From 19f60af874fc746c3d2c0d5fb543246e070cc6e8 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 21 Jul 2026 11:22:29 +0530 Subject: [PATCH 001/115] Added CPD 5.3.1 gitops support --- .../templates/00-ibm-cp4d-olm-531.yaml | 678 ++++++++++++++++++ .../templates/01-ibm-cp4d-CatalogSources.yaml | 72 ++ .../templates/00-ibm-cp4d-olm-531.yaml | 677 +++++++++++++++++ .../04-db2u-Volatile-Runstats_Cron.yaml | 1 + 4 files changed, 1428 insertions(+) create mode 100644 instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml create mode 100644 instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml diff --git a/instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml b/instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml new file mode 100644 index 000000000..fb9b366fd --- /dev/null +++ b/instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml @@ -0,0 +1,678 @@ +{{- if eq .Values.cpd_product_version "5.3.1" }} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: olm-utils-cm + namespace: mas-{{ .Values.instance_id }}-syncres + annotations: + argocd.argoproj.io/sync-wave: "00" + labels: + app.kubernetes.io/name: olm-utils +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +data: + licenses_urls: |- + SWHP: + url: "https://ibm.biz/BdbGRu" + description: "IBM Software Hub Premium Cartridge" + SWHAI: + url: "https://ibm.biz/BdbGRL" + description: "IBM Softare Hub AI Assistant Cartridge" + EE: + url: https://ibm.biz/Bdbq3x + description: "IBM Cloud Pak for Data Enterprise Edition" + SE: + url: https://ibm.biz/Bdbq3H + description: "IBM Cloud Pak for Data Standard Edition" + WXAI: + url: https://ibm.biz/BdbKbw + description: "IBM watsonx.ai" + DB2CE: + url: https://ibm.biz/BdnPB7 + description: "IBM Db2 Community Edition" + DB2SE: + url: https://ibm.biz/BdnPdB + description: "IBM Db2 Standard Edition Cartridge for IBM Cloud Pak for Data" + DB2AE: + url: https://ibm.biz/BdnPBW + description: "IBM Db2 Advanced Edition Cartridge for IBM Cloud Pak for Data" + DG: + url: "https://ibm.biz/dg4zos_v320" + description: "IBM Data Gate for z/OS with Cloud Pak for Data" + DGWXD: + url: "https://ibm.biz/dgx_v13" + description: "IBM Data Gate for watsonx" + DGWXDB: + url: "https://ibm.biz/wxd-dgx" + description: "IBM watsonx.data with Data Gate for IBM Z" + DGWXDPB: + url: "https://ibm.biz/wxdprem-dgx111" + description: "IBM watsonx.data Premium with Data Gate for IBM Z" + DGFS: + url: "https://ibm.biz/dg4fs_v13" + description: "IBM Data Gate for Financial Services" + IKCS: + url: https://ibm.biz/Bdmm4V + description: "IBM Knowledge Catalog Standard" + IKCP: + url: https://ibm.biz/Bdmm4J + description: "IBM Knowledge Catalog Premium" + IDRC: + url: https://ibm.biz/BdpHpg + description: "IBM Data Replication Cartridge" + IIDRC: + url: https://ibm.biz/BdpHph + description: "IBM InfoSphere Data Replication Cartridge" + IDRM: + url: https://ibm.biz/BdpHpJ + description: "IBM Data Replication Modernization" + IIDRM: + url: https://ibm.biz/BdpHpA + description: "IBM InfoSphere Data Replication Modernization" + IDRZOS: + url: https://ibm.biz/BdpHp9 + description: "IBM Data Replication for Db2 z/OS Cartridge" + IIDRWXTO: + url: https://ibm.biz/BdpHpu + description: "IBM InfoSphere Data Replication for watsonx.data Cartridge" + IIDRWXAO: + url: https://ibm.biz/BdpHpL + description: "IBM InfoSphere Data Replication Cartridge Add-on for IBM watsonx.data" + WXD: + url: https://ibm.biz/BdpdBF + description: "IBM watsonx.data" + WXDP: + url: https://ibm.biz/BdpzEx + description: "IBM watsonx.data Premium Edition" + WCA: + url: https://ibm.biz/Bdbv9x + description: "IBM watsonx Code Assistant" + WCAA: + url: https://ibm.biz/Bdbv9D + description: "IBM watsonx Code Assistant for Red Hat Ansible Lightspeed" + DPH: + url: https://ibm.biz/BdbQMv + description: "IBM Data Product Hub" + + release_components_meta: |- + scheduler: + case_version: 1.61.0 + sub_channel: "v1.61" + csv_version: 1.61.0 + cr_version: 1.61.0 + + cpfs: + csv_version: 4.17.0 + case_version: 4.17.0 + sub_channel: "v4.17" + + ibm-common-service-operator: + cr_version: 4.17.0 + + ibm-iam-operator: + cr_version: 4.16.0 + + ibm-namespace-scope-operator: + cr_version: 4.3.4 + + ibm-cert-manager: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_events_operator: + case_version: 6.0.0 + sub_channel: "v6.0" + csv_version: 6.0.0 + cr_version: 4.1.1 + + streamsets: + case_version: 9.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-streamsets-sdi: + case_version: 2.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-licensing: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_usage_metering: + case_version: 1.0.4 + csv_version: 1.0.4 + sub_channel: "v1.0" + cr_version: 1.0.4 + + cpd_platform: + case_version: 5.4.0 + csv_version: 6.4.0 + sub_channel: "v6.4" + cr_version: 5.4.0 + + platform-config: + cr_version: 5.4.0 + + ibm_swhcc: + case_version: 5.4.0 + csv_version: 5.4.0 + sub_channel: "v5.4" + cr_version: 5.4.0 + + zen: + case_version: 6.4.0 + sub_channel: "v6.4" + csv_version: 6.4.0 + cr_version: 6.4.0 + + analyticsengine: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + cognos_analytics: + case_version: 29.1.0 + sub_channel: "v29.1" + cr_version: 29.1.0 + csv_version: 29.1.0 + + ccs: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + dashboard: + case_version: 4.0.0 + sub_channel: "v4.0" + csv_version: 4.0.0 + cr_version: 5.3.0 + + datarefinery: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: "v12.1" + cr_version: 12.1.0 + + canvasbase: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + spss: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + syntheticdata: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + datastage_ent: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + datastage_ent_plus: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + informix: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + informix_cp4d: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + openscale: + case_version: 10.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + ws: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + ws_runtimes: + case_version: 12.1.0 + cr_version: 12.1.0 + + db2aaservice: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2oltp: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2wh: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2u: + case_version: 7.5.2 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + datagate: + case_version: 11.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 9.1.0 + + dods: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + hee: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + dv: + case_version: 8.1.0 + sub_channel: "v8.1" + csv_version: 8.1.0 + cr_version: 3.3.1 + + bigsql: + case_version: 14.1.0 + sub_channel: "v14.1" + csv_version: 14.1.0 + cr_version: 8.3.1 + + planning_analytics: + case_version: 5.3.1 + sub_channel: "v11.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + rstudio: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + watson_assistant: + case_version: 5.11.0 + sub_channel: "v5.11" + csv_version: 5.11.0 + cr_version: "5.3.1" + + watson_discovery: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + watson_speech: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + wkc: + case_version: 5.3.1 + sub_channel: "v9.1" + csv_version: 2.3.1 + cr_version: 5.3.1 + + ikc_standard: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + ikc_premium: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + datalineage: + case_version: 5.3.1 + sub_channel: "v7.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + udp: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster: + case_version: 9.1.0 + csv_version: 9.1.0 + sub_channel: "v9.1" + cr_version: 9.1.0 + + dataproduct: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + semantic_automation: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster_instance: + cr_version: 9.1.0 + + dp: + case_version: 11.1.0 + csv_version: 11.1.0 + sub_channel: "v11.1" + cr_version: 5.3.1 + + wml: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + dmc: + case_version: 8.11.0 + csv_version: 5.11.0 + cr_version: 5.3.1 + sub_channel: "v5.11" + + openpages: + case_version: 10.1.0 + csv_version: 10.1.0 + cr_version: 9.7.0 + sub_channel: "v10.1" + + openpages_instance: + cr_version: 9.7.0 + + mantaflow: + case_version: 2.4.0 + csv_version: 2.4.0 + sub_channel: "v2.4" + cr_version: 42.15.0 + + match360: + case_version: 4.11.0 + csv_version: 4.11.0 + cr_version: 4.11.50 + sub_channel: "v4.11" + + model_gateway: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + opencontent_opensearch: + case_version: 1.2.0 + csv_version: 1.2.0 + cr_version: 1.2.0 + sub_channel: "v1.1" + + opencontent_redis: + case_version: 1.6.11 + csv_version: 1.6.11 + sub_channel: "v1.6" + + ibm_redis_cp: + case_version: 1.3.1 + csv_version: 1.3.1 + sub_channel: "v1.3" + cr_version: 1.3.1 + + opencontent_rabbitmq: + case_version: 1.3.0 + csv_version: 1.3.0 + sub_channel: "v1.0" + cr_version: 1.3.0 + + opencontent_fdb: + case_version: 5.3.1 + csv_version: 5.3.1 + cr_version: 5.3.1 + sub_channel: "v5.3" + + fdb_k8s: + csv_version: 5.3.1 + sub_channel: "v5.3" + + opencontent_minio: + case_version: 1.0.23 + csv_version: 1.0.18 + + opencontent_etcd: + case_version: 2.0.57 + csv_version: 1.0.47 + + opencontent_auditwebhook: + case_version: 1.0.24 + csv_version: 0.3.1 + + watson_gateway: + case_version: 2.2.0 + csv_version: 2.2.0 + cr_version: 2.2.0 + + data_governor: + case_version: 8.1.0 + csv_version: 8.1.0 + sub_channel: v8.1 + cr_version: 3.29.4 + + ws_pipelines: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 5.3.1 + + postgresql: + case_version: 5.31.0 + sub_channel: "stable-v1.25" + csv_version: 1.25.5 + cr_version: 1.25.5 + + edb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + mongodb: + case_version: 5.31.0 + sub_channel: "stable" + csv_version: 1.33.0 + cr_version: 5.31.0 + + mongodb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + dpra: + deprecated: true + case_version: 1.20.0 + sub_channel: "v1.20" + csv_version: 1.20.0 + cr_version: 1.20.0 + + factsheet: + case_version: 7.1.0 + csv_version: 7.1.0 + sub_channel: "v7.1" + cr_version: 5.3.1 + + replication: + case_version: 5.3.1 + csv_version: 7.1.0 + cr_version: 5.3.1 + sub_channel: "v7.1" + + voice_gateway: + case_version: 1.13.0 + csv_version: 1.13.0 + sub_channel: v1.13 + cr_version: 1.13.0 + + watsonx_data: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + watsonx_data_premium: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + wxd_query_optimizer: + component_dependencies: + - db2u + + watsonx_ai: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + osai_min_version: 2.19.0 + + watsonx_ai_ifm: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + + watsonx_bi_assistant: + case_version: 3.4.0 + csv_version: 3.4.0 + sub_channel: v3.4 + cr_version: 3.4.0 + + wca_ansible: + case_version: 4.1.0 + cr_version: 5.3.1 + + wca: + case_version: 3.1.0 + cr_version: 5.3.1 + + wca_z: + case_version: 4.1.0 + csv_version: 4.1.0 + sub_channel: v4.0 + cr_version: 5.3.1 + + wca_z_agentic: + case_version: 2.0.1 + csv_version: 2.0.1 + sub_channel: v2.1 + cr_version: 2.7.1 + + wca_z_ce: + case_version: 5.3.1 + sub_channel: v2.8 + csv_version: 2.8.10 + cr_version: 2.8.10 + + wca_z_cg: + case_version: 5.3.1 + sub_channel: v1.1 + csv_version: 1.1.1 + cr_version: 2.8.10 + + wca_base: + case_version: 4.1.0 + cr_version: 5.3.1 + + ibm_neo4j: + case_version: 1.3.1 + sub_channel: "v4.1" + csv_version: 1.3.1 + cr_version: 1.3.1 + + watsonx_governance: + case_version: 5.1.0 + sub_channel: "v5.1" + csv_version: 5.1.0 + cr_version: 2.3.1 + + watsonx_orchestrate: + case_version: 7.1.0 + sub_channel: "v7.1" + csv_version: 7.1.0 + cr_version: "7.1.0" + + watsonx_dataintegration: + case_version: 2.4.0 + sub_channel: "v2.4" + csv_version: 5.3.1 + cr_version: 2.3.1 + + watsonx_dataintelligence: + case_version: 2.3.1 + sub_channel: "v2.31" + csv_version: 2.3.1 + cr_version: 2.3.1 + + wca_z_understand: + case_version: 1.1.0 + csv_version: 1.1.0 + sub_channel: v1.1 + cr_version: 2.8.10 + + ibm-databand: + case_version: 1.0.0 + csv_version: 1.0.0 + cr_version: 1.0.0 + sub_channel: "v1.0.0" + + datastax_mc: + case_version: 1.16.1 + cr_version: 1.16.1 + + ibm_wxd_opensearch: + case_version: 3.3.2 + cr_version: 3.3.2 + release_version: 5.3.1 +{{- end }} + + + diff --git a/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml b/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml index 461104031..499b3ad64 100644 --- a/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml +++ b/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml @@ -293,4 +293,76 @@ spec: registryPoll: interval: 30m0s {{- end }} +{{- end }} + + +# cpd 5.3.1 catalog sources +{{- if eq .Values.cpd_product_version "5.3.1" }} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: CatalogSource +metadata: + name: cpd-platform + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "001" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + displayName: ibm-cp-datacore-6.4.0-50 + image: icr.io/cpopen/ibm-cpd-platform-operator-catalog@sha256:0a63f6bf9c312efc3daca05a657c70f300eaef7f5a36055753b11fcf014688ca + publisher: IBM + sourceType: grpc + updateStrategy: + registryPoll: + interval: 30m0s + +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: CatalogSource +metadata: + name: opencloud-operators + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "001" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} {{- end }} +spec: + displayName: ibm-cp-common-services-4.17.0 + image: icr.io/cpopen/ibm-common-service-catalog@sha256:de97dd2a35b4c58da9b7ad5d89976d7a4184541e2e0a78a1c71e441a0105ce6e + publisher: IBM + sourceType: grpc + updateStrategy: + registryPoll: + interval: 30m0s + +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: CatalogSource +metadata: + name: ibm-zen-operator-catalog + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "001" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + displayName: ibm-zen-6.4.0-92 + image: icr.io/cpopen/ibm-zen-operator-catalog@sha256:9a02519e5ab679f0807fc5b7cfc5fc96242961bee0e1d3144012d33e925e6a99 + publisher: IBM + sourceType: grpc + updateStrategy: + registryPoll: + interval: 30m0s +{{- end }} +{{- end }} + + + + diff --git a/instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml b/instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml new file mode 100644 index 000000000..ae436acc7 --- /dev/null +++ b/instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml @@ -0,0 +1,677 @@ +{{- if eq .Values.cpd_product_version "5.3.1" }} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: olm-utils-cm + namespace: {{ .Values.cpd_instance_namespace }} + annotations: + argocd.argoproj.io/sync-wave: "00" + labels: + app.kubernetes.io/name: olm-utils +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +data: + licenses_urls: |- + SWHP: + url: "https://ibm.biz/BdbGRu" + description: "IBM Software Hub Premium Cartridge" + SWHAI: + url: "https://ibm.biz/BdbGRL" + description: "IBM Softare Hub AI Assistant Cartridge" + EE: + url: https://ibm.biz/Bdbq3x + description: "IBM Cloud Pak for Data Enterprise Edition" + SE: + url: https://ibm.biz/Bdbq3H + description: "IBM Cloud Pak for Data Standard Edition" + WXAI: + url: https://ibm.biz/BdbKbw + description: "IBM watsonx.ai" + DB2CE: + url: https://ibm.biz/BdnPB7 + description: "IBM Db2 Community Edition" + DB2SE: + url: https://ibm.biz/BdnPdB + description: "IBM Db2 Standard Edition Cartridge for IBM Cloud Pak for Data" + DB2AE: + url: https://ibm.biz/BdnPBW + description: "IBM Db2 Advanced Edition Cartridge for IBM Cloud Pak for Data" + DG: + url: "https://ibm.biz/dg4zos_v320" + description: "IBM Data Gate for z/OS with Cloud Pak for Data" + DGWXD: + url: "https://ibm.biz/dgx_v13" + description: "IBM Data Gate for watsonx" + DGWXDB: + url: "https://ibm.biz/wxd-dgx" + description: "IBM watsonx.data with Data Gate for IBM Z" + DGWXDPB: + url: "https://ibm.biz/wxdprem-dgx111" + description: "IBM watsonx.data Premium with Data Gate for IBM Z" + DGFS: + url: "https://ibm.biz/dg4fs_v13" + description: "IBM Data Gate for Financial Services" + IKCS: + url: https://ibm.biz/Bdmm4V + description: "IBM Knowledge Catalog Standard" + IKCP: + url: https://ibm.biz/Bdmm4J + description: "IBM Knowledge Catalog Premium" + IDRC: + url: https://ibm.biz/BdpHpg + description: "IBM Data Replication Cartridge" + IIDRC: + url: https://ibm.biz/BdpHph + description: "IBM InfoSphere Data Replication Cartridge" + IDRM: + url: https://ibm.biz/BdpHpJ + description: "IBM Data Replication Modernization" + IIDRM: + url: https://ibm.biz/BdpHpA + description: "IBM InfoSphere Data Replication Modernization" + IDRZOS: + url: https://ibm.biz/BdpHp9 + description: "IBM Data Replication for Db2 z/OS Cartridge" + IIDRWXTO: + url: https://ibm.biz/BdpHpu + description: "IBM InfoSphere Data Replication for watsonx.data Cartridge" + IIDRWXAO: + url: https://ibm.biz/BdpHpL + description: "IBM InfoSphere Data Replication Cartridge Add-on for IBM watsonx.data" + WXD: + url: https://ibm.biz/BdpdBF + description: "IBM watsonx.data" + WXDP: + url: https://ibm.biz/BdpzEx + description: "IBM watsonx.data Premium Edition" + WCA: + url: https://ibm.biz/Bdbv9x + description: "IBM watsonx Code Assistant" + WCAA: + url: https://ibm.biz/Bdbv9D + description: "IBM watsonx Code Assistant for Red Hat Ansible Lightspeed" + DPH: + url: https://ibm.biz/BdbQMv + description: "IBM Data Product Hub" + + release_components_meta: |- + scheduler: + case_version: 1.61.0 + sub_channel: "v1.61" + csv_version: 1.61.0 + cr_version: 1.61.0 + + cpfs: + csv_version: 4.17.0 + case_version: 4.17.0 + sub_channel: "v4.17" + + ibm-common-service-operator: + cr_version: 4.17.0 + + ibm-iam-operator: + cr_version: 4.16.0 + + ibm-namespace-scope-operator: + cr_version: 4.3.4 + + ibm-cert-manager: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_events_operator: + case_version: 6.0.0 + sub_channel: "v6.0" + csv_version: 6.0.0 + cr_version: 4.1.1 + + streamsets: + case_version: 9.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-streamsets-sdi: + case_version: 2.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-licensing: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_usage_metering: + case_version: 1.0.4 + csv_version: 1.0.4 + sub_channel: "v1.0" + cr_version: 1.0.4 + + cpd_platform: + case_version: 5.4.0 + csv_version: 6.4.0 + sub_channel: "v6.4" + cr_version: 5.4.0 + + platform-config: + cr_version: 5.4.0 + + ibm_swhcc: + case_version: 5.4.0 + csv_version: 5.4.0 + sub_channel: "v5.4" + cr_version: 5.4.0 + + zen: + case_version: 6.4.0 + sub_channel: "v6.4" + csv_version: 6.4.0 + cr_version: 6.4.0 + + analyticsengine: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + cognos_analytics: + case_version: 29.1.0 + sub_channel: "v29.1" + cr_version: 29.1.0 + csv_version: 29.1.0 + + ccs: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + dashboard: + case_version: 4.0.0 + sub_channel: "v4.0" + csv_version: 4.0.0 + cr_version: 5.3.0 + + datarefinery: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: "v12.1" + cr_version: 12.1.0 + + canvasbase: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + spss: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + syntheticdata: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + datastage_ent: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + datastage_ent_plus: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + informix: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + informix_cp4d: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + openscale: + case_version: 10.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + ws: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + ws_runtimes: + case_version: 12.1.0 + cr_version: 12.1.0 + + db2aaservice: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2oltp: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2wh: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2u: + case_version: 7.5.2 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + datagate: + case_version: 11.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 9.1.0 + + dods: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + hee: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + dv: + case_version: 8.1.0 + sub_channel: "v8.1" + csv_version: 8.1.0 + cr_version: 3.3.1 + + bigsql: + case_version: 14.1.0 + sub_channel: "v14.1" + csv_version: 14.1.0 + cr_version: 8.3.1 + + planning_analytics: + case_version: 5.3.1 + sub_channel: "v11.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + rstudio: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + watson_assistant: + case_version: 5.11.0 + sub_channel: "v5.11" + csv_version: 5.11.0 + cr_version: "5.3.1" + + watson_discovery: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + watson_speech: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + wkc: + case_version: 5.3.1 + sub_channel: "v9.1" + csv_version: 2.3.1 + cr_version: 5.3.1 + + ikc_standard: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + ikc_premium: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + datalineage: + case_version: 5.3.1 + sub_channel: "v7.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + udp: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster: + case_version: 9.1.0 + csv_version: 9.1.0 + sub_channel: "v9.1" + cr_version: 9.1.0 + + dataproduct: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + semantic_automation: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster_instance: + cr_version: 9.1.0 + + dp: + case_version: 11.1.0 + csv_version: 11.1.0 + sub_channel: "v11.1" + cr_version: 5.3.1 + + wml: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + dmc: + case_version: 8.11.0 + csv_version: 5.11.0 + cr_version: 5.3.1 + sub_channel: "v5.11" + + openpages: + case_version: 10.1.0 + csv_version: 10.1.0 + cr_version: 9.7.0 + sub_channel: "v10.1" + + openpages_instance: + cr_version: 9.7.0 + + mantaflow: + case_version: 2.4.0 + csv_version: 2.4.0 + sub_channel: "v2.4" + cr_version: 42.15.0 + + match360: + case_version: 4.11.0 + csv_version: 4.11.0 + cr_version: 4.11.50 + sub_channel: "v4.11" + + model_gateway: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + opencontent_opensearch: + case_version: 1.2.0 + csv_version: 1.2.0 + cr_version: 1.2.0 + sub_channel: "v1.1" + + opencontent_redis: + case_version: 1.6.11 + csv_version: 1.6.11 + sub_channel: "v1.6" + + ibm_redis_cp: + case_version: 1.3.1 + csv_version: 1.3.1 + sub_channel: "v1.3" + cr_version: 1.3.1 + + opencontent_rabbitmq: + case_version: 1.3.0 + csv_version: 1.3.0 + sub_channel: "v1.0" + cr_version: 1.3.0 + + opencontent_fdb: + case_version: 5.3.1 + csv_version: 5.3.1 + cr_version: 5.3.1 + sub_channel: "v5.3" + + fdb_k8s: + csv_version: 5.3.1 + sub_channel: "v5.3" + + opencontent_minio: + case_version: 1.0.23 + csv_version: 1.0.18 + + opencontent_etcd: + case_version: 2.0.57 + csv_version: 1.0.47 + + opencontent_auditwebhook: + case_version: 1.0.24 + csv_version: 0.3.1 + + watson_gateway: + case_version: 2.2.0 + csv_version: 2.2.0 + cr_version: 2.2.0 + + data_governor: + case_version: 8.1.0 + csv_version: 8.1.0 + sub_channel: v8.1 + cr_version: 3.29.4 + + ws_pipelines: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 5.3.1 + + postgresql: + case_version: 5.31.0 + sub_channel: "stable-v1.25" + csv_version: 1.25.5 + cr_version: 1.25.5 + + edb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + mongodb: + case_version: 5.31.0 + sub_channel: "stable" + csv_version: 1.33.0 + cr_version: 5.31.0 + + mongodb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + dpra: + deprecated: true + case_version: 1.20.0 + sub_channel: "v1.20" + csv_version: 1.20.0 + cr_version: 1.20.0 + + factsheet: + case_version: 7.1.0 + csv_version: 7.1.0 + sub_channel: "v7.1" + cr_version: 5.3.1 + + replication: + case_version: 5.3.1 + csv_version: 7.1.0 + cr_version: 5.3.1 + sub_channel: "v7.1" + + voice_gateway: + case_version: 1.13.0 + csv_version: 1.13.0 + sub_channel: v1.13 + cr_version: 1.13.0 + + watsonx_data: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + watsonx_data_premium: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + wxd_query_optimizer: + component_dependencies: + - db2u + + watsonx_ai: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + osai_min_version: 2.19.0 + + watsonx_ai_ifm: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + + watsonx_bi_assistant: + case_version: 3.4.0 + csv_version: 3.4.0 + sub_channel: v3.4 + cr_version: 3.4.0 + + wca_ansible: + case_version: 4.1.0 + cr_version: 5.3.1 + + wca: + case_version: 3.1.0 + cr_version: 5.3.1 + + wca_z: + case_version: 4.1.0 + csv_version: 4.1.0 + sub_channel: v4.0 + cr_version: 5.3.1 + + wca_z_agentic: + case_version: 2.0.1 + csv_version: 2.0.1 + sub_channel: v2.1 + cr_version: 2.7.1 + + wca_z_ce: + case_version: 5.3.1 + sub_channel: v2.8 + csv_version: 2.8.10 + cr_version: 2.8.10 + + wca_z_cg: + case_version: 5.3.1 + sub_channel: v1.1 + csv_version: 1.1.1 + cr_version: 2.8.10 + + wca_base: + case_version: 4.1.0 + cr_version: 5.3.1 + + ibm_neo4j: + case_version: 1.3.1 + sub_channel: "v4.1" + csv_version: 1.3.1 + cr_version: 1.3.1 + + watsonx_governance: + case_version: 5.1.0 + sub_channel: "v5.1" + csv_version: 5.1.0 + cr_version: 2.3.1 + + watsonx_orchestrate: + case_version: 7.1.0 + sub_channel: "v7.1" + csv_version: 7.1.0 + cr_version: "7.1.0" + + watsonx_dataintegration: + case_version: 2.4.0 + sub_channel: "v2.4" + csv_version: 5.3.1 + cr_version: 2.3.1 + + watsonx_dataintelligence: + case_version: 2.3.1 + sub_channel: "v2.31" + csv_version: 2.3.1 + cr_version: 2.3.1 + + wca_z_understand: + case_version: 1.1.0 + csv_version: 1.1.0 + sub_channel: v1.1 + cr_version: 2.8.10 + + ibm-databand: + case_version: 1.0.0 + csv_version: 1.0.0 + cr_version: 1.0.0 + sub_channel: "v1.0.0" + + datastax_mc: + case_version: 1.16.1 + cr_version: 1.16.1 + + ibm_wxd_opensearch: + case_version: 3.3.2 + cr_version: 3.3.2 + release_version: 5.3.1 +{{- end }} + + diff --git a/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml b/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml index 980b17c49..b76edaa92 100644 --- a/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml @@ -4,6 +4,7 @@ {{- /* Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. */}} + {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} # From b7eb0941a2af1814aac1be368e318b2d23739556 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Wed, 22 Jul 2026 14:51:08 +0530 Subject: [PATCH 002/115] [minor] Fix CatalogSources template - add CPD 5.3.1 block (MASCORE-15507) --- .../templates/01-ibm-cp4d-CatalogSources.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml b/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml index 499b3ad64..8c0985a57 100644 --- a/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml +++ b/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml @@ -293,7 +293,7 @@ spec: registryPoll: interval: 30m0s {{- end }} -{{- end }} + # cpd 5.3.1 catalog sources From 8c99760df4aad462d42acad2200820fd2722d8b4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 28 Jul 2026 12:15:53 +0530 Subject: [PATCH 003/115] For CPD 5.3.1 services are installed via Helm --- .../templates/00-ibm-spark_Subscription.yaml | 3 +- .../templates/01-ibm-spark-cr.yaml | 7 ++ .../120-ibm-spark/values.yaml | 1 + .../templates/00-ibm-spss_Subscription.yaml | 2 + .../templates/01-ibm-spss-cr.yaml | 10 ++- .../120-ibm-spss/values.yaml | 1 + .../templates/01-ibm-wml_Subscription.yaml | 2 + .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 7 ++ instance-applications/120-ibm-wml/values.yaml | 1 + .../templates/00-ibm-wsl_Subscription.yaml | 22 ++++++ .