Fvtsaasai change

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "build/bin/config/oscap/ssg-rhel9-ds.xml|^.secrets.baseline$|^docs/catalogs/",
     "lines": null
   },
-  "generated_at": "2026-07-09T02:31:07Z",
+  "generated_at": "2026-07-30T12:23:32Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -248,29 +248,29 @@
         "type": "Secret Keyword",
         "verified_result": null
       },
-      {
-        "hashed_secret": "d8a1d01c81ccc3a024b078bd0af28e40cb38cdc4",
-        "is_secret": true,
-        "is_verified": false,
-        "line_number": 290,
-        "type": "Secret Keyword",
-        "verified_result": null
-      },
       {
         "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 359,
+        "line_number": 344,
         "type": "Secret Keyword",
         "verified_result": null
       }
     ],
     "image/cli/mascli/functions/gitops_aiservice_tenant": [
+      {
+        "hashed_secret": "d8a1d01c81ccc3a024b078bd0af28e40cb38cdc4",
+        "is_secret": true,
+        "is_verified": false,
+        "line_number": 356,
+        "type": "Secret Keyword",
+        "verified_result": null
+      },
       {
         "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 387,
+        "line_number": 408,
         "type": "Secret Keyword",
         "verified_result": null
       }
@@ -365,16 +365,6 @@
         "verified_result": null
       }
     ],
-    "image/cli/mascli/functions/gitops_deprovision_kmodel": [
-      {
-        "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 173,
-        "type": "Secret Keyword",
-        "verified_result": null
-      }
-    ],
     "image/cli/mascli/functions/gitops_deprovision_mongo": [
       {
         "hashed_secret": "2582aea6f911bd00fc04cb25e0ec16d5ead62068",
@@ -443,16 +433,6 @@
         "verified_result": null
       }
     ],
-    "image/cli/mascli/functions/gitops_kmodel": [
-      {
-        "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 335,
-        "type": "Secret Keyword",
-        "verified_result": null
-      }
-    ],
     "image/cli/mascli/functions/gitops_license": [
       {
         "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa",
@@ -720,7 +700,7 @@
         "hashed_secret": "fee2d55ad9a49a95fc89abe8f414dad66704ebfd",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 48,
+        "line_number": 49,
         "type": "Secret Keyword",
         "verified_result": null
       }

image/cli/mascli/functions/gitops_aiservice

@@ -287,21 +287,6 @@ function gitops_aiservice_fvt_prepare() {
 
   SECRETS_PREFIX="${ACCOUNT_ID}${SECRETS_KEY_SEPERATOR}${CLUSTER_ID}${SECRETS_KEY_SEPERATOR}"
 
-  WATSONXAI_APIKEY=${WATSONXAI_APIKEY:-"watsonxai-apikey"}
-  WATSONXAI_PROJECT_ID=${WATSONXAI_PROJECT_ID:-"watsonxai-project-id"}
-
-  SECRET_NAME_WATSONXAI=${SECRETS_PREFIX}watsonx
-
-  TAGS="[{\"Key\": \"watsonxai_apikey\", \"Value\": \"watsonxai_apikey\"}, {\"Key\": \"watsonxai_project_id\", \"Value\": \"watsonxai_project_id\"}]"
-
-  sm_update_secret \
-    "$SECRET_NAME_WATSONXAI" \
-    "{\"watsonxai_apikey\":\"$WATSONXAI_APIKEY\",\"watsonxai_project_id\":\"$WATSONXAI_PROJECT_ID\"}" \
-    "$TAGS" || {
-      echo "Failed to update WatsonX secret"
-      return 1
-    }
-
   SM_S3_ACCESSKEY=${SM_S3_ACCESSKEY:-"sm_s3_accesskey"}
   SM_S3_SECRETKEY=${SM_S3_SECRETKEY:-"sm_s3_secretkey"}
   SM_S3_HOST=${SM_S3_HOST:-"sm_s3_host"}

image/cli/mascli/functions/gitops_aiservice_tenant

@@ -349,6 +349,27 @@ function gitops_aiservice_tenant_noninteractive() {
   fi
  }
 
