fix: support private VPC S3 endpoints in Loki operator

Fixes #19243

The Loki operator was rejecting private VPC S3 endpoints due to overly
strict endpoint validation that only accepted the standard AWS S3 format
(https://s3.region.amazonaws.com).

This change updates the validateS3Endpoint function to also accept VPC
endpoint formats:
- https://bucket.vpce-*-region.s3.region.vpce.amazonaws.com
- https://vpce-*-region.s3.region.vpce.amazonaws.com

Changes:
- Modified validateS3Endpoint to check for VPC endpoint patterns
- Added comprehensive test cases for both VPC endpoint formats
- Maintains backward compatibility with standard AWS S3 endpoints

This allows users to configure Loki with private VPC S3 endpoints in
OpenShift environments without operator reconciliation failures.

Signed-off-by: puretension <rlrlfhtm5@gmail.com>

Author: puretension

operator/internal/handlers/internal/storage/secrets.go

@@ -506,10 +506,20 @@ func validateS3Endpoint(endpoint string, region string) error {
 			return fmt.Errorf("%w: %s", errSecretMissingField, storage.KeyAWSRegion)
 		}
 
+		// Check if it's a standard AWS S3 endpoint
 		validEndpoint := fmt.Sprintf("https://s3.%s%s", region, awsEndpointSuffix)
-		if endpoint != validEndpoint {
-			return fmt.Errorf("%w: %s", errS3EndpointAWSInvalid, validEndpoint)
+		if endpoint == validEndpoint {
+			return nil
 		}
+
+		// Check if it's a VPC endpoint format: https://bucket.vpce-*-region.s3.region.vpce.amazonaws.com
+		// or https://vpce-*-region.s3.region.vpce.amazonaws.com
+		if strings.Contains(endpoint, ".vpce.amazonaws.com") && strings.Contains(endpoint, region) {
+			return nil
+		}
+
+		// If neither standard nor VPC endpoint format, return error
+		return fmt.Errorf("%w: %s", errS3EndpointAWSInvalid, validEndpoint)
 	}
 	return nil
 }

operator/internal/handlers/internal/storage/secrets_test.go

@@ -719,6 +719,44 @@ func TestS3Extract_ForcePathStyle(t *testing.T) {
 				ForcePathStyle: true,
 			},
 		},
+		{
+			desc: "aws s3 vpc endpoint",
+			secret: &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Data: map[string][]byte{
+					"endpoint":          []byte("https://bucket.vpce-1234567-us-east-1c.s3.us-east-1.vpce.amazonaws.com"),
+					"region":            []byte("us-east-1"),
+					"bucketnames":       []byte("this,that"),
+					"access_key_id":     []byte("id"),
+					"access_key_secret": []byte("secret"),
+				},
+			},
+			wantOptions: &storage.S3StorageConfig{
+				Endpoint:       "https://bucket.vpce-1234567-us-east-1c.s3.us-east-1.vpce.amazonaws.com",
+				Region:         "us-east-1",
+				Buckets:        "this,that",
+				ForcePathStyle: false,
+			},
+		},
+		{
+			desc: "aws s3 vpc endpoint without bucket prefix",
+			secret: &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{Name: "test"},
+				Data: map[string][]byte{
+					"endpoint":          []byte("https://vpce-1234567-us-east-1c.s3.us-east-1.vpce.amazonaws.com"),
+					"region":            []byte("us-east-1"),
+					"bucketnames":       []byte("this,that"),
+					"access_key_id":     []byte("id"),
+					"access_key_secret": []byte("secret"),
+				},
+			},
+			wantOptions: &storage.S3StorageConfig{
+				Endpoint:       "https://vpce-1234567-us-east-1c.s3.us-east-1.vpce.amazonaws.com",
+				Region:         "us-east-1",
+				Buckets:        "this,that",
+				ForcePathStyle: false,
+			},
+		},
 		{
 			desc: "invalid forcepathstyle value",
 			secret: &corev1.Secret{