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 71 +++++++++++++++++++ 11 files changed, 124 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml index 598d60619..99918936a 100644 --- a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml +++ b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,4 +17,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.spark_install_plan | default "Automatic" | quote }} - +{{- end }} diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 87a8a32c9..45a3588ed 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: ae.cpd.ibm.com/v1 kind: AnalyticsEngine @@ -22,3 +23,9 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.spark_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +# Spark (Analytics Engine) is installed via ansible-devops cp4d_service role using Helm +# No OLM Subscription or CR is created here for CPD >= 5.3.1 +{{- end }} diff --git a/instance-applications/120-ibm-spark/values.yaml b/instance-applications/120-ibm-spark/values.yaml index d6a766919..25e5c803b 100644 --- a/instance-applications/120-ibm-spark/values.yaml +++ b/instance-applications/120-ibm-spark/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" spark_channel: "" spark_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index dcb608e85..c37c39d91 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -35,3 +36,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.canvasbase_install_plan | default "Automatic" | quote }} +{{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 2869c08f6..f182ecf68 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,4 +1,4 @@ - +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: spssmodeler.cpd.ibm.com/v1 kind: Spss @@ -24,4 +24,10 @@ spec: version: "{{ .Values.spss_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" - wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" \ No newline at end of file + wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +# SPSS Modeler is installed via ansible-devops cp4d_service role using Helm +# No OLM Subscription or CR is created here for CPD >= 5.3.1 +{{- end }} diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml index 51ca216c9..b7c0618d7 100644 --- a/instance-applications/120-ibm-spss/values.yaml +++ b/instance-applications/120-ibm-spss/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" spss_channel: "" spss_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml index 327653732..8b80ea231 100644 --- a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml +++ b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,3 +17,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.wml_install_plan | default "Automatic" | quote }} +{{- end }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index e1e789973..f6e485cb5 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: wml.cpd.ibm.com/v1beta1 kind: WmlBase @@ -22,3 +23,9 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.wml_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +# WML is installed via ansible-devops cp4d_service role using Helm +# No OLM Subscription or CR is created here for CPD >= 5.3.1 +{{- end }} diff --git a/instance-applications/120-ibm-wml/values.yaml b/instance-applications/120-ibm-wml/values.yaml index b5ec6e992..56dedaab2 100644 --- a/instance-applications/120-ibm-wml/values.yaml +++ b/instance-applications/120-ibm-wml/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" wml_channel: "" wml_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index b2556409c..d205eb28b 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -1,3 +1,24 @@ +# --- +# apiVersion: operators.coreos.com/v1alpha1 +# kind: Subscription +# metadata: +# name: ibm-cpd-ws-operator +# namespace: "{{ .Values.cpd_operators_namespace }}" +# annotations: +# argocd.argoproj.io/sync-wave: "090" +# {{- if .Values.custom_labels }} +# labels: +# {{ .Values.custom_labels | toYaml | indent 4 }} +# {{- end }} +# spec: +# name: ibm-cpd-wsl +# channel: "{{ .Values.wsl_channel }}" +# source: ibm-operator-catalog +# sourceNamespace: openshift-marketplace +# installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} + + +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,3 +37,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} +{{- end }} \ No newline at end of file diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 11c9d89a3..a37ce5f29 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -1,3 +1,33 @@ +# --- +# apiVersion: ws.cpd.ibm.com/v1beta1 +# kind: WS +# metadata: +# name: "ws-cr" +# namespace: "{{ .Values.cpd_instance_namespace }}" +# annotations: +# argocd.argoproj.io/sync-wave: "091" +# argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +# {{- if .Values.custom_labels }} +# labels: +# {{ .Values.custom_labels | toYaml | indent 4 }} +# {{- end }} +# spec: +# imagePullSecret: ibm-entitlement-key +# ignoreForMaintenance: false +# license: +# accept: true +# license: Standard +# scaleConfig: "{{ .Values.cpd_service_scale_config }}" +# fileStorageClass: "{{ .Values.cpd_service_storage_class }}" +# blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" +# version: "{{ .Values.wsl_version }}" +# ccs_operand_version: "{{ .Values.ccs_version }}" +# datarefinery_operand_version: "{{ .Values.datarefinery_version }}" +# wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" + + + +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: ws.cpd.ibm.com/v1beta1 kind: WS @@ -24,3 +54,44 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +apiVersion: batch/v1 +kind: Job +metadata: + name: install-wsl-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: quay.io/ibmmas/cli:latest + command: + - /bin/sh + - -c + - | + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + helm upgrade --install wsl ibm-charts/wsl \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set ws.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 30m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 +{{- end }} \ No newline at end of file From 31562eb6cf21d71e14f6267bea9d0513c214ca01 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 28 Jul 2026 16:19:48 +0530 Subject: [PATCH 004/115] MASCORE-15507: Fix WSL Helm Job - install deps in sequence; add Helm Jobs for WML, Spark, SPSS --- .../templates/01-ibm-spark-cr.yaml | 39 ++++- .../templates/01-ibm-spss-cr.yaml | 39 ++++- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 39 ++++- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 136 +++++++++++++++--- 4 files changed, 231 insertions(+), 22 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 45a3588ed..eecc35568 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -26,6 +26,41 @@ spec: {{- else }} --- # Helm-based installation for CPD 5.3.1+ -# Spark (Analytics Engine) is installed via ansible-devops cp4d_service role using Helm -# No OLM Subscription or CR is created here for CPD >= 5.3.1 +apiVersion: batch/v1 +kind: Job +metadata: + name: install-spark-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: quay.io/ibmmas/cli:latest + command: + - /bin/sh + - -c + - | + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + helm upgrade --install analyticsengine ibm-charts/analyticsengine \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set analyticsengine.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 30m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 {{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index f182ecf68..ba9b5ec61 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -28,6 +28,41 @@ spec: {{- else }} --- # Helm-based installation for CPD 5.3.1+ -# SPSS Modeler is installed via ansible-devops cp4d_service role using Helm -# No OLM Subscription or CR is created here for CPD >= 5.3.1 +apiVersion: batch/v1 +kind: Job +metadata: + name: install-spss-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: quay.io/ibmmas/cli:latest + command: + - /bin/sh + - -c + - | + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + helm upgrade --install spss-modeler ibm-charts/spss-modeler \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set spssmodeler.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 30m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 {{- end }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index f6e485cb5..dc4849977 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -26,6 +26,41 @@ spec: {{- else }} --- # Helm-based installation for CPD 5.3.1+ -# WML is installed via ansible-devops cp4d_service role using Helm -# No OLM Subscription or CR is created here for CPD >= 5.3.1 +apiVersion: batch/v1 +kind: Job +metadata: + name: install-wml-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: quay.io/ibmmas/cli:latest + command: + - /bin/sh + - -c + - | + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + helm upgrade --install wml ibm-charts/wml \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set wml.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 30m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 {{- end }} diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index a37ce5f29..2d4ceb0a7 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -57,6 +57,9 @@ spec: {{- else }} --- # Helm-based installation for CPD 5.3.1+ +# Installs WSL and all its dependencies (opensearch, ccs, datarefinery, ws-runtimes) +# using IBM Helm charts. Each component requires a cluster-scoped chart (CRDs/ClusterRoles) +# followed by a namespace-scoped chart (Operator + CR). apiVersion: batch/v1 kind: Job metadata: @@ -76,22 +79,123 @@ spec: - /bin/sh - -c - | - helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + set -e + + HELM_REPO=ibm-charts + HELM_REPO_URL=https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + OPERATORS_NS={{ .Values.cpd_operators_namespace }} + INSTANCE_NS={{ .Values.cpd_instance_namespace }} + FILE_SC={{ .Values.cpd_service_storage_class }} + BLOCK_SC={{ .Values.cpd_service_block_storage_class }} + SCALE={{ .Values.cpd_service_scale_config }} + CPD_VERSION={{ .Values.cpd_product_version }} + PULL_SECRET=ibm-entitlement-key + + echo "================================================================" + echo "Adding IBM Helm repository" + echo "================================================================" + helm repo add ${HELM_REPO} ${HELM_REPO_URL} || true helm repo update - helm upgrade --install wsl ibm-charts/wsl \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --set ws.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 30m + + # Shared values file used by all components + cat > /tmp/cpd-global-values.yaml << EOF + global: + licenseAccept: true + releaseVersion: ${CPD_VERSION} + operatorNamespace: ${OPERATORS_NS} + instanceNamespace: ${INSTANCE_NS} + fileStorageClass: ${FILE_SC} + blockStorageClass: ${BLOCK_SC} + imagePullSecret: ${PULL_SECRET} + imagePullPrefix: cp.icr.io + EOF + + install_component() { + local NAME=$1 + local CHART=$2 + local CLUSTER_CHART=$3 + local VERSION=$4 + local EXTRA_VALUES=$5 + + echo "================================================================" + echo "Installing ${NAME} (version ${VERSION})" + echo "================================================================" + + # 1. Cluster-scoped chart (CRDs, ClusterRoles) + echo " [${NAME}] Installing cluster-scoped chart..." + helm template ${NAME}-cluster ${HELM_REPO}/${CLUSTER_CHART} \ + --version ${VERSION} \ + -f /tmp/cpd-global-values.yaml \ + --namespace ${OPERATORS_NS} | oc apply -f - + + # 2. Namespace-scoped chart (Operator + CR) + echo " [${NAME}] Installing namespace-scoped chart..." + helm upgrade --install ${NAME} ${HELM_REPO}/${CHART} \ + --version ${VERSION} \ + -f /tmp/cpd-global-values.yaml \ + ${EXTRA_VALUES} \ + --namespace ${INSTANCE_NS} \ + --create-namespace \ + --wait --timeout 60m + } + + # ---------------------------------------------------------------- + # Step 1: OpenSearch (dependency) + # ---------------------------------------------------------------- + install_component \ + "opencontent-opensearch" \ + "opencontent-opensearch" \ + "opencontent-opensearch-cluster-scoped" \ + "1.2.0" + + # ---------------------------------------------------------------- + # Step 2: CCS - Common Core Services (dependency) + # ---------------------------------------------------------------- + install_component \ + "ccs" \ + "ccs" \ + "ccs-cluster-scoped" \ + "12.1.0" \ + "--set ccs.scaleConfig=${SCALE}" + + # Wait for CCS CR to be ready + echo "Waiting for CCS CR to be ready..." + oc wait ccs/ccs-cr -n ${INSTANCE_NS} \ + --for=jsonpath='{.status.controlPlaneStatus}'=Completed \ + --timeout=60m + + # ---------------------------------------------------------------- + # Step 3: DataRefinery (dependency) + # ---------------------------------------------------------------- + install_component \ + "datarefinery" \ + "datarefinery" \ + "datarefinery-cluster-scoped" \ + "12.1.0" + + # ---------------------------------------------------------------- + # Step 4: WS Runtimes (dependency) + # ---------------------------------------------------------------- + install_component \ + "ws-runtimes" \ + "ws-runtimes" \ + "ws-runtimes-cluster-scoped" \ + "12.1.0" + + # ---------------------------------------------------------------- + # Step 5: Watson Studio (main component) + # ---------------------------------------------------------------- + install_component \ + "wsl" \ + "ws" \ + "ws-cluster-scoped" \ + "12.1.0" \ + "--set ws.scaleConfig=${SCALE}" + + echo "================================================================" + echo "WSL installation complete" + echo "================================================================" restartPolicy: Never serviceAccountName: cpd-sa - backoffLimit: 2 -{{- end }} \ No newline at end of file + backoffLimit: 1 +{{- end }} From 2b6f7b44c8c575b627e62b2e6222a83af6373796 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 28 Jul 2026 19:06:59 +0530 Subject: [PATCH 005/115] MASCORE-15507: Pass cpd_product_version to WSL, Spark, SPSS ArgoCD Applications --- .../ibm-mas-instance-root/templates/120-ibm-spark-app.yaml | 1 + .../ibm-mas-instance-root/templates/120-ibm-spss-app.yaml | 1 + .../ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml | 1 + 3 files changed, 3 insertions(+) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml index d3edd8787..cfee55a4c 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml @@ -48,6 +48,7 @@ spec: application_admin_role: {{ .Values.application_admin_role }} ccs_version: "{{ .Values.ibm_spark.ccs_version }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_service_block_storage_class: "{{ .Values.ibm_spark.cpd_service_block_storage_class }}" cpd_service_scale_config: "{{ .Values.ibm_spark.cpd_service_scale_config }}" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index 5f16e9abe..c312d6053 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -47,6 +47,7 @@ spec: sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" cpd_service_storage_class: "{{ .Values.ibm_spss.cpd_service_storage_class }}" cpd_service_block_storage_class: "{{ .Values.ibm_spss.cpd_service_block_storage_class }}" cpd_service_scale_config: "{{ .Values.ibm_spss.cpd_service_scale_config }}" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index d770e7365..73e710050 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -48,6 +48,7 @@ spec: sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" cpd_service_storage_class: "{{ .Values.ibm_wsl.cpd_service_storage_class }}" cpd_service_block_storage_class: "{{ .Values.ibm_wsl.cpd_service_block_storage_class }}" cpd_service_scale_config: "{{ .Values.ibm_wsl.cpd_service_scale_config }}" From 326fe687908f220f2bc43a6641e704c9a7f8e0a4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 28 Jul 2026 20:41:30 +0530 Subject: [PATCH 006/115] MASCORE-15507: Fix heredoc in WSL Helm Job - use printf to avoid YAML/shell conflict --- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 2d4ceb0a7..d2e4e63f9 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -98,17 +98,9 @@ spec: helm repo update # Shared values file used by all components - cat > /tmp/cpd-global-values.yaml << EOF - global: - licenseAccept: true - releaseVersion: ${CPD_VERSION} - operatorNamespace: ${OPERATORS_NS} - instanceNamespace: ${INSTANCE_NS} - fileStorageClass: ${FILE_SC} - blockStorageClass: ${BLOCK_SC} - imagePullSecret: ${PULL_SECRET} - imagePullPrefix: cp.icr.io - EOF + printf 'global:\n licenseAccept: true\n releaseVersion: %s\n operatorNamespace: %s\n instanceNamespace: %s\n fileStorageClass: %s\n blockStorageClass: %s\n imagePullSecret: %s\n imagePullPrefix: cp.icr.io\n' \ + "${CPD_VERSION}" "${OPERATORS_NS}" "${INSTANCE_NS}" "${FILE_SC}" "${BLOCK_SC}" "${PULL_SECRET}" \ + > /tmp/cpd-global-values.yaml install_component() { local NAME=$1 From e8f2c0f052fdaa85d14d6a910313b18db08c2449 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 30 Jul 2026 16:35:26 +0530 Subject: [PATCH 007/115] Fix semver comparison - use toString to handle unquoted cpd_product_version value --- .../120-ibm-spark/templates/00-ibm-spark_Subscription.yaml | 2 +- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 2 +- .../120-ibm-spss/templates/00-ibm-spss_Subscription.yaml | 2 +- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- .../120-ibm-wml/templates/01-ibm-wml_Subscription.yaml | 2 +- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- .../120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml | 2 +- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml index 99918936a..f76f473ca 100644 --- a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml +++ b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index eecc35568..e12e2b3a3 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: ae.cpd.ibm.com/v1 kind: AnalyticsEngine diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index c37c39d91..87ad8ae35 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index ba9b5ec61..a88dc3343 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: spssmodeler.cpd.ibm.com/v1 kind: Spss diff --git a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml index 8b80ea231..fd899c668 100644 --- a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml +++ b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index dc4849977..64ea9fa2a 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: wml.cpd.ibm.com/v1beta1 kind: WmlBase diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index d205eb28b..b667f0b8e 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -18,7 +18,7 @@ # installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index d2e4e63f9..91f9b59df 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -27,7 +27,7 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: ws.cpd.ibm.com/v1beta1 kind: WS From 892f5f0ec2a3676964e056b2640fe50318182cc4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 11:24:51 +0530 Subject: [PATCH 008/115] MASCORE-15507: skip OLM CCS/OpenSearch post-sync patching for CPD 5.3.1+ --- .../templates/01-cpd-service-post-ops.