+function gitops_aiservice_tenant_fvt_prepare() {
+
+  SECRETS_PREFIX="${ACCOUNT_ID}${SECRETS_KEY_SEPERATOR}${CLUSTER_ID}${SECRETS_KEY_SEPERATOR}${AISERVICE_INSTANCE_ID}${SECRETS_KEY_SEPERATOR}${TENANT_ID}${SECRETS_KEY_SEPERATOR}"
+
+  WATSONXAI_APIKEY=${WATSONXAI_APIKEY:-"watsonxai-apikey"}
+  WATSONXAI_PROJECT_ID=${WATSONXAI_PROJECT_ID:-"watsonxai-project-id"}
+
+  SECRET_NAME_WATSONXAI=${SECRETS_PREFIX}watsonx
+
+  TAGS="[{\"Key\": \"watsonxai_apikey\", \"Value\": \"watsonxai_apikey\"}, {\"Key\": \"watsonxai_project_id\", \"Value\": \"watsonxai_project_id\"}]"
+
+  sm_update_secret \
+    "$SECRET_NAME_WATSONXAI" \
+    "{\"watsonxai_apikey\":\"$WATSONXAI_APIKEY\",\"watsonxai_project_id\":\"$WATSONXAI_PROJECT_ID\"}" \
+    "$TAGS" || {
+      echo "Failed to update WatsonX secret"
+      return 1
+    }    
+  echo "AI Service Tenant FVT secret creating function end"
+}
+
 function gitops_aiservice_tenant() {
   # Take the first parameter off (it will be create-gitops)
   shift
@@ -508,7 +529,8 @@ fi
     fi
     sm_verify_secret_exists ${WATSONX_SECRET} "watsonxai_apikey,watsonxai_project_id"
   else
-      echo "GitOps FVT Environment: Skipping SLS secret verification (will be created by postSync job)"
+      echo "IS_GITOPS_FVT_ENV is true - Skipping DRO, sls, and watsonx secret validation"
+      gitops_aiservice_tenant_fvt_prepare
   fi
 
   # Load scheduling config file

image/cli/mascli/functions/gitops_mas_fvt_preparer

@@ -88,7 +88,18 @@ function gitops_mas_fvt_preparer() {
     export SET_FINISHED=false
   fi
   export DEPROVISION=false
-
+
+  # For AI Service FVT flow: ensure AISERVICE_INSTANCE_ID drives the pipelines namespace
+  # start_pipeline defaults read pipelines_namespace from FVT_ENVIRONMENT
+  # FVT_ENVIRONMENT is already set to AISERVICE_INSTANCE_ID by the Tekton task env,
+  # but we also explicitly export it here for clarity and for non-Tekton invocations
+  if [[ -n "${AISERVICE_INSTANCE_ID}" ]]; then
+    export FVT_ENVIRONMENT=${AISERVICE_INSTANCE_ID}
+    export SYNC_WITH_UPDATE=false
+    export SYNC_WITH_UPGRADE=false
+    export SYNC_WITH_UNINSTALL=false
+  fi
+
   #FVT pipeline to run
   export PIPELINE_NAME=$FVT_PIPELINE_NAME
   export ROLE_NAME="setup_pipeline"

image/cli/mascli/templates/gitops/appset-configs/cluster/instance/ibm-aiservice-tenant.yaml.j2

@@ -9,6 +9,7 @@ ibm_aiservice_tenant:
   catalog_source: "{{ CATALOG_SOURCE }}"
   aiservice_tenant_install_plan_approval: "{{ AISERVICE_TENANT_INSTALL_PLAN_APPROVAL }}"
   tenantNamespace: "{{ TENANT_NAMESPACE }}"
+  is_gitops_fvt_env: "{{IS_GITOPS_FVT_ENV}}"
 {% if AISERVICE_ENABLE_DEPROVISIONING is defined and AISERVICE_ENABLE_DEPROVISIONING != '' %}
   enable_deprovisioning: {{ AISERVICE_ENABLE_DEPROVISIONING }}
 {% endif %}

tekton/src/pipelines/gitops/gitops-aiservice-fvt-preparer-pipeline.yml.j2

@@ -42,6 +42,16 @@ spec:
       type: string
     - name: fvt_ansible_version
       type: string
+    - name: fvt_version_core
+      type: string
+      default: ""
+    - name: ivt_version_core
+      type: string
+      default: ""  
+
+    - name: fvt_version_aiservice
+      type: string
+      default: ""
 
     - name: aiservice_channel
       type: string
@@ -105,7 +115,12 @@ spec:
           value: $(params.artifactory_generic_logs_url)
         - name: fvt_ansible_version
           value: $(params.fvt_ansible_version)
-
+        - name: fvt_version_core
+          value: $(params.fvt_version_core)
+        - name: ivt_version_core
+          value: $(params.ivt_version_core)
+        - name: fvt_version_aiservice
+          value: $(params.fvt_version_aiservice)
 
         - name: aiservice_channel
           value: $(params.aiservice_channel)

tekton/src/tasks/gitops/gitops-aiservice-fvt-preparer.yml.j2

@@ -28,6 +28,12 @@ spec:
       type: string
     - name: fvt_config
       type: string
+    - name: fvt_version_core
+      type: string
+      default: ""
+    - name: ivt_version_core
+      type: string
+      default: ""  
 
