From dc3e7b3e65ba9424482916e9551453452b2b42b1 Mon Sep 17 00:00:00 2001
From: Divyesh-Khokhar <divyesh.k@ibm.com>
Date: Mon, 6 Jul 2026 15:49:21 +0530
Subject: [PATCH 1/2] [minor] Add external database support for AIService
 (#404)

---
 .../templates/pipelinerun-install.yml.j2      | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/src/mas/devops/templates/pipelinerun-install.yml.j2 b/src/mas/devops/templates/pipelinerun-install.yml.j2
index 5ebb7805..668e7c71 100644
--- a/src/mas/devops/templates/pipelinerun-install.yml.j2
+++ b/src/mas/devops/templates/pipelinerun-install.yml.j2
@@ -1005,6 +1005,29 @@ spec:
       value: "{{ aiservice_certificate_issuer }}"
 {%- endif %}
 
+    # AI Service - Database Configuration
+    # -------------------------------------------------------------------------
+{%- if install_db2 is defined %}
+    - name: install_db2
+      value: "{{ install_db2 }}"
+{%- endif %}
+{%- if aiservice_db_jdbc_url is defined and aiservice_db_jdbc_url != "" %}
+    - name: aiservice_db_jdbc_url
+      value: "{{ aiservice_db_jdbc_url }}"
+{%- endif %}
+{%- if aiservice_db_username is defined and aiservice_db_username != "" %}
+    - name: aiservice_db_username
+      value: "{{ aiservice_db_username }}"
+{%- endif %}
+{%- if aiservice_db_password is defined and aiservice_db_password != "" %}
+    - name: aiservice_db_password
+      value: "{{ aiservice_db_password }}"
+{%- endif %}
+{%- if aiservice_db_ca_cert is defined and aiservice_db_ca_cert != "" %}
+    - name: aiservice_db_ca_cert
+      value: "{{ aiservice_db_ca_cert }}"
+{%- endif %}
+
 {%- endif %}
 
   workspaces:

From 2adbd6525ba2ce82683ad60e966fc4ff78a273de Mon Sep 17 00:00:00 2001
From: Raahithyaj <raahithya.jayaram@ibm.com>
Date: Mon, 6 Jul 2026 17:24:03 +0530
Subject: [PATCH 2/2] [patch] Fix postsync job 'postsync-setup-db2' is failing
 on the ENCRLIB validation check for the facilities DB2 instance. (#417)

Co-authored-by: amitpandey0217 <amit.pandey17@ibm.com>
---
 .secrets.baseline     | 4 ++--
 src/mas/devops/db2.py | 4 ++++
 test/src/test_db2.py  | 6 ++++++
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.secrets.baseline b/.secrets.baseline
index dfa6a6f7..046b9045 100644
--- a/.secrets.baseline
+++ b/.secrets.baseline
@@ -3,7 +3,7 @@
     "files": "^.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2026-06-19T12:37:02Z",
+  "generated_at": "2026-07-03T11:02:31Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -178,7 +178,7 @@
         "hashed_secret": "a4b48a81cdab1e1a5dd37907d6c85ca1c61ddc7c",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 241,
+        "line_number": 247,
         "type": "Secret Keyword",
         "verified_result": null
       }
diff --git a/src/mas/devops/db2.py b/src/mas/devops/db2.py
index f7f89b7c..6148bff6 100644
--- a/src/mas/devops/db2.py
+++ b/src/mas/devops/db2.py
@@ -189,6 +189,10 @@ def cr_pod_v_matches(cr_k: str, cr_v: str, pod_v: str) -> bool:
         # db2 appends something like "/NODE0000/LOGSTREAM0000/" to the cr_v in these cases
         return pod_v.startswith(cr_v)
 
+    # special case for ENCRLIB — DB2 resolves the symlink and stores the full absolute path, so just check if the library name is present
+    if cr_k == "ENCRLIB":
+        return cr_v in pod_v
+
     # Look for e.g. 8192 AUTOMATIC -> AUTOMATIC(8192)
     matches = re.search(r"(\d+)\s*AUTOMATIC", cr_v, re.IGNORECASE)
     if matches is not None:
diff --git a/test/src/test_db2.py b/test/src/test_db2.py
index c6feaa43..5f26c803 100644
--- a/test/src/test_db2.py
+++ b/test/src/test_db2.py
@@ -49,6 +49,12 @@
         ("X", "otherSTRING", "OTHERstring", False),
         ("X", "other string", "other string", True),
         ("X", "22", "22", True),
+        # ENCRLIB — short filename in CR, full absolute path in pod → should pass
+        ("ENCRLIB", "libdb2compr_encr.so", "/opt/ibm/db2/V11.5.0.0/lib64/libdb2compr_encr.so.1", True),
+        # ENCRLIB — future DB2 version path → should still pass
+        ("ENCRLIB", "libdb2compr_encr.so", "/opt/ibm/db2/V11.5.10.0/lib64/libdb2compr_encr.so.1", True),
+        # ENCRLIB — completely wrong library → should fail
+        ("ENCRLIB", "libdb2compr_encr.so", "/opt/ibm/db2/V11.5.0.0/lib64/somewronglibrary.so", False),
     ],
 )
 def test_cr_pod_v_matches(cr_k, cr_v, pod_v, expected):