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml b/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml index 8aebe3f14..810599109 100644 --- a/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml +++ b/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml @@ -247,6 +247,15 @@ spec: echo $(( $V1 - $V2 )) } + # For CPD 5.3.1+, CCS and OpenSearch are installed via Helm (not OLM). + # The CCS CR and OpenSearch CR managed by this post-sync job do not exist + # in that deployment model, so skip all OLM-specific post-sync patching. + COMP_531=$(compare_versions ${CPD_PRODUCT_VERSION} 5.3.1) + if [[ ${COMP_531} -ge 0 ]]; then + echo "CPD ${CPD_PRODUCT_VERSION} detected (>= 5.3.1) - CCS/OpenSearch installed via Helm, skipping OLM post-sync patching" + exit 0 + fi + echo echo "================================================================================" echo "Wait for CCS Cr to be ready and patch if needed" From 7a99311d2d0d5b8732ebf914d0dd109077c56f68 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 12:08:24 +0530 Subject: [PATCH 009/115] MASCORE-15507: bump job version to v2 to force new job name after script change --- .../templates/01-cpd-service-post-ops.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml b/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml index 810599109..556806533 100644 --- a/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml +++ b/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml @@ -25,7 +25,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v1" }} +{{- $_job_version := "v2" }} {{- /* 10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest From 675a87c4b76045e9305cf435b08e5d778fa9e5d5 Mon Sep 17 00:00:00 2001 From: Nikita Kumble Date: Fri, 31 Jul 2026 14:28:16 +0530 Subject: [PATCH 010/115] minor update --- .../120-ibm-db2u-database/files/PostBackFlow.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh index 90d87d308..18a94ef57 100755 --- a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh +++ b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh @@ -5,7 +5,7 @@ INSTOWNER=`/usr/local/bin/db2greg -dump | grep -ae "I," | grep -v "/das," | awk # Find the home directory INSTHOME=` cat /etc/passwd | grep ${INSTOWNER} | cut -d: -f6` -DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep MANA | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` +DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep -E "MANA|FACI" | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` SCRIPT=/mnt/backup/bin/PostBF_Scripts.sh echo "db2 connect to bludb" > ${SCRIPT} From 647900b8d0367d43b2fc4d0f82fdeb8e1587df26 Mon Sep 17 00:00:00 2001 From: Nikita Kumble Date: Fri, 31 Jul 2026 14:47:10 +0530 Subject: [PATCH 011/115] changes undo --- .../120-ibm-db2u-database/files/PostBackFlow.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh index 18a94ef57..90d87d308 100755 --- a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh +++ b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh @@ -5,7 +5,7 @@ INSTOWNER=`/usr/local/bin/db2greg -dump | grep -ae "I," | grep -v "/das," | awk # Find the home directory INSTHOME=` cat /etc/passwd | grep ${INSTOWNER} | cut -d: -f6` -DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep -E "MANA|FACI" | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` +DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep MANA | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` SCRIPT=/mnt/backup/bin/PostBF_Scripts.sh echo "db2 connect to bludb" > ${SCRIPT} From 413dd4e80e5627813b8d59be0ddebf8e6e908658 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 17:19:48 +0530 Subject: [PATCH 012/115] MASCORE-15507: gate CCS/datarefinery/ws-runtimes OLM subscriptions behind < 5.3.1 --- .../110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml index 4a90cf334..cb0ec381b 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml @@ -146,6 +146,7 @@ spec: backoffLimit: 4 +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} {{- if or .Values.wml_channel .Values.wsl_channel .Values.spss_channel }} --- apiVersion: operators.coreos.com/v1alpha1 @@ -246,3 +247,4 @@ spec: {{- end }} {{- end }} +{{- end }} From 0da19330a84e3953b1f37f376ba59c235cf475a2 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 19:37:37 +0530 Subject: [PATCH 013/115] MASCORE-15507: fix semver comparison syntax - use .Compare pattern instead of lt(semver,semver) --- .../120-ibm-spark/templates/00-ibm-spark_Subscription.yaml | 2 +- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 2 +- .../120-ibm-spss/templates/00-ibm-spss_Subscription.yaml | 2 +- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- .../120-ibm-wml/templates/01-ibm-wml_Subscription.yaml | 2 +- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- .../120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml | 2 +- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml index f76f473ca..392b67cf3 100644 --- a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml +++ b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index e12e2b3a3..77884e561 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: ae.cpd.ibm.com/v1 kind: AnalyticsEngine diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index 87ad8ae35..d54dac607 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index a88dc3343..df3319f9b 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: spssmodeler.cpd.ibm.com/v1 kind: Spss diff --git a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml index fd899c668..01f75abbd 100644 --- a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml +++ b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 64ea9fa2a..4bad95c3c 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: wml.cpd.ibm.com/v1beta1 kind: WmlBase diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index b667f0b8e..2f30520a5 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -18,7 +18,7 @@ # installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 91f9b59df..08f0935b6 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -27,7 +27,7 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: ws.cpd.ibm.com/v1beta1 kind: WS From 6ed6801afb9c3b95b69efe2d4173caa16a768fed Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 20:55:45 +0530 Subject: [PATCH 014/115] MASCORE-15507: install cluster-scoped chart first to register CRDs before namespace-scoped helm install --- .../templates/01-ibm-spark-cr.yaml | 29 +++++++++++++++++++ .../templates/01-ibm-spss-cr.yaml | 29 +++++++++++++++++++ .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 29 +++++++++++++++++++ 3 files changed, 87 insertions(+) diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 77884e561..694550523 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -45,8 +45,37 @@ spec: - /bin/sh - -c - | + set -e helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm helm repo update + + echo "Installing analyticsengine cluster-scoped chart (CRDs + ClusterRoles)..." + helm template analyticsengine-cluster ibm-charts/analyticsengine-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for analyticsengines.ae.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd analyticsengines.ae.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing analyticsengine namespace-scoped chart (operator + CR)..." helm upgrade --install analyticsengine ibm-charts/analyticsengine \ --version 12.1.0 \ --namespace {{ .Values.cpd_instance_namespace }} \ diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index df3319f9b..465f04217 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -47,8 +47,37 @@ spec: - /bin/sh - -c - | + set -e helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm helm repo update + + echo "Installing spss-modeler cluster-scoped chart (CRDs + ClusterRoles)..." + helm template spss-modeler-cluster ibm-charts/spss-modeler-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for spssmodelers.spssmodeler.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd spssmodelers.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing spss-modeler namespace-scoped chart (operator + CR)..." helm upgrade --install spss-modeler ibm-charts/spss-modeler \ --version 12.1.0 \ --namespace {{ .Values.cpd_instance_namespace }} \ diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 4bad95c3c..8c2be0a27 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -45,8 +45,37 @@ spec: - /bin/sh - -c - | + set -e helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm helm repo update + + echo "Installing wml cluster-scoped chart (CRDs + ClusterRoles)..." + helm template wml-cluster ibm-charts/wml-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for wmlbases.wml.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd wmlbases.wml.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing wml namespace-scoped chart (operator + CR)..." helm upgrade --install wml ibm-charts/wml \ --version 12.1.0 \ --namespace {{ .Values.cpd_instance_namespace }} \ From b7e2f54bc5a3e13aa044fa5759235d3eb85e5103 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 21:16:55 +0530 Subject: [PATCH 015/115] MASCORE-15507: grant cpd-sa cluster-level CRD/ClusterRole permissions for Helm 5.3.1+ installs --- .../templates/02-ibm-cp4d_rbac.yaml | 85 +++++++++++++++++++ 1 file changed, 85 insertions(+) diff --git a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml index 7797ff419..20f5db2fe 100644 --- a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml +++ b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml @@ -1526,3 +1526,88 @@ roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: admin + +{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0) }} +--- +# For CPD 5.3.1+, cpd-sa needs cluster-level permissions to apply CRDs and +# ClusterRoles from the Helm cluster-scoped charts during service installation. +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: "cpd-sa-helm-cluster-role-{{ .Values.instance_id }}" + annotations: + argocd.argoproj.io/sync-wave: "084" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +rules: + - verbs: + - get + - list + - create + - update + - patch + - delete + apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + - verbs: + - get + - list + - create + - update + - patch + - delete + apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + - verbs: + - get + - list + apiGroups: + - "" + resources: + - namespaces + - nodes + - verbs: + - get + - list + apiGroups: + - config.openshift.io + resources: + - clusterversions + - infrastructures + - verbs: + - use + apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - anyuid + - restricted + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: "cpd-sa-helm-cluster-rb-{{ .Values.instance_id }}" + annotations: + argocd.argoproj.io/sync-wave: "085" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +subjects: + - kind: ServiceAccount + name: cpd-sa + namespace: "{{ .Values.cpd_operators_namespace }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: "cpd-sa-helm-cluster-role-{{ .Values.instance_id }}" +{{- end }} From 846e49e0554f4c12d1a03c79fee7c943b7af2b75 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 22:32:54 +0530 Subject: [PATCH 016/115] MASCORE-15507: expand cpd-sa ClusterRole with escalate, roles, CPD API groups for Helm install --- .../templates/02-ibm-cp4d_rbac.yaml | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml index 20f5db2fe..2c8d3d747 100644 --- a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml +++ b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml @@ -1542,6 +1542,7 @@ metadata: {{ .Values.custom_labels | toYaml | indent 4 }} {{- end }} rules: + # CRD management (needed to apply cluster-scoped Helm charts) - verbs: - get - list @@ -1553,6 +1554,7 @@ rules: - apiextensions.k8s.io resources: - customresourcedefinitions + # ClusterRole/Binding management with escalate (allows granting permissions not yet held) - verbs: - get - list @@ -1560,11 +1562,28 @@ rules: - update - patch - delete + - bind + - escalate apiGroups: - rbac.authorization.k8s.io resources: - clusterroles - clusterrolebindings + # Namespaced roles/rolebindings (needed by Helm namespace-scoped charts) + - verbs: + - get + - list + - create + - update + - patch + - delete + - watch + apiGroups: + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + # Namespace/node read - verbs: - get - list @@ -1573,6 +1592,7 @@ rules: resources: - namespaces - nodes + # OpenShift infra - verbs: - get - list @@ -1581,6 +1601,7 @@ rules: resources: - clusterversions - infrastructures + # SCCs - verbs: - use apiGroups: @@ -1590,6 +1611,41 @@ rules: resourceNames: - anyuid - restricted + - nonroot + - privileged + # CPD service API groups (needed to grant these permissions in cluster-scoped ClusterRoles) + - verbs: + - get + - list + - create + - update + - patch + - delete + - watch + apiGroups: + - ae.cpd.ibm.com + - wml.cpd.ibm.com + - spssmodeler.cpd.ibm.com + - ws.cpd.ibm.com + - ccs.cpd.ibm.com + - opensearch.cloudpackopen.ibm.com + - datarefinery.cpd.ibm.com + - wsruntimes.cpd.ibm.com + resources: + - "*" + # Webhook configs (needed by some Helm charts) + - verbs: + - get + - list + - create + - update + - patch + - delete + apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations --- kind: ClusterRoleBinding From 9c91cf793257e2343d5a10723b81ca2b2d1d47dd Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 23:48:54 +0530 Subject: [PATCH 017/115] MASCORE-15507: pin cli image to digest instead of :latest in Helm install jobs --- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 2 +- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 694550523..8dda22647 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -40,7 +40,7 @@ spec: spec: containers: - name: helm-install - image: quay.io/ibmmas/cli:latest + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 command: - /bin/sh - -c diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 465f04217..47612cb8b 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -42,7 +42,7 @@ spec: spec: containers: - name: helm-install - image: quay.io/ibmmas/cli:latest + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 command: - /bin/sh - -c diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 8c2be0a27..b8f7e5236 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -40,7 +40,7 @@ spec: spec: containers: - name: helm-install - image: quay.io/ibmmas/cli:latest + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 command: - /bin/sh - -c diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 08f0935b6..e44e2fea2 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -74,7 +74,7 @@ spec: spec: containers: - name: helm-install - image: quay.io/ibmmas/cli:latest + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 command: - /bin/sh - -c From e410251c2bbfae71166cecf3761b310c882fbcf1 Mon Sep 17 00:00:00 2001 From: Nikita Kumble Date: Mon, 3 Aug 2026 13:12:14 +0530 Subject: [PATCH 018/115] adding temp changes for facilities --- .../120-ibm-db2u-database/files/PostBackFlow.