     - name: artifactory_generic_release_url
       type: string
@@ -49,6 +55,9 @@ spec:
     - name: aiservice_channel
       type: string
       default: ""
+    - name: fvt_version_aiservice
+      type: string
+      default: ""
     - name: launchfvt_aiservice
       type: string
       default: "true"  
@@ -97,7 +106,7 @@ spec:
       - name: AISERVICE_INSTANCE_ID
         value: $(params.aiservice_instance_id)
       - name: MAS_INSTANCE_ID
-        value: ""
+        value: $(params.aiservice_instance_id)
       - name: FVT_ENVIRONMENT
         value: $(params.aiservice_instance_id)
       - name: PIPELINE_STORAGE_CLASS
@@ -112,6 +121,10 @@ spec:
         value: $(params.fvt_config)
       - name: FVT_IMAGE_REGISTRY
         value: $(params.fvt_image_registry)
+      - name: FVT_VERSION_CORE
+        value: $(params.fvt_version_core)
+      - name: IVT_VERSION_CORE
+        value: $(params.ivt_version_core)  
       - name: ARTIFACTORY_GENERIC_RELEASE_URL
         value: $(params.artifactory_generic_release_url)
       - name: ARTIFACTORY_GENERIC_LOGS_URL
@@ -120,6 +133,8 @@ spec:
         value: $(params.fvt_ansible_version)
       - name: AISERVICE_CHANNEL
         value: $(params.aiservice_channel)
+      - name: FVT_VERSION_AISERVICE
+        value: $(params.fvt_version_aiservice)
       - name: LAUNCHFVT_AISERVICE
         value: $(params.launchfvt_aiservice)  
 
@@ -242,7 +257,7 @@ spec:
         export ARTIFACTORY_TOKEN=${FVT_ARTIFACTORY_TOKEN}
         export ARTIFACTORY_UPLOAD_DIR=${ARTIFACTORY_GENERIC_LOGS_URL}/mas-fvt/${AISERVICE_INSTANCE_ID}/${DEVOPS_BUILD_NUMBER}
 
-        CLI_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" 
+        CLI_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
         . $CLI_DIR/functions/gitops_utils
 
         ROSA_CONFIG=/workspace/configs/tmp-rosa/rosa-$(params.cluster_name)-details.yaml
@@ -361,14 +376,14 @@ spec:
 
           # First check the POSTSYNCJOBS_APP is healthy so we know the initial users job has run already (and so will exist)
           POSTSYNCJOBS_APP="postsyncjobs.${CLUSTER_NAME}.${AISERVICE_INSTANCE_ID}"
-          check_argo_app_healthy "${POSTSYNCJOBS_APP}" 20 || return $?
+          # check_argo_app_healthy "${POSTSYNCJOBS_APP}" 20 || return $?
 
           IU_SECRET_NAME="${ACCOUNT_ID}/${CLUSTER_NAME}/${AISERVICE_INSTANCE_ID}/initial_users" 
           IU_SECRET_VALUE="{\"$(get_random_email)\": \"primary,john,smith\", \"$(get_random_email)\": \"primary,jane,doe\", \"$(get_random_email)\": \"secondary,joe,bloggs\", \"$(get_random_email)\": \"secondary,billy,bob\"}"
           IU_SECRET_TAGS="[{\"Key\": \"source\", \"Value\": \"gitops-mas-fvt-preparer\"}, {\"Key\": \"account\", \"Value\": \"${ACCOUNT_ID}\"}, {\"Key\": \"cluster\", \"Value\": \"${CLUSTER_NAME}\"}]"
 
           echo "Creating ${IU_SECRET_NAME} secret"
-          sm_update_secret "${IU_SECRET_NAME}" "${IU_SECRET_VALUE}" "${IU_SECRET_TAGS}" || return $?
+          # sm_update_secret "${IU_SECRET_NAME}" "${IU_SECRET_VALUE}" "${IU_SECRET_TAGS}" || return $?
 
           # The Job will have already run when MAS Core was installed during the first phase of our FVT process
           # Since no initial_users secret existed at that time, it will not have done anything
@@ -385,8 +400,8 @@ spec:
 
           # Force a resync of the postsyncjobs app
           echo "Forcing ${POSTSYNCJOBS_APP} to resync"
-          argocd_sync "${POSTSYNCJOBS_APP}" || return $?
-          check_argo_app_healthy "${POSTSYNCJOBS_APP}" 20 || return $?
+          # argocd_sync "${POSTSYNCJOBS_APP}" || return $?
+          # check_argo_app_healthy "${POSTSYNCJOBS_APP}" 20 || return $?
         }
 
 
@@ -470,7 +485,7 @@ spec:
         if [[ "$LAUNCHER_ID" == "aiservice" ]]; then
           ACCOUNT_ROOT_APP="root.${ACCOUNT_ID}"
           CLUSTER_ROOT_APP="cluster.${CLUSTER_NAME}"
-          INSTANCE_ROOT_APP="instance.${CLUSTER_NAME}.${AISERVICE_INSTANCE_ID}"
+          INSTANCE_ROOT_APP="aiservice.${CLUSTER_NAME}.${AISERVICE_INSTANCE_ID}"
 
           argocd app set ${ACCOUNT_ROOT_APP} --parameter auto_delete=true --grpc-web