diff --git a/.secrets.baseline b/.secrets.baseline index 8dcdf20718..abb1da58ee 100644 --- a/.secrets.baseline +++ b/.secrets.baseline @@ -3,7 +3,7 @@ "files": "build/bin/config/oscap/ssg-rhel9-ds.xml|^.secrets.baseline$|^docs/catalogs/", "lines": null }, - "generated_at": "2026-07-09T02:31:07Z", + "generated_at": "2026-07-30T12:23:32Z", "plugins_used": [ { "name": "AWSKeyDetector" @@ -248,29 +248,29 @@ "type": "Secret Keyword", "verified_result": null }, - { - "hashed_secret": "d8a1d01c81ccc3a024b078bd0af28e40cb38cdc4", - "is_secret": true, - "is_verified": false, - "line_number": 290, - "type": "Secret Keyword", - "verified_result": null - }, { "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa", "is_secret": false, "is_verified": false, - "line_number": 359, + "line_number": 344, "type": "Secret Keyword", "verified_result": null } ], "image/cli/mascli/functions/gitops_aiservice_tenant": [ + { + "hashed_secret": "d8a1d01c81ccc3a024b078bd0af28e40cb38cdc4", + "is_secret": true, + "is_verified": false, + "line_number": 356, + "type": "Secret Keyword", + "verified_result": null + }, { "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa", "is_secret": false, "is_verified": false, - "line_number": 387, + "line_number": 408, "type": "Secret Keyword", "verified_result": null } @@ -365,16 +365,6 @@ "verified_result": null } ], - "image/cli/mascli/functions/gitops_deprovision_kmodel": [ - { - "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa", - "is_secret": false, - "is_verified": false, - "line_number": 173, - "type": "Secret Keyword", - "verified_result": null - } - ], "image/cli/mascli/functions/gitops_deprovision_mongo": [ { "hashed_secret": "2582aea6f911bd00fc04cb25e0ec16d5ead62068", @@ -443,16 +433,6 @@ "verified_result": null } ], - "image/cli/mascli/functions/gitops_kmodel": [ - { - "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa", - "is_secret": false, - "is_verified": false, - "line_number": 335, - "type": "Secret Keyword", - "verified_result": null - } - ], "image/cli/mascli/functions/gitops_license": [ { "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa", @@ -720,7 +700,7 @@ "hashed_secret": "fee2d55ad9a49a95fc89abe8f414dad66704ebfd", "is_secret": false, "is_verified": false, - "line_number": 48, + "line_number": 49, "type": "Secret Keyword", "verified_result": null } diff --git a/image/cli/mascli/functions/gitops_aiservice b/image/cli/mascli/functions/gitops_aiservice index a4de64daf9..4efd34a316 100644 --- a/image/cli/mascli/functions/gitops_aiservice +++ b/image/cli/mascli/functions/gitops_aiservice @@ -287,21 +287,6 @@ function gitops_aiservice_fvt_prepare() { SECRETS_PREFIX="${ACCOUNT_ID}${SECRETS_KEY_SEPERATOR}${CLUSTER_ID}${SECRETS_KEY_SEPERATOR}" - WATSONXAI_APIKEY=${WATSONXAI_APIKEY:-"watsonxai-apikey"} - WATSONXAI_PROJECT_ID=${WATSONXAI_PROJECT_ID:-"watsonxai-project-id"} - - SECRET_NAME_WATSONXAI=${SECRETS_PREFIX}watsonx - - TAGS="[{\"Key\": \"watsonxai_apikey\", \"Value\": \"watsonxai_apikey\"}, {\"Key\": \"watsonxai_project_id\", \"Value\": \"watsonxai_project_id\"}]" - - sm_update_secret \ - "$SECRET_NAME_WATSONXAI" \ - "{\"watsonxai_apikey\":\"$WATSONXAI_APIKEY\",\"watsonxai_project_id\":\"$WATSONXAI_PROJECT_ID\"}" \ - "$TAGS" || { - echo "Failed to update WatsonX secret" - return 1 - } - SM_S3_ACCESSKEY=${SM_S3_ACCESSKEY:-"sm_s3_accesskey"} SM_S3_SECRETKEY=${SM_S3_SECRETKEY:-"sm_s3_secretkey"} SM_S3_HOST=${SM_S3_HOST:-"sm_s3_host"} diff --git a/image/cli/mascli/functions/gitops_aiservice_tenant b/image/cli/mascli/functions/gitops_aiservice_tenant index a3654bfc3d..a277b29b6e 100644 --- a/image/cli/mascli/functions/gitops_aiservice_tenant +++ b/image/cli/mascli/functions/gitops_aiservice_tenant @@ -349,6 +349,27 @@ function gitops_aiservice_tenant_noninteractive() { fi } +function gitops_aiservice_tenant_fvt_prepare() { + + SECRETS_PREFIX="${ACCOUNT_ID}${SECRETS_KEY_SEPERATOR}${CLUSTER_ID}${SECRETS_KEY_SEPERATOR}${AISERVICE_INSTANCE_ID}${SECRETS_KEY_SEPERATOR}${TENANT_ID}${SECRETS_KEY_SEPERATOR}" + + WATSONXAI_APIKEY=${WATSONXAI_APIKEY:-"watsonxai-apikey"} + WATSONXAI_PROJECT_ID=${WATSONXAI_PROJECT_ID:-"watsonxai-project-id"} + + SECRET_NAME_WATSONXAI=${SECRETS_PREFIX}watsonx + + TAGS="[{\"Key\": \"watsonxai_apikey\", \"Value\": \"watsonxai_apikey\"}, {\"Key\": \"watsonxai_project_id\", \"Value\": \"watsonxai_project_id\"}]" + + sm_update_secret \ + "$SECRET_NAME_WATSONXAI" \ + "{\"watsonxai_apikey\":\"$WATSONXAI_APIKEY\",\"watsonxai_project_id\":\"$WATSONXAI_PROJECT_ID\"}" \ + "$TAGS" || { + echo "Failed to update WatsonX secret" + return 1 + } + echo "AI Service Tenant FVT secret creating function end" +} + function gitops_aiservice_tenant() { # Take the first parameter off (it will be create-gitops) shift @@ -508,7 +529,8 @@ fi fi sm_verify_secret_exists ${WATSONX_SECRET} "watsonxai_apikey,watsonxai_project_id" else - echo "GitOps FVT Environment: Skipping SLS secret verification (will be created by postSync job)" + echo "IS_GITOPS_FVT_ENV is true - Skipping DRO, sls, and watsonx secret validation" + gitops_aiservice_tenant_fvt_prepare fi # Load scheduling config file diff --git a/image/cli/mascli/functions/gitops_mas_fvt_preparer b/image/cli/mascli/functions/gitops_mas_fvt_preparer index 0ed89efec6..59fb4dd9b4 100644 --- a/image/cli/mascli/functions/gitops_mas_fvt_preparer +++ b/image/cli/mascli/functions/gitops_mas_fvt_preparer @@ -88,7 +88,18 @@ function gitops_mas_fvt_preparer() { export SET_FINISHED=false fi export DEPROVISION=false - + + # For AI Service FVT flow: ensure AISERVICE_INSTANCE_ID drives the pipelines namespace + # start_pipeline defaults read pipelines_namespace from FVT_ENVIRONMENT + # FVT_ENVIRONMENT is already set to AISERVICE_INSTANCE_ID by the Tekton task env, + # but we also explicitly export it here for clarity and for non-Tekton invocations + if [[ -n "${AISERVICE_INSTANCE_ID}" ]]; then + export FVT_ENVIRONMENT=${AISERVICE_INSTANCE_ID} + export SYNC_WITH_UPDATE=false + export SYNC_WITH_UPGRADE=false + export SYNC_WITH_UNINSTALL=false + fi + #FVT