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh index 90d87d308..18a94ef57 100755 --- a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh +++ b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh @@ -5,7 +5,7 @@ INSTOWNER=`/usr/local/bin/db2greg -dump | grep -ae "I," | grep -v "/das," | awk # Find the home directory INSTHOME=` cat /etc/passwd | grep ${INSTOWNER} | cut -d: -f6` -DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep MANA | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` +DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep -E "MANA|FACI" | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` SCRIPT=/mnt/backup/bin/PostBF_Scripts.sh echo "db2 connect to bludb" > ${SCRIPT} From a561f1e92ccb1d073f6c808367ed11d3d2e73382 Mon Sep 17 00:00:00 2001 From: Nikita Kumble Date: Tue, 4 Aug 2026 13:28:52 +0530 Subject: [PATCH 019/115] undone postbackflow.sh script --- .../120-ibm-db2u-database/files/PostBackFlow.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh index 18a94ef57..90d87d308 100755 --- a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh +++ b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh @@ -5,7 +5,7 @@ INSTOWNER=`/usr/local/bin/db2greg -dump | grep -ae "I," | grep -v "/das," | awk # Find the home directory INSTHOME=` cat /etc/passwd | grep ${INSTOWNER} | cut -d: -f6` -DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep -E "MANA|FACI" | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` +DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep MANA | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` SCRIPT=/mnt/backup/bin/PostBF_Scripts.sh echo "db2 connect to bludb" > ${SCRIPT} From 4aa87d7d22dfd534393fc83c09438177e952ca75 Mon Sep 17 00:00:00 2001 From: Adit Yarra Date: Wed, 5 Aug 2026 15:14:25 +0530 Subject: [PATCH 020/115] initial commit --- instance-applications/100-ibm-sls/README.md | 4 ++++ .../100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml | 4 ++++ .../ibm-mas-instance-root/templates/100-ibm-sls-app.yaml | 3 +++ .../ibm-mas-sls-root/templates/100-ibm-sls-app.yaml | 3 +++ .../100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml | 4 ++++ 5 files changed, 18 insertions(+) diff --git a/instance-applications/100-ibm-sls/README.md b/instance-applications/100-ibm-sls/README.md index 78ae3fbec..f0845de86 100644 --- a/instance-applications/100-ibm-sls/README.md +++ b/instance-applications/100-ibm-sls/README.md @@ -69,6 +69,10 @@ ibm_sls: - alias: string crt: string (multiline) + # Pod Templates (optional) + sls_pod_templates: + key: value + # Certificate Authority (optional) internal_certificate_authority: string ``` diff --git a/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml b/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml index b5b8b3aa8..2277794be 100644 --- a/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml +++ b/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml @@ -17,6 +17,10 @@ spec: {{ .Values.mongo_spec | toYaml | indent 4 }} license: accept: true +{{- if not (empty .Values.sls_pod_templates) }} + podTemplates: +{{ .Values.sls_pod_templates | toYaml | indent 4 }} +{{- end }} settings: auth: enforce: true diff --git a/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml b/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml index e1d364f59..e3ce37274 100644 --- a/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml @@ -80,6 +80,9 @@ spec: devops_build_number: "{{ .Values.devops.build_number }}" gitops_version: "{{ .Values.source.revision }}" cli_image_repo: {{ .Values.cli_image_repo }} + {{- if .Values.ibm_sls.sls_pod_templates }} + sls_pod_templates: {{ .Values.ibm_sls.sls_pod_templates | toYaml | nindent 14 }} + {{- end }} {{- if .Values.ibm_sls.internal_certificate_authority }} internal_certificate_authority: "{{ .Values.ibm_sls.internal_certificate_authority }}" {{- end }} diff --git a/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml b/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml index 71c353c2b..d852e67c4 100644 --- a/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml +++ b/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml @@ -78,6 +78,9 @@ spec: devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" devops_build_number: "{{ .Values.devops.build_number }}" gitops_version: "{{ .Values.source.revision }}" + {{- if .Values.ibm_sls_standalone.sls_pod_templates }} + sls_pod_templates: {{ .Values.ibm_sls_standalone.sls_pod_templates | toYaml | nindent 14 }} + {{- end }} {{- if .Values.ibm_sls_standalone.internal_certificate_authority }} internal_certificate_authority: "{{ .Values.ibm_sls_standalone.internal_certificate_authority }}" {{- end }} diff --git a/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml b/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml index 276cbc3f1..3914dc7d8 100644 --- a/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml +++ b/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml @@ -18,6 +18,10 @@ spec: {{ .Values.mongo_spec | toYaml | indent 4 }} license: accept: true +{{- if not (empty .Values.sls_pod_templates) }} + podTemplates: +{{ .Values.sls_pod_templates | toYaml | indent 4 }} +{{- end }} settings: auth: enforce: true From 5bf472cbbc1e2f962d8791b35553834675f86184 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 11:13:45 +0530 Subject: [PATCH 021/115] MASCORE-15507: fix CPD 5.3.1 Helm service install correctness - Gate OperandRegistry/OperandConfig to < 5.3.1 to prevent OLM resource drift when services are installed via Helm - Gate spark-hb-control-plane patch job to < 5.3.1; OLM-managed deployment does not exist in Helm install model - Add CRD establishment wait inside WSL install_component() between cluster-scoped apply and namespace-scoped helm upgrade to prevent race condition - Extend Helm Job --wait timeout from 30m to 60m for WML, SPSS and Spark to match WSL and avoid premature timeout on loaded clusters --- .../09-ibm-cp4d_services_dependencies.yaml | 2 +- .../templates/01-ibm-spark-cr.yaml | 2 +- .../templates/02-ibm-spark-control-plane.yaml | 3 +- .../templates/01-ibm-spss-cr.yaml | 2 +- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 54 +++++++++++++++++++ 6 files changed, 60 insertions(+), 5 deletions(-) diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml index aecaafdef..6a270dcee 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml @@ -1,4 +1,4 @@ -{{- if or .Values.wsl_channel .Values.spss_channel }} +{{- if and (or .Values.wsl_channel .Values.spss_channel) (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0) }} # Custom Operand Registries # ----------------------------------------------------------------------------- --- diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 8dda22647..be1a252fa 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -88,7 +88,7 @@ spec: --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ --set global.imagePullSecret=ibm-entitlement-key \ --set analyticsengine.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 30m + --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 2 diff --git a/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml b/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml index 65d3bf87d..e2c7b5f8a 100644 --- a/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml +++ b/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml @@ -55,6 +55,7 @@ are required here. */}} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- kind: ServiceAccount apiVersion: v1 @@ -165,5 +166,5 @@ spec: restartPolicy: Never serviceAccountName: spark-cp-sa backoffLimit: 4 - +{{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 47612cb8b..6f7c7368a 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -90,7 +90,7 @@ spec: --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ --set global.imagePullSecret=ibm-entitlement-key \ --set spssmodeler.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 30m + --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 2 diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index b8f7e5236..311232e18 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -88,7 +88,7 @@ spec: --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ --set global.imagePullSecret=ibm-entitlement-key \ --set wml.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 30m + --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 2 diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index e44e2fea2..477584a6f 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -120,6 +120,12 @@ spec: -f /tmp/cpd-global-values.yaml \ --namespace ${OPERATORS_NS} | oc apply -f - + # Wait for all CRDs from the cluster-scoped chart to be established + # before running the namespace-scoped chart that depends on them. + echo " [${NAME}] Waiting for CRDs to be established..." + sleep 5 + oc wait crd --all --for=condition=Established --timeout=120s 2>/dev/null || true + # 2. Namespace-scoped chart (Operator + CR) echo " [${NAME}] Installing namespace-scoped chart..." helm upgrade --install ${NAME} ${HELM_REPO}/${CHART} \ @@ -140,6 +146,22 @@ spec: "opencontent-opensearch-cluster-scoped" \ "1.2.0" + echo "Waiting for opensearchclusters.opensearch.cloudpackopen.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd opensearchclusters.opensearch.cloudpackopen.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + # ---------------------------------------------------------------- # Step 2: CCS - Common Core Services (dependency) # ---------------------------------------------------------------- @@ -165,6 +187,22 @@ spec: "datarefinery-cluster-scoped" \ "12.1.0" + echo "Waiting for datarefineries.datarefinery.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd datarefineries.datarefinery.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + # ---------------------------------------------------------------- # Step 4: WS Runtimes (dependency) # ---------------------------------------------------------------- @@ -174,6 +212,22 @@ spec: "ws-runtimes-cluster-scoped" \ "12.1.0" + echo "Waiting for wsruntimes.wsruntimes.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd wsruntimes.wsruntimes.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + # ---------------------------------------------------------------- # Step 5: Watson Studio (main component) # ---------------------------------------------------------------- From cdaa41aa92017136b3cebabf74200722585da5ba Mon Sep 17 00:00:00 2001 From: Adit Date: Thu, 6 Aug 2026 11:45:26 +0530 Subject: [PATCH 022/115] Merge 15507 and 15757 (#520) * Added CPD 5.3.1 gitops support * [minor] Fix CatalogSources template - add CPD 5.3.1 block (MASCORE-15507) * For CPD 5.3.1 services are installed via Helm * MASCORE-15507: Fix WSL Helm Job - install deps in sequence; add Helm Jobs for WML, Spark, SPSS * MASCORE-15507: Pass cpd_product_version to WSL, Spark, SPSS ArgoCD Applications * MASCORE-15507: Fix heredoc in WSL Helm Job - use printf to avoid YAML/shell conflict * Fix semver comparison - use toString to handle unquoted cpd_product_version value * MASCORE-15507: skip OLM CCS/OpenSearch post-sync patching for CPD 5.3.1+ * MASCORE-15507: bump job version to v2 to force new job name after script change * minor update * changes undo * MASCORE-15507: gate CCS/datarefinery/ws-runtimes OLM subscriptions behind < 5.3.1 * MASCORE-15507: fix semver comparison syntax - use .Compare pattern instead of lt(semver,semver) * MASCORE-15507: install cluster-scoped chart first to register CRDs before namespace-scoped helm install * MASCORE-15507: grant cpd-sa cluster-level CRD/ClusterRole permissions for Helm 5.3.1+ installs * MASCORE-15507: expand cpd-sa ClusterRole with escalate, roles, CPD API groups for Helm install * MASCORE-15507: pin cli image to digest instead of :latest in Helm install jobs * adding temp changes for facilities * undone postbackflow.sh script * MASCORE-15507: fix CPD 5.3.1 Helm service install correctness - Gate OperandRegistry/OperandConfig to < 5.3.1 to prevent OLM resource drift when services are installed via Helm - Gate spark-hb-control-plane patch job to < 5.3.1; OLM-managed deployment does not exist in Helm install model - Add CRD establishment wait inside WSL install_component() between cluster-scoped apply and namespace-scoped helm upgrade to prevent race condition - Extend Helm Job --wait timeout from 30m to 60m for WML, SPSS and Spark to match WSL and avoid premature timeout on loaded clusters --------- Co-authored-by: Sakshi Singhroha Co-authored-by: Nikita Kumble --- .../templates/00-ibm-cp4d-olm-531.yaml | 678 ++++++++++++++++++ .../templates/01-ibm-cp4d-CatalogSources.yaml | 72 ++ .../templates/00-ibm-cp4d-olm-531.yaml | 677 +++++++++++++++++ .../templates/02-ibm-cp4d_rbac.yaml | 141 ++++ .../templates/09-ibm-cp4d_services_base.yaml | 2 + .../09-ibm-cp4d_services_dependencies.yaml | 2 +- .../04-db2u-Volatile-Runstats_Cron.yaml | 1 + .../templates/00-ibm-spark_Subscription.yaml | 3 +- .../templates/01-ibm-spark-cr.yaml | 71 ++ .../templates/02-ibm-spark-control-plane.yaml | 3 +- .../120-ibm-spark/values.yaml | 1 + .../templates/00-ibm-spss_Subscription.yaml | 2 + .../templates/01-ibm-spss-cr.yaml | 74 +- .../120-ibm-spss/values.yaml | 1 + .../templates/01-ibm-wml_Subscription.yaml | 2 + .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 71 ++ instance-applications/120-ibm-wml/values.yaml | 1 + .../templates/00-ibm-wsl_Subscription.yaml | 22 + .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 221 ++++++ .../templates/01-cpd-service-post-ops.yaml | 11 +- .../templates/120-ibm-spark-app.yaml | 1 + .../templates/120-ibm-spss-app.yaml | 1 + .../templates/120-ibm-wsl-app.yaml | 1 + 23 files changed, 2053 insertions(+), 6 deletions(-) create mode 100644 instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml create mode 100644 instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml diff --git a/instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml b/instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml new file mode 100644 index 000000000..fb9b366fd --- /dev/null +++ b/instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml @@ -0,0 +1,678 @@ +{{- if eq .Values.cpd_product_version "5.3.1" }} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: olm-utils-cm + namespace: mas-{{ .Values.instance_id }}-syncres + annotations: + argocd.argoproj.io/sync-wave: "00" + labels: + app.kubernetes.io/name: olm-utils +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +data: + licenses_urls: |- + SWHP: + url: "https://ibm.biz/BdbGRu" + description: "IBM Software Hub Premium Cartridge" + SWHAI: + url: "https://ibm.biz/BdbGRL" + description: "IBM Softare Hub AI Assistant Cartridge" + EE: + url: https://ibm.biz/Bdbq3x + description: "IBM Cloud Pak for Data Enterprise Edition" + SE: + url: https://ibm.biz/Bdbq3H + description: "IBM Cloud Pak for Data Standard Edition" + WXAI: + url: https://ibm.biz/BdbKbw + description: "IBM watsonx.ai" + DB2CE: + url: https://ibm.biz/BdnPB7 + description: "IBM Db2 Community Edition" + DB2SE: + url: https://ibm.biz/BdnPdB + description: "IBM Db2 Standard Edition Cartridge for IBM Cloud Pak for Data" + DB2AE: + url: https://ibm.biz/BdnPBW + description: "IBM Db2 Advanced Edition Cartridge for IBM Cloud Pak for Data" + DG: + url: "https://ibm.biz/dg4zos_v320" + description: "IBM Data Gate for z/OS with Cloud Pak for Data" + DGWXD: + url: "https://ibm.biz/dgx_v13" + description: "IBM Data Gate for watsonx" + DGWXDB: + url: "https://ibm.biz/wxd-dgx" + description: "IBM watsonx.data with Data Gate for IBM Z" + DGWXDPB: + url: "https://ibm.biz/wxdprem-dgx111" + description: "IBM watsonx.data Premium with Data Gate for IBM Z" + DGFS: + url: "https://ibm.biz/dg4fs_v13" + description: "IBM Data Gate for Financial Services" + IKCS: + url: https://ibm.biz/Bdmm4V + description: "IBM Knowledge Catalog Standard" + IKCP: + url: https://ibm.biz/Bdmm4J + description: "IBM Knowledge Catalog Premium" + IDRC: + url: https://ibm.biz/BdpHpg + description: "IBM Data Replication Cartridge" + IIDRC: + url: https://ibm.biz/BdpHph + description: "IBM InfoSphere Data Replication Cartridge" + IDRM: + url: https://ibm.biz/BdpHpJ + description: "IBM Data Replication Modernization" + IIDRM: + url: https://ibm.biz/BdpHpA + description: "IBM InfoSphere Data Replication Modernization" + IDRZOS: + url: https://ibm.biz/BdpHp9 + description: "IBM Data Replication for Db2 z/OS Cartridge" + IIDRWXTO: + url: https://ibm.biz/BdpHpu + description: "IBM InfoSphere Data Replication for watsonx.data Cartridge" + IIDRWXAO: + url: https://ibm.biz/BdpHpL + description: "IBM InfoSphere Data Replication Cartridge Add-on for IBM watsonx.data" + WXD: + url: https://ibm.biz/BdpdBF + description: "IBM watsonx.data" + WXDP: + url: https://ibm.biz/BdpzEx + description: "IBM watsonx.data Premium Edition" + WCA: + url: https://ibm.biz/Bdbv9x + description: "IBM watsonx Code Assistant" + WCAA: + url: https://ibm.biz/Bdbv9D + description: "IBM watsonx Code Assistant for Red Hat Ansible Lightspeed" + DPH: + url: https://ibm.biz/BdbQMv + description: "IBM Data Product Hub" + + release_components_meta: |- + scheduler: + case_version: 1.61.0 + sub_channel: "v1.61" + csv_version: 1.61.0 + cr_version: 1.61.0 + + cpfs: + csv_version: 4.17.0 + case_version: 4.17.0 + sub_channel: "v4.17" + + ibm-common-service-operator: + cr_version: 4.17.0 + + ibm-iam-operator: + cr_version: 4.16.0 + + ibm-namespace-scope-operator: + cr_version: 4.3.4 + + ibm-cert-manager: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_events_operator: + case_version: 6.0.0 + sub_channel: "v6.0" + csv_version: 6.0.0 + cr_version: 4.1.1 + + streamsets: + case_version: 9.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-streamsets-sdi: + case_version: 2.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-licensing: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_usage_metering: + case_version: 1.0.4 + csv_version: 1.0.4 + sub_channel: "v1.0" + cr_version: 1.0.4 + + cpd_platform: + case_version: 5.4.0 + csv_version: 6.4.0 + sub_channel: "v6.4" + cr_version: 5.4.0 + + platform-config: + cr_version: 5.4.0 + + ibm_swhcc: + case_version: 5.4.0 + csv_version: 5.4.0 + sub_channel: "v5.4" + cr_version: 5.4.0 + + zen: + case_version: 6.4.0 + sub_channel: "v6.4" + csv_version: 6.4.0 + cr_version: 6.4.0 + + analyticsengine: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + cognos_analytics: + case_version: 29.1.0 + sub_channel: "v29.1" + cr_version: 29.1.0 + csv_version: 29.1.0 + + ccs: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + dashboard: + case_version: 4.0.0 + sub_channel: "v4.0" + csv_version: 4.0.0 + cr_version: 5.3.0 + + datarefinery: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: "v12.1" + cr_version: 12.1.0 + + canvasbase: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + spss: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + syntheticdata: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + datastage_ent: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + datastage_ent_plus: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + informix: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + informix_cp4d: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + openscale: + case_version: 10.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + ws: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + ws_runtimes: + case_version: 12.1.0 + cr_version: 12.1.0 + + db2aaservice: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2oltp: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2wh: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2u: + case_version: 7.5.2 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + datagate: + case_version: 11.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 9.1.0 + + dods: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + hee: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + dv: + case_version: 8.1.0 + sub_channel: "v8.1" + csv_version: 8.1.0 + cr_version: 3.3.1 + + bigsql: + case_version: 14.1.0 + sub_channel: "v14.1" + csv_version: 14.1.0 + cr_version: 8.3.1 + + planning_analytics: + case_version: 5.3.1 + sub_channel: "v11.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + rstudio: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + watson_assistant: + case_version: 5.11.0 + sub_channel: "v5.11" + csv_version: 5.11.0 + cr_version: "5.3.1" + + watson_discovery: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + watson_speech: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + wkc: + case_version: 5.3.1 + sub_channel: "v9.1" + csv_version: 2.3.1 + cr_version: 5.3.1 + + ikc_standard: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + ikc_premium: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + datalineage: + case_version: 5.3.1 + sub_channel: "v7.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + udp: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster: + case_version: 9.1.0 + csv_version: 9.1.0 + sub_channel: "v9.1" + cr_version: 9.1.0 + + dataproduct: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + semantic_automation: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster_instance: + cr_version: 9.1.0 + + dp: + case_version: 11.1.0 + csv_version: 11.1.0 + sub_channel: "v11.1" + cr_version: 5.3.1 + + wml: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + dmc: + case_version: 8.11.0 + csv_version: 5.11.0 + cr_version: 5.3.1 + sub_channel: "v5.11" + + openpages: + case_version: 10.1.0 + csv_version: 10.1.0 + cr_version: 9.7.0 + sub_channel: "v10.1" + + openpages_instance: + cr_version: 9.7.0 + + mantaflow: + case_version: 2.4.0 + csv_version: 2.4.0 + sub_channel: "v2.4" + cr_version: 42.15.0 + + match360: + case_version: 4.11.0 + csv_version: 4.11.0 + cr_version: 4.11.50 + sub_channel: "v4.11" + + model_gateway: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + opencontent_opensearch: + case_version: 1.2.0 + csv_version: 1.2.0 + cr_version: 1.2.0 + sub_channel: "v1.1" + + opencontent_redis: + case_version: 1.6.11 + csv_version: 1.6.11 + sub_channel: "v1.6" + + ibm_redis_cp: + case_version: 1.3.1 + csv_version: 1.3.1 + sub_channel: "v1.3" + cr_version: 1.3.1 + + opencontent_rabbitmq: + case_version: 1.3.0 + csv_version: 1.3.0 + sub_channel: "v1.0" + cr_version: 1.3.0 + + opencontent_fdb: + case_version: 5.3.1 + csv_version: 5.3.1 + cr_version: 5.3.1 + sub_channel: "v5.3" + + fdb_k8s: + csv_version: 5.3.1 + sub_channel: "v5.3" + + opencontent_minio: + case_version: 1.0.23 + csv_version: 1.0.18 + + opencontent_etcd: + case_version: 2.0.57 + csv_version: 1.0.47 + + opencontent_auditwebhook: + case_version: 1.0.24 + csv_version: 0.3.1 + + watson_gateway: + case_version: 2.2.0 + csv_version: 2.2.0 + cr_version: 2.2.0 + + data_governor: + case_version: 8.1.0 + csv_version: 8.1.0 + sub_channel: v8.1 + cr_version: 3.29.4 + + ws_pipelines: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 5.3.1 + + postgresql: + case_version: 5.31.0 + sub_channel: "stable-v1.25" + csv_version: 1.25.5 + cr_version: 1.25.5 + + edb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + mongodb: + case_version: 5.31.0 + sub_channel: "stable" + csv_version: 1.33.0 + cr_version: 5.31.0 + + mongodb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + dpra: + deprecated: true + case_version: 1.20.0 + sub_channel: "v1.20" + csv_version: 1.20.0 + cr_version: 1.20.0 + + factsheet: + case_version: 7.1.0 + csv_version: 7.1.0 + sub_channel: "v7.1" + cr_version: 5.3.1 + + replication: + case_version: 5.3.1 + csv_version: 7.1.0 + cr_version: 5.3.1 + sub_channel: "v7.1" + + voice_gateway: + case_version: 1.13.0 + csv_version: 1.13.0 + sub_channel: v1.13 + cr_version: 1.13.0 + + watsonx_data: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + watsonx_data_premium: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + wxd_query_optimizer: + component_dependencies: + - db2u + + watsonx_ai: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + osai_min_version: 2.19.0 + + watsonx_ai_ifm: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + + watsonx_bi_assistant: + case_version: 3.4.0 + csv_version: 3.4.0 + sub_channel: v3.4 + cr_version: 3.4.0 + + wca_ansible: + case_version: 4.1.0 + cr_version: 5.3.1 + + wca: + case_version: 3.1.0 + cr_version: 5.3.1 + + wca_z: + case_version: 4.1.0 + csv_version: 4.1.0 + sub_channel: v4.0 + cr_version: 5.3.1 + + wca_z_agentic: + case_version: 2.0.1 + csv_version: 2.0.1 + sub_channel: v2.1 + cr_version: 2.7.1 + + wca_z_ce: + case_version: 5.3.1 + sub_channel: v2.8 + csv_version: 2.8.10 + cr_version: 2.8.10 + + wca_z_cg: + case_version: 5.3.1 + sub_channel: v1.1 + csv_version: 1.1.1 + cr_version: 2.8.10 + + wca_base: + case_version: 4.1.0 + cr_version: 5.3.1 + + ibm_neo4j: + case_version: 1.3.1 + sub_channel: "v4.1" + csv_version: 1.3.1 + cr_version: 1.3.1 + + watsonx_governance: + case_version: 5.1.0 + sub_channel: "v5.1" + csv_version: 5.1.0 + cr_version: 2.3.1 + + watsonx_orchestrate: + case_version: 7.1.0 + sub_channel: "v7.1" + csv_version: 7.1.0 + cr_version: "7.1.0" + + watsonx_dataintegration: + case_version: 2.4.0 + sub_channel: "v2.4" + csv_version: 5.3.1 + cr_version: 2.3.1 + + watsonx_dataintelligence: + case_version: 2.3.1 + sub_channel: "v2.31" + csv_version: 2.3.1 + cr_version: 2.3.1 + + wca_z_understand: + case_version: 1.1.0 + csv_version: 1.1.0 + sub_channel: v1.1 + cr_version: 2.8.10 + + ibm-databand: + case_version: 1.0.0 + csv_version: 1.0.0 + cr_version: 1.0.0 + sub_channel: "v1.0.0" + + datastax_mc: + case_version: 1.16.1 + cr_version: 1.16.1 + + ibm_wxd_opensearch: + case_version: 3.3.2 + cr_version: 3.3.2 + release_version: 5.3.1 +{{- end }} + + + diff --git a/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml b/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml index 461104031..8c0985a57 100644 --- a/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml +++ b/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml @@ -293,4 +293,76 @@ spec: registryPoll: interval: 30m0s {{- end }} + + + +# cpd 5.3.1 catalog sources +{{- if eq .Values.cpd_product_version "5.3.1" }} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: CatalogSource +metadata: + name: cpd-platform + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "001" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + displayName: ibm-cp-datacore-6.4.0-50 + image: icr.io/cpopen/ibm-cpd-platform-operator-catalog@sha256:0a63f6bf9c312efc3daca05a657c70f300eaef7f5a36055753b11fcf014688ca + publisher: IBM + sourceType: grpc + updateStrategy: + registryPoll: + interval: 30m0s + +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: CatalogSource +metadata: + name: opencloud-operators + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "001" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + displayName: ibm-cp-common-services-4.17.0 + image: icr.io/cpopen/ibm-common-service-catalog@sha256:de97dd2a35b4c58da9b7ad5d89976d7a4184541e2e0a78a1c71e441a0105ce6e + publisher: IBM + sourceType: grpc + updateStrategy: + registryPoll: + interval: 30m0s + +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: CatalogSource +metadata: + name: ibm-zen-operator-catalog + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "001" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + displayName: ibm-zen-6.4.0-92 + image: icr.io/cpopen/ibm-zen-operator-catalog@sha256:9a02519e5ab679f0807fc5b7cfc5fc96242961bee0e1d3144012d33e925e6a99 + publisher: IBM + sourceType: grpc + updateStrategy: + registryPoll: + interval: 30m0s +{{- end }} {{- end }} + + + + diff --git a/instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml b/instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml new file mode 100644 index 000000000..ae436acc7 --- /dev/null +++ b/instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml @@ -0,0 +1,677 @@ +{{- if eq .Values.cpd_product_version "5.3.1" }} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: olm-utils-cm + namespace: {{ .Values.cpd_instance_namespace }} + annotations: + argocd.argoproj.io/sync-wave: "00" + labels: + app.kubernetes.io/name: olm-utils +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +data: + licenses_urls: |- + SWHP: + url: "https://ibm.biz/BdbGRu" + description: "IBM Software Hub Premium Cartridge" + SWHAI: + url: "https://ibm.biz/BdbGRL" + description: "IBM Softare Hub AI Assistant Cartridge" + EE: + url: https://ibm.biz/Bdbq3x + description: "IBM Cloud Pak for Data Enterprise Edition" + SE: + url: https://ibm.biz/Bdbq3H + description: "IBM Cloud Pak for Data Standard Edition" + WXAI: + url: https://ibm.biz/BdbKbw + description: "IBM watsonx.ai" + DB2CE: + url: https://ibm.biz/BdnPB7 + description: "IBM Db2 Community Edition" + DB2SE: + url: https://ibm.biz/BdnPdB + description: "IBM Db2 Standard Edition Cartridge for IBM Cloud Pak for Data" + DB2AE: + url: https://ibm.biz/BdnPBW + description: "IBM Db2 Advanced Edition Cartridge for IBM Cloud Pak for Data" + DG: + url: "https://ibm.biz/dg4zos_v320" + description: "IBM Data Gate for z/OS with Cloud Pak for Data" + DGWXD: + url: "https://ibm.biz/dgx_v13" + description: "IBM Data Gate for watsonx" + DGWXDB: + url: "https://ibm.biz/wxd-dgx" + description: "IBM watsonx.data with Data Gate for IBM Z" + DGWXDPB: + url: "https://ibm.biz/wxdprem-dgx111" + description: "IBM watsonx.data Premium with Data Gate for IBM Z" + DGFS: + url: "https://ibm.biz/dg4fs_v13" + description: "IBM Data Gate for Financial Services" + IKCS: + url: https://ibm.biz/Bdmm4V + description: "IBM Knowledge Catalog Standard" + IKCP: + url: https://ibm.biz/Bdmm4J + description: "IBM Knowledge Catalog Premium" + IDRC: + url: https://ibm.biz/BdpHpg + description: "IBM Data Replication Cartridge" + IIDRC: + url: https://ibm.biz/BdpHph + description: "IBM InfoSphere Data Replication Cartridge" + IDRM: + url: https://ibm.biz/BdpHpJ + description: "IBM Data Replication Modernization" + IIDRM: + url: https://ibm.biz/BdpHpA + description: "IBM InfoSphere Data Replication Modernization" + IDRZOS: + url: https://ibm.biz/BdpHp9 + description: "IBM Data Replication for Db2 z/OS Cartridge" + IIDRWXTO: + url: https://ibm.biz/BdpHpu + description: "IBM InfoSphere Data Replication for watsonx.data Cartridge" + IIDRWXAO: + url: https://ibm.biz/BdpHpL + description: "IBM InfoSphere Data Replication Cartridge Add-on for IBM watsonx.data" + WXD: + url: https://ibm.biz/BdpdBF + description: "IBM watsonx.data" + WXDP: + url: https://ibm.biz/BdpzEx + description: "IBM watsonx.data Premium Edition" + WCA: + url: https://ibm.biz/Bdbv9x + description: "IBM watsonx Code Assistant" + WCAA: + url: https://ibm.biz/Bdbv9D + description: "IBM watsonx Code Assistant for Red Hat Ansible Lightspeed" + DPH: + url: https://ibm.biz/BdbQMv + description: "IBM Data Product Hub" + + release_components_meta: |- + scheduler: + case_version: 1.61.0 + sub_channel: "v1.61" + csv_version: 1.61.0 + cr_version: 1.61.0 + + cpfs: + csv_version: 4.17.0 + case_version: 4.17.0 + sub_channel: "v4.17" + + ibm-common-service-operator: + cr_version: 4.17.0 + + ibm-iam-operator: + cr_version: 4.16.0 + + ibm-namespace-scope-operator: + cr_version: 4.3.4 + + ibm-cert-manager: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_events_operator: + case_version: 6.0.0 + sub_channel: "v6.0" + csv_version: 6.0.0 + cr_version: 4.1.1 + + streamsets: + case_version: 9.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-streamsets-sdi: + case_version: 2.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-licensing: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_usage_metering: + case_version: 1.0.4 + csv_version: 1.0.4 + sub_channel: "v1.0" + cr_version: 1.0.4 + + cpd_platform: + case_version: 5.4.0 + csv_version: 6.4.0 + sub_channel: "v6.4" + cr_version: 5.4.0 + + platform-config: + cr_version: 5.4.0 + + ibm_swhcc: + case_version: 5.4.0 + csv_version: 5.4.0 + sub_channel: "v5.4" + cr_version: 5.4.0 + + zen: + case_version: 6.4.0 + sub_channel: "v6.4" + csv_version: 6.4.0 + cr_version: 6.4.0 + + analyticsengine: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + cognos_analytics: + case_version: 29.1.0 + sub_channel: "v29.1" + cr_version: 29.1.0 + csv_version: 29.1.0 + + ccs: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + dashboard: + case_version: 4.0.0 + sub_channel: "v4.0" + csv_version: 4.0.0 + cr_version: 5.3.0 + + datarefinery: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: "v12.1" + cr_version: 12.1.0 + + canvasbase: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + spss: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + syntheticdata: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + datastage_ent: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + datastage_ent_plus: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + informix: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + informix_cp4d: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + openscale: + case_version: 10.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + ws: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + ws_runtimes: + case_version: 12.1.0 + cr_version: 12.1.0 + + db2aaservice: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2oltp: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2wh: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2u: + case_version: 7.5.2 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + datagate: + case_version: 11.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 9.1.0 + + dods: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + hee: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + dv: + case_version: 8.1.0 + sub_channel: "v8.1" + csv_version: 8.1.0 + cr_version: 3.3.1 + + bigsql: + case_version: 14.1.0 + sub_channel: "v14.1" + csv_version: 14.1.0 + cr_version: 8.3.1 + + planning_analytics: + case_version: 5.3.1 + sub_channel: "v11.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + rstudio: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + watson_assistant: + case_version: 5.11.0 + sub_channel: "v5.11" + csv_version: 5.11.0 + cr_version: "5.3.1" + + watson_discovery: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + watson_speech: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + wkc: + case_version: 5.3.1 + sub_channel: "v9.1" + csv_version: 2.3.1 + cr_version: 5.3.1 + + ikc_standard: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + ikc_premium: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + datalineage: + case_version: 5.3.1 + sub_channel: "v7.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + udp: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster: + case_version: 9.1.0 + csv_version: 9.1.0 + sub_channel: "v9.1" + cr_version: 9.1.0 + + dataproduct: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + semantic_automation: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster_instance: + cr_version: 9.1.0 + + dp: + case_version: 11.1.0 + csv_version: 11.1.0 + sub_channel: "v11.1" + cr_version: 5.3.1 + + wml: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + dmc: + case_version: 8.11.0 + csv_version: 5.11.0 + cr_version: 5.3.1 + sub_channel: "v5.11" + + openpages: + case_version: 10.1.0 + csv_version: 10.1.0 + cr_version: 9.7.0 + sub_channel: "v10.1" + + openpages_instance: + cr_version: 9.7.0 + + mantaflow: + case_version: 2.4.0 + csv_version: 2.4.0 + sub_channel: "v2.4" + cr_version: 42.15.0 + + match360: + case_version: 4.11.0 + csv_version: 4.11.0 + cr_version: 4.11.50 + sub_channel: "v4.11" + + model_gateway: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + opencontent_opensearch: + case_version: 1.2.0 + csv_version: 1.2.0 + cr_version: 1.2.0 + sub_channel: "v1.1" + + opencontent_redis: + case_version: 1.6.11 + csv_version: 1.6.11 + sub_channel: "v1.6" + + ibm_redis_cp: + case_version: 1.3.1 + csv_version: 1.3.1 + sub_channel: "v1.3" + cr_version: 1.3.1 + + opencontent_rabbitmq: + case_version: 1.3.0 + csv_version: 1.3.0 + sub_channel: "v1.0" + cr_version: 1.3.0 + + opencontent_fdb: + case_version: 5.3.1 + csv_version: 5.3.1 + cr_version: 5.3.1 + sub_channel: "v5.3" + + fdb_k8s: + csv_version: 5.3.1 + sub_channel: "v5.3" + + opencontent_minio: + case_version: 1.0.23 + csv_version: 1.0.18 + + opencontent_etcd: + case_version: 2.0.57 + csv_version: 1.0.47 + + opencontent_auditwebhook: + case_version: 1.0.24 + csv_version: 0.3.1 + + watson_gateway: + case_version: 2.2.0 + csv_version: 2.2.0 + cr_version: 2.2.0 + + data_governor: + case_version: 8.1.0 + csv_version: 8.1.0 + sub_channel: v8.1 + cr_version: 3.29.4 + + ws_pipelines: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 5.3.1 + + postgresql: + case_version: 5.31.0 + sub_channel: "stable-v1.25" + csv_version: 1.25.5 + cr_version: 1.25.5 + + edb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + mongodb: + case_version: 5.31.0 + sub_channel: "stable" + csv_version: 1.33.0 + cr_version: 5.31.0 + + mongodb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + dpra: + deprecated: true + case_version: 1.20.0 + sub_channel: "v1.20" + csv_version: 1.20.0 + cr_version: 1.20.0 + + factsheet: + case_version: 7.1.0 + csv_version: 7.1.0 + sub_channel: "v7.1" + cr_version: 5.3.1 + + replication: + case_version: 5.3.1 + csv_version: 7.1.0 + cr_version: 5.3.1 + sub_channel: "v7.1" + + voice_gateway: + case_version: 1.13.0 + csv_version: 1.13.0 + sub_channel: v1.13 + cr_version: 1.13.0 + + watsonx_data: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + watsonx_data_premium: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + wxd_query_optimizer: + component_dependencies: + - db2u + + watsonx_ai: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + osai_min_version: 2.19.0 + + watsonx_ai_ifm: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + + watsonx_bi_assistant: + case_version: 3.4.0 + csv_version: 3.4.0 + sub_channel: v3.4 + cr_version: 3.4.0 + + wca_ansible: + case_version: 4.1.0 + cr_version: 5.3.1 + + wca: + case_version: 3.1.0 + cr_version: 5.3.1 + + wca_z: + case_version: 4.1.0 + csv_version: 4.1.0 + sub_channel: v4.0 + cr_version: 5.3.1 + + wca_z_agentic: + case_version: 2.0.1 + csv_version: 2.0.1 + sub_channel: v2.1 + cr_version: 2.7.1 + + wca_z_ce: + case_version: 5.3.1 + sub_channel: v2.8 + csv_version: 2.8.10 + cr_version: 2.8.10 + + wca_z_cg: + case_version: 5.3.1 + sub_channel: v1.1 + csv_version: 1.1.1 + cr_version: 2.8.10 + + wca_base: + case_version: 4.1.0 + cr_version: 5.3.1 + + ibm_neo4j: + case_version: 1.3.1 + sub_channel: "v4.1" + csv_version: 1.3.1 + cr_version: 1.3.1 + + watsonx_governance: + case_version: 5.1.0 + sub_channel: "v5.1" + csv_version: 5.1.0 + cr_version: 2.3.1 + + watsonx_orchestrate: + case_version: 7.1.0 + sub_channel: "v7.1" + csv_version: 7.1.0 + cr_version: "7.1.0" + + watsonx_dataintegration: + case_version: 2.4.0 + sub_channel: "v2.4" + csv_version: 5.3.1 + cr_version: 2.3.1 + + watsonx_dataintelligence: + case_version: 2.3.1 + sub_channel: "v2.31" + csv_version: 2.3.1 + cr_version: 2.3.1 + + wca_z_understand: + case_version: 1.1.0 + csv_version: 1.1.0 + sub_channel: v1.1 + cr_version: 2.8.10 + + ibm-databand: + case_version: 1.0.0 + csv_version: 1.0.0 + cr_version: 1.0.0 + sub_channel: "v1.0.0" + + datastax_mc: + case_version: 1.16.1 + cr_version: 1.16.1 + + ibm_wxd_opensearch: + case_version: 3.3.2 + cr_version: 3.3.2 + release_version: 5.3.1 +{{- end }} + + diff --git a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml index 7797ff419..2c8d3d747 100644 --- a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml +++ b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml @@ -1526,3 +1526,144 @@ roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: admin + +{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0) }} +--- +# For CPD 5.3.1+, cpd-sa needs cluster-level permissions to apply CRDs and +# ClusterRoles from the Helm cluster-scoped charts during service installation. +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: "cpd-sa-helm-cluster-role-{{ .Values.instance_id }}" + annotations: + argocd.argoproj.io/sync-wave: "084" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +rules: + # CRD management (needed to apply cluster-scoped Helm charts) + - verbs: + - get + - list + - create + - update + - patch + - delete + apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + # ClusterRole/Binding management with escalate (allows granting permissions not yet held) + - verbs: + - get + - list + - create + - update + - patch + - delete + - bind + - escalate + apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + # Namespaced roles/rolebindings (needed by Helm namespace-scoped charts) + - verbs: + - get + - list + - create + - update + - patch + - delete + - watch + apiGroups: + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + # Namespace/node read + - verbs: + - get + - list + apiGroups: + - "" + resources: + - namespaces + - nodes + # OpenShift infra + - verbs: + - get + - list + apiGroups: + - config.openshift.io + resources: + - clusterversions + - infrastructures + # SCCs + - verbs: + - use + apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - anyuid + - restricted + - nonroot + - privileged + # CPD service API groups (needed to grant these permissions in cluster-scoped ClusterRoles) + - verbs: + - get + - list + - create + - update + - patch + - delete + - watch + apiGroups: + - ae.cpd.ibm.com + - wml.cpd.ibm.com + - spssmodeler.cpd.ibm.com + - ws.cpd.ibm.com + - ccs.cpd.ibm.com + - opensearch.cloudpackopen.ibm.com + - datarefinery.cpd.ibm.com + - wsruntimes.cpd.ibm.com + resources: + - "*" + # Webhook configs (needed by some Helm charts) + - verbs: + - get + - list + - create + - update + - patch + - delete + apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: "cpd-sa-helm-cluster-rb-{{ .Values.instance_id }}" + annotations: + argocd.argoproj.io/sync-wave: "085" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +subjects: + - kind: ServiceAccount + name: cpd-sa + namespace: "{{ .Values.cpd_operators_namespace }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: "cpd-sa-helm-cluster-role-{{ .Values.instance_id }}" +{{- end }} diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml index 4a90cf334..cb0ec381b 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml @@ -146,6 +146,7 @@ spec: backoffLimit: 4 +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} {{- if or .Values.wml_channel .Values.wsl_channel .Values.spss_channel }} --- apiVersion: operators.coreos.com/v1alpha1 @@ -246,3 +247,4 @@ spec: {{- end }} {{- end }} +{{- end }} diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml index aecaafdef..6a270dcee 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml @@ -1,4 +1,4 @@ -{{- if or .Values.wsl_channel .Values.spss_channel }} +{{- if and (or .Values.wsl_channel .Values.spss_channel) (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0) }} # Custom Operand Registries # ----------------------------------------------------------------------------- --- diff --git a/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml b/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml index 980b17c49..b76edaa92 100644 --- a/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml @@ -4,6 +4,7 @@ {{- /* Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. */}} + {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} # diff --git a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml index 598d60619..392b67cf3 100644 --- a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml +++ b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,4 +17,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.spark_install_plan | default "Automatic" | quote }} - +{{- end }} diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 87a8a32c9..be1a252fa 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: ae.cpd.ibm.com/v1 kind: AnalyticsEngine @@ -22,3 +23,73 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.spark_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +apiVersion: batch/v1 +kind: Job +metadata: + name: install-spark-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + command: + - /bin/sh + - -c + - | + set -e + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + + echo "Installing analyticsengine cluster-scoped chart (CRDs + ClusterRoles)..." + helm template analyticsengine-cluster ibm-charts/analyticsengine-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for analyticsengines.ae.