
• .github/workflows/test-iac.yaml — Adds src/loki/tasks.yaml to the EKS path-filter so the workflow re-runs when the task is modified.

Confidence Score: 5/5

Safe to merge — the new CI task adds observability over Loki's S3 write path without touching any production code.

All changes are confined to CI tasks and workflow definitions. The bash scripts use proper trap-based cleanup, inline readiness polling with bounded retries, a poll timeout for the S3 check, and manual masking of the sensitive bucket name in diagnostic output. Edge cases (empty bucket, JMESPath null return, port-forward early exit) are handled correctly.

No files require special attention.

Important Files Changed

Filename	Overview
src/loki/tasks.yaml	Adds validate-object-storage-writes task: well-structured with trap-based cleanup, port-forward readiness polling, S3 write verification loop, and bucket name masking in diagnostics. No logic errors found.
.github/workflows/test-eks.yaml	Adds a single step to run the Loki S3 validation task after the core test suite; inputs are correctly wired and step placement is appropriate.
.github/workflows/test-iac.yaml	Adds src/loki/tasks.yaml to EKS path filter and updates copyright year to 2024-2026; straightforward and correct.

Sequence Diagram

sequenceDiagram
    participant CI as GitHub Actions (EKS)
    participant UDS as UDS Task Runner
    participant TF as OpenTofu
    participant KFW as kubectl port-forward
    participant LW as Loki Write (svc)
    participant S3 as AWS S3

    CI->>UDS: uds run validate-object-storage-writes
    UDS->>TF: tofu output -raw loki_s3_bucket
    TF-->>UDS: LOKI_CHUNKS_OBJECT_STORAGE_BUCKET
    UDS->>UDS: capture LOKI_OBJECT_STORAGE_TEST_START (date -u)
    UDS->>KFW: port-forward svc/loki-write :3100
    loop readiness (up to 30x2s)
        UDS->>LW: GET /ready
        LW-->>UDS: 200 OK
    end
    UDS->>LW: POST /loki/api/v1/push (test log)
    LW-->>UDS: 204
    UDS->>LW: POST /flush
    LW-->>UDS: 200
    UDS->>KFW: kill (trap cleanup)
    loop poll S3 (up to 300s / 10s interval)
        UDS->>S3: "list-objects-v2 --prefix fake/ --query LastModified >= START"
        S3-->>UDS: count of recent chunk objects
        alt "count > 0"
            UDS-->>CI: PASS
        else "count == 0"
            UDS->>UDS: sleep 10s
        end
    end
    UDS-->>CI: FAIL (timeout)

Loading

_{Reviews (4): Last reviewed commit: "chore(ci): switch loki s3 test to look f..." | Re-trigger Greptile}

[Copilot]

Pull request overview

Adds an EKS CI validation path to confirm Loki can write flushed log chunks to AWS S3 object storage.

Changes:

• Adds a Loki task that pushes a synthetic log, calls Loki flush, and polls S3 for recent objects.
• Runs the new Loki S3 validation in the EKS workflow.
• Updates IaC path filtering so Loki task changes trigger EKS testing.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/loki/tasks.yaml	Adds reusable object-storage write validation task for Loki.
.github/workflows/test-eks.yaml	Runs the new Loki S3 validation during EKS tests.
.github/workflows/test-iac.yaml	Adds Loki task file to the EKS IaC workflow path filter.