pipeline to run export PIPELINE_NAME=$FVT_PIPELINE_NAME export ROLE_NAME="setup_pipeline" diff --git a/image/cli/mascli/templates/gitops/appset-configs/cluster/instance/ibm-aiservice-tenant.yaml.j2 b/image/cli/mascli/templates/gitops/appset-configs/cluster/instance/ibm-aiservice-tenant.yaml.j2 index 668762eff7..37270f5e6f 100644 --- a/image/cli/mascli/templates/gitops/appset-configs/cluster/instance/ibm-aiservice-tenant.yaml.j2 +++ b/image/cli/mascli/templates/gitops/appset-configs/cluster/instance/ibm-aiservice-tenant.yaml.j2 @@ -9,6 +9,7 @@ ibm_aiservice_tenant: catalog_source: "{{ CATALOG_SOURCE }}" aiservice_tenant_install_plan_approval: "{{ AISERVICE_TENANT_INSTALL_PLAN_APPROVAL }}" tenantNamespace: "{{ TENANT_NAMESPACE }}" + is_gitops_fvt_env: "{{IS_GITOPS_FVT_ENV}}" {% if AISERVICE_ENABLE_DEPROVISIONING is defined and AISERVICE_ENABLE_DEPROVISIONING != '' %} enable_deprovisioning: {{ AISERVICE_ENABLE_DEPROVISIONING }} {% endif %} diff --git a/tekton/src/pipelines/gitops/gitops-aiservice-fvt-preparer-pipeline.yml.j2 b/tekton/src/pipelines/gitops/gitops-aiservice-fvt-preparer-pipeline.yml.j2 index 09e07f9c90..b9c8068da7 100644 --- a/tekton/src/pipelines/gitops/gitops-aiservice-fvt-preparer-pipeline.yml.j2 +++ b/tekton/src/pipelines/gitops/gitops-aiservice-fvt-preparer-pipeline.yml.j2 @@ -42,6 +42,16 @@ spec: type: string - name: fvt_ansible_version type: string + - name: fvt_version_core + type: string + default: "" + - name: ivt_version_core + type: string + default: "" + + - name: fvt_version_aiservice + type: string + default: "" - name: aiservice_channel type: string @@ -105,7 +115,12 @@ spec: value: $(params.artifactory_generic_logs_url) - name: fvt_ansible_version value: $(params.fvt_ansible_version) - + - name: fvt_version_core + value: $(params.fvt_version_core) + - name: ivt_version_core + value: $(params.ivt_version_core) + - name: fvt_version_aiservice + value: $(params.fvt_version_aiservice) - name: aiservice_channel value: $(params.aiservice_channel) diff --git a/tekton/src/tasks/gitops/gitops-aiservice-fvt-preparer.yml.j2 b/tekton/src/tasks/gitops/gitops-aiservice-fvt-preparer.yml.j2 index dcde39d240..ff3cd89206 100644 --- a/tekton/src/tasks/gitops/gitops-aiservice-fvt-preparer.yml.j2 +++ b/tekton/src/tasks/gitops/gitops-aiservice-fvt-preparer.yml.j2 @@ -28,6 +28,12 @@ spec: type: string - name: fvt_config type: string + - name: fvt_version_core + type: string + default: "" + - name: ivt_version_core + type: string + default: "" - name: artifactory_generic_release_url type: string @@ -49,6 +55,9 @@ spec: - name: aiservice_channel type: string default: "" + - name: fvt_version_aiservice + type: string + default: "" - name: launchfvt_aiservice type: string default: "true" @@ -97,7 +106,7 @@ spec: - name: AISERVICE_INSTANCE_ID value: $(params.aiservice_instance_id) - name: MAS_INSTANCE_ID - value: "" + value: $(params.aiservice_instance_id) - name: FVT_ENVIRONMENT value: $(params.aiservice_instance_id) - name: PIPELINE_STORAGE_CLASS @@ -112,6 +121,10 @@ spec: value: $(params.fvt_config) - name: FVT_IMAGE_REGISTRY value: $(params.fvt_image_registry) + - name: FVT_VERSION_CORE + value: $(params.fvt_version_core) + - name: IVT_VERSION_CORE + value: $(params.ivt_version_core) - name: ARTIFACTORY_GENERIC_RELEASE_URL value: $(params.artifactory_generic_release_url) - name: ARTIFACTORY_GENERIC_LOGS_URL @@ -120,6 +133,8 @@ spec: value: $(params.fvt_ansible_version) - name: AISERVICE_CHANNEL value: $(params.aiservice_channel) + - name: FVT_VERSION_AISERVICE + value: $(params.fvt_version_aiservice) - name: LAUNCHFVT_AISERVICE value: $(params.launchfvt_aiservice) @@ -242,7 +257,7 @@ spec: export ARTIFACTORY_TOKEN=${FVT_ARTIFACTORY_TOKEN} export ARTIFACTORY_UPLOAD_DIR=${ARTIFACTORY_GENERIC_LOGS_URL}/mas-fvt/${AISERVICE_INSTANCE_ID}/${DEVOPS_BUILD_NUMBER} - CLI_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" + CLI_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" . $CLI_DIR/functions/gitops_utils ROSA_CONFIG=/workspace/configs/tmp-rosa/rosa-$(params.cluster_name)-details.yaml @@ -361,14 +376,14 @@ spec: # First check the POSTSYNCJOBS_APP is healthy so we know the initial users job has run already (and so will exist) POSTSYNCJOBS_APP="postsyncjobs.${CLUSTER_NAME}.${AISERVICE_INSTANCE_ID}" - check_argo_app_healthy "${POSTSYNCJOBS_APP}" 20 || return $? + # check_argo_app_healthy "${POSTSYNCJOBS_APP}" 20 || return $? IU_SECRET_NAME="${ACCOUNT_ID}/${CLUSTER_NAME}/${AISERVICE_INSTANCE_ID}/initial_users" IU_SECRET_VALUE="{\"$(get_random_email)\": \"primary,john,smith\", \"$(get_random_email)\": \"primary,jane,doe\", \"$(get_random_email)\": \"secondary,joe,bloggs\", \"$(get_random_email)\": \"secondary,billy,bob\"}" IU_SECRET_TAGS="[{\"Key\": \"source\", \"Value\": \"gitops-mas-fvt-preparer\"}, {\"Key\": \"account\", \"Value\": \"${ACCOUNT_ID}\"}, {\"Key\": \"cluster\", \"Value\": \"${CLUSTER_NAME}\"}]" echo "Creating ${IU_SECRET_NAME} secret" - sm_update_secret "${IU_SECRET_NAME}" "${IU_SECRET_VALUE}" "${IU_SECRET_TAGS}" || return $? + # sm_update_secret "${IU_SECRET_NAME}" "${IU_SECRET_VALUE}" "${IU_SECRET_TAGS}" || return $? # The Job will have already run when MAS Core was installed during the first phase of our FVT process # Since no initial_users secret existed at that time, it will not have done anything @@ -385,8 +400,8 @@ spec: # Force a resync of the postsyncjobs app echo "Forcing ${POSTSYNCJOBS_APP} to resync" - argocd_sync "${POSTSYNCJOBS_APP}" || return $? - check_argo_app_healthy "${POSTSYNCJOBS_APP}" 20 || return $? + # argocd_sync "${POSTSYNCJOBS_APP}" || return $? + # check_argo_app_healthy "${POSTSYNCJOBS_APP}" 20 || return $? } @@ -470,7 +485,7 @@ spec: if [[ "$LAUNCHER_ID" == "aiservice" ]]; then ACCOUNT_ROOT_APP="root.${ACCOUNT_ID}" CLUSTER_ROOT_APP="cluster.${CLUSTER_NAME}" - INSTANCE_ROOT_APP="instance.${CLUSTER_NAME}.${AISERVICE_INSTANCE_ID}" + INSTANCE_ROOT_APP="aiservice.${CLUSTER_NAME}.${AISERVICE_INSTANCE_ID}" argocd app set ${ACCOUNT_ROOT_APP} --parameter auto_delete=true --grpc-web