Merge branch 'stable' into rbacmode

Author: unnati-solanki-git

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "^.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2026-06-19T12:37:02Z",
+  "generated_at": "2026-07-03T11:02:31Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -178,7 +178,7 @@
         "hashed_secret": "a4b48a81cdab1e1a5dd37907d6c85ca1c61ddc7c",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 241,
+        "line_number": 247,
         "type": "Secret Keyword",
         "verified_result": null
       }

src/mas/devops/db2.py

@@ -189,6 +189,10 @@ def cr_pod_v_matches(cr_k: str, cr_v: str, pod_v: str) -> bool:
         # db2 appends something like "/NODE0000/LOGSTREAM0000/" to the cr_v in these cases
         return pod_v.startswith(cr_v)
 
+    # special case for ENCRLIB — DB2 resolves the symlink and stores the full absolute path, so just check if the library name is present
+    if cr_k == "ENCRLIB":
+        return cr_v in pod_v
+
     # Look for e.g. 8192 AUTOMATIC -> AUTOMATIC(8192)
     matches = re.search(r"(\d+)\s*AUTOMATIC", cr_v, re.IGNORECASE)
     if matches is not None:

src/mas/devops/mas/suite.py

@@ -88,10 +88,16 @@ def getDefaultStorageClasses(dynClient: DynamicClient) -> SimpleNamespace:
     for storageClass in storageClasses:
         if storageClass.metadata.name in ["ibmc-block-gold", "ibmc-file-gold-gid"]:
             result.provider = "ibmc"
-            result.providerName = "IBMCloud ROKS"
+            result.providerName = "IBMCloud ROKS Classic"
             result.rwo = "ibmc-block-gold"
             result.rwx = "ibmc-file-gold-gid"
             break
+        elif storageClass.metadata.name in ["ibmc-vpc-block-10iops-tier", "ibmc-vpc-file-1000-iops"]:
+            result.provider = "ibmc-vpc"
+            result.providerName = "IBMCloud ROKS VPC"
+            result.rwo = "ibmc-vpc-block-10iops-tier"
+            result.rwx = "ibmc-vpc-file-1000-iops"
+            break
         elif storageClass.metadata.name in [
             "ocs-storagecluster-ceph-rbd",
             "ocs-storagecluster-cephfs",

src/mas/devops/pre_install.py

@@ -11,7 +11,10 @@
 import logging
 import yaml
 
+import re
+
 from os import path, listdir
+from packaging.version import Version
 
 from jinja2 import Environment
 from kubernetes import client as k8s_client
@@ -86,6 +89,29 @@ def _should_apply_preinstall_mas_rbac_file(fileName: str, adminMode: str) -> boo
     return False
 
 
+def _resolve_rbac_version(rbacDir: str, masVersion: str) -> str | None:
+    """Return the highest x.y version directory under rbacDir that is <= masVersion.
+
+    Only directories whose names match the 'x.y' pattern are considered.
+    Returns None if no usable directory exists.
+    """
+    if not path.isdir(rbacDir):
+        return None
+
+    target = Version(masVersion)
+    best: Version | None = None
+
+    for entry in listdir(rbacDir):
+        if not re.fullmatch(r"\d+\.\d+", entry):
+            continue
+        candidate = Version(entry)
+        if candidate <= target:
+            if best is None or candidate > best:
+                best = candidate
+
+    return str(best) if best is not None else None
+
+
 def _collect_preinstall_mas_rbac_files_from_source(
     sourceOperatorsRoot: str,
     masVersion: str,
@@ -106,11 +132,16 @@ def _collect_preinstall_mas_rbac_files_from_source(
             logger.debug(f"Skipping missing operator root {operatorRoot}")
             continue
 
-        versionDir = path.join(operatorRoot, "rbac", masVersion)
-        if not path.isdir(versionDir):
-            logger.debug(f"Skipping missing RBAC version directory {versionDir}")
+        rbacDir = path.join(operatorRoot, "rbac")
+        resolvedVersion = _resolve_rbac_version(rbacDir, masVersion)
+        if resolvedVersion is None:
+            logger.debug(f"No usable RBAC version directory for {operatorName} at {masVersion} under {rbacDir}")
             continue
 
+        if resolvedVersion != masVersion:
+            logger.debug(f"RBAC version resolved: {operatorName} requested={masVersion} resolved={resolvedVersion}")
+
+        versionDir = path.join(rbacDir, resolvedVersion)
         for manifestName in sorted(listdir(versionDir)):
             manifestFile = path.join(versionDir, manifestName)
             if not path.isfile(manifestFile):

src/mas/devops/templates/pipelinerun-install.yml.j2

@@ -1005,6 +1005,29 @@ spec:
       value: "{{ aiservice_certificate_issuer }}"
 {%- endif %}
 
+    # AI Service - Database Configuration
+    # -------------------------------------------------------------------------
+{%- if install_db2 is defined %}
+    - name: install_db2
+      value: "{{ install_db2 }}"
+{%- endif %}
+{%- if aiservice_db_jdbc_url is defined and aiservice_db_jdbc_url != "" %}
+    - name: aiservice_db_jdbc_url
+      value: "{{ aiservice_db_jdbc_url }}"
+{%- endif %}
+{%- if aiservice_db_username is defined and aiservice_db_username != "" %}
+    - name: aiservice_db_username
+      value: "{{ aiservice_db_username }}"
+{%- endif %}
+{%- if aiservice_db_password is defined and aiservice_db_password != "" %}
+    - name: aiservice_db_password
+      value: "{{ aiservice_db_password }}"
+{%- endif %}
+{%- if aiservice_db_ca_cert is defined and aiservice_db_ca_cert != "" %}
+    - name: aiservice_db_ca_cert
+      value: "{{ aiservice_db_ca_cert }}"
+{%- endif %}
+
 {%- endif %}
 
   workspaces:

test/src/test_db2.py

@@ -49,6 +49,12 @@
         ("X", "otherSTRING", "OTHERstring", False),
         ("X", "other string", "other string", True),
         ("X", "22", "22", True),
+        # ENCRLIB — short filename in CR, full absolute path in pod → should pass
+        ("ENCRLIB", "libdb2compr_encr.so", "/opt/ibm/db2/V11.5.0.0/lib64/libdb2compr_encr.so.1", True),
+        # ENCRLIB — future DB2 version path → should still pass
+        ("ENCRLIB", "libdb2compr_encr.so", "/opt/ibm/db2/V11.5.10.0/lib64/libdb2compr_encr.so.1", True),
+        # ENCRLIB — completely wrong library → should fail
+        ("ENCRLIB", "libdb2compr_encr.so", "/opt/ibm/db2/V11.5.0.0/lib64/somewronglibrary.so", False),
     ],
 )
 def test_cr_pod_v_matches(cr_k, cr_v, pod_v, expected):