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd analyticsengines.ae.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing analyticsengine namespace-scoped chart (operator + CR)..." + helm upgrade --install analyticsengine ibm-charts/analyticsengine \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set analyticsengine.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 60m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 +{{- end }} diff --git a/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml b/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml index 65d3bf87d..e2c7b5f8a 100644 --- a/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml +++ b/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml @@ -55,6 +55,7 @@ are required here. */}} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- kind: ServiceAccount apiVersion: v1 @@ -165,5 +166,5 @@ spec: restartPolicy: Never serviceAccountName: spark-cp-sa backoffLimit: 4 - +{{- end }} diff --git a/instance-applications/120-ibm-spark/values.yaml b/instance-applications/120-ibm-spark/values.yaml index d6a766919..25e5c803b 100644 --- a/instance-applications/120-ibm-spark/values.yaml +++ b/instance-applications/120-ibm-spark/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" spark_channel: "" spark_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index dcb608e85..d54dac607 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -35,3 +36,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.canvasbase_install_plan | default "Automatic" | quote }} +{{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 2869c08f6..6f7c7368a 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,4 +1,4 @@ - +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: spssmodeler.cpd.ibm.com/v1 kind: Spss @@ -24,4 +24,74 @@ spec: version: "{{ .Values.spss_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" - wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" \ No newline at end of file + wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +apiVersion: batch/v1 +kind: Job +metadata: + name: install-spss-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + command: + - /bin/sh + - -c + - | + set -e + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + + echo "Installing spss-modeler cluster-scoped chart (CRDs + ClusterRoles)..." + helm template spss-modeler-cluster ibm-charts/spss-modeler-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for spssmodelers.spssmodeler.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd spssmodelers.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing spss-modeler namespace-scoped chart (operator + CR)..." + helm upgrade --install spss-modeler ibm-charts/spss-modeler \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set spssmodeler.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 60m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 +{{- end }} diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml index 51ca216c9..b7c0618d7 100644 --- a/instance-applications/120-ibm-spss/values.yaml +++ b/instance-applications/120-ibm-spss/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" spss_channel: "" spss_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml index 327653732..01f75abbd 100644 --- a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml +++ b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,3 +17,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.wml_install_plan | default "Automatic" | quote }} +{{- end }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index e1e789973..311232e18 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: wml.cpd.ibm.com/v1beta1 kind: WmlBase @@ -22,3 +23,73 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.wml_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +apiVersion: batch/v1 +kind: Job +metadata: + name: install-wml-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + command: + - /bin/sh + - -c + - | + set -e + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + + echo "Installing wml cluster-scoped chart (CRDs + ClusterRoles)..." + helm template wml-cluster ibm-charts/wml-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for wmlbases.wml.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd wmlbases.wml.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing wml namespace-scoped chart (operator + CR)..." + helm upgrade --install wml ibm-charts/wml \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set wml.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 60m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 +{{- end }} diff --git a/instance-applications/120-ibm-wml/values.yaml b/instance-applications/120-ibm-wml/values.yaml index b5ec6e992..56dedaab2 100644 --- a/instance-applications/120-ibm-wml/values.yaml +++ b/instance-applications/120-ibm-wml/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" wml_channel: "" wml_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index b2556409c..2f30520a5 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -1,3 +1,24 @@ +# --- +# apiVersion: operators.coreos.com/v1alpha1 +# kind: Subscription +# metadata: +# name: ibm-cpd-ws-operator +# namespace: "{{ .Values.cpd_operators_namespace }}" +# annotations: +# argocd.argoproj.io/sync-wave: "090" +# {{- if .Values.custom_labels }} +# labels: +# {{ .Values.custom_labels | toYaml | indent 4 }} +# {{- end }} +# spec: +# name: ibm-cpd-wsl +# channel: "{{ .Values.wsl_channel }}" +# source: ibm-operator-catalog +# sourceNamespace: openshift-marketplace +# installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} + + +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,3 +37,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} +{{- end }} \ No newline at end of file diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 11c9d89a3..477584a6f 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -1,3 +1,33 @@ +# --- +# apiVersion: ws.cpd.ibm.com/v1beta1 +# kind: WS +# metadata: +# name: "ws-cr" +# namespace: "{{ .Values.cpd_instance_namespace }}" +# annotations: +# argocd.argoproj.io/sync-wave: "091" +# argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +# {{- if .Values.custom_labels }} +# labels: +# {{ .Values.custom_labels | toYaml | indent 4 }} +# {{- end }} +# spec: +# imagePullSecret: ibm-entitlement-key +# ignoreForMaintenance: false +# license: +# accept: true +# license: Standard +# scaleConfig: "{{ .Values.cpd_service_scale_config }}" +# fileStorageClass: "{{ .Values.cpd_service_storage_class }}" +# blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" +# version: "{{ .Values.wsl_version }}" +# ccs_operand_version: "{{ .Values.ccs_version }}" +# datarefinery_operand_version: "{{ .Values.datarefinery_version }}" +# wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" + + + +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: ws.cpd.ibm.com/v1beta1 kind: WS @@ -24,3 +54,194 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +# Installs WSL and all its dependencies (opensearch, ccs, datarefinery, ws-runtimes) +# using IBM Helm charts. Each component requires a cluster-scoped chart (CRDs/ClusterRoles) +# followed by a namespace-scoped chart (Operator + CR). +apiVersion: batch/v1 +kind: Job +metadata: + name: install-wsl-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + command: + - /bin/sh + - -c + - | + set -e + + HELM_REPO=ibm-charts + HELM_REPO_URL=https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + OPERATORS_NS={{ .Values.cpd_operators_namespace }} + INSTANCE_NS={{ .Values.cpd_instance_namespace }} + FILE_SC={{ .Values.cpd_service_storage_class }} + BLOCK_SC={{ .Values.cpd_service_block_storage_class }} + SCALE={{ .Values.cpd_service_scale_config }} + CPD_VERSION={{ .Values.cpd_product_version }} + PULL_SECRET=ibm-entitlement-key + + echo "================================================================" + echo "Adding IBM Helm repository" + echo "================================================================" + helm repo add ${HELM_REPO} ${HELM_REPO_URL} || true + helm repo update + + # Shared values file used by all components + printf 'global:\n licenseAccept: true\n releaseVersion: %s\n operatorNamespace: %s\n instanceNamespace: %s\n fileStorageClass: %s\n blockStorageClass: %s\n imagePullSecret: %s\n imagePullPrefix: cp.icr.io\n' \ + "${CPD_VERSION}" "${OPERATORS_NS}" "${INSTANCE_NS}" "${FILE_SC}" "${BLOCK_SC}" "${PULL_SECRET}" \ + > /tmp/cpd-global-values.yaml + + install_component() { + local NAME=$1 + local CHART=$2 + local CLUSTER_CHART=$3 + local VERSION=$4 + local EXTRA_VALUES=$5 + + echo "================================================================" + echo "Installing ${NAME} (version ${VERSION})" + echo "================================================================" + + # 1. Cluster-scoped chart (CRDs, ClusterRoles) + echo " [${NAME}] Installing cluster-scoped chart..." + helm template ${NAME}-cluster ${HELM_REPO}/${CLUSTER_CHART} \ + --version ${VERSION} \ + -f /tmp/cpd-global-values.yaml \ + --namespace ${OPERATORS_NS} | oc apply -f - + + # Wait for all CRDs from the cluster-scoped chart to be established + # before running the namespace-scoped chart that depends on them. + echo " [${NAME}] Waiting for CRDs to be established..." + sleep 5 + oc wait crd --all --for=condition=Established --timeout=120s 2>/dev/null || true + + # 2. Namespace-scoped chart (Operator + CR) + echo " [${NAME}] Installing namespace-scoped chart..." + helm upgrade --install ${NAME} ${HELM_REPO}/${CHART} \ + --version ${VERSION} \ + -f /tmp/cpd-global-values.yaml \ + ${EXTRA_VALUES} \ + --namespace ${INSTANCE_NS} \ + --create-namespace \ + --wait --timeout 60m + } + + # ---------------------------------------------------------------- + # Step 1: OpenSearch (dependency) + # ---------------------------------------------------------------- + install_component \ + "opencontent-opensearch" \ + "opencontent-opensearch" \ + "opencontent-opensearch-cluster-scoped" \ + "1.2.0" + + echo "Waiting for opensearchclusters.opensearch.cloudpackopen.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd opensearchclusters.opensearch.cloudpackopen.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + # ---------------------------------------------------------------- + # Step 2: CCS - Common Core Services (dependency) + # ---------------------------------------------------------------- + install_component \ + "ccs" \ + "ccs" \ + "ccs-cluster-scoped" \ + "12.1.0" \ + "--set ccs.scaleConfig=${SCALE}" + + # Wait for CCS CR to be ready + echo "Waiting for CCS CR to be ready..." + oc wait ccs/ccs-cr -n ${INSTANCE_NS} \ + --for=jsonpath='{.status.controlPlaneStatus}'=Completed \ + --timeout=60m + + # ---------------------------------------------------------------- + # Step 3: DataRefinery (dependency) + # ---------------------------------------------------------------- + install_component \ + "datarefinery" \ + "datarefinery" \ + "datarefinery-cluster-scoped" \ + "12.1.0" + + echo "Waiting for datarefineries.datarefinery.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd datarefineries.datarefinery.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + # ---------------------------------------------------------------- + # Step 4: WS Runtimes (dependency) + # ---------------------------------------------------------------- + install_component \ + "ws-runtimes" \ + "ws-runtimes" \ + "ws-runtimes-cluster-scoped" \ + "12.1.0" + + echo "Waiting for wsruntimes.wsruntimes.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd wsruntimes.wsruntimes.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + # ---------------------------------------------------------------- + # Step 5: Watson Studio (main component) + # ---------------------------------------------------------------- + install_component \ + "wsl" \ + "ws" \ + "ws-cluster-scoped" \ + "12.1.0" \ + "--set ws.scaleConfig=${SCALE}" + + echo "================================================================" + echo "WSL installation complete" + echo "================================================================" + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 1 +{{- end }} diff --git a/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml b/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml index 8aebe3f14..556806533 100644 --- a/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml +++ b/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml @@ -25,7 +25,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v1" }} +{{- $_job_version := "v2" }} {{- /* 10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest @@ -247,6 +247,15 @@ spec: echo $(( $V1 - $V2 )) } + # For CPD 5.3.1+, CCS and OpenSearch are installed via Helm (not OLM). + # The CCS CR and OpenSearch CR managed by this post-sync job do not exist + # in that deployment model, so skip all OLM-specific post-sync patching. + COMP_531=$(compare_versions ${CPD_PRODUCT_VERSION} 5.3.1) + if [[ ${COMP_531} -ge 0 ]]; then + echo "CPD ${CPD_PRODUCT_VERSION} detected (>= 5.3.1) - CCS/OpenSearch installed via Helm, skipping OLM post-sync patching" + exit 0 + fi + echo echo "================================================================================" echo "Wait for CCS Cr to be ready and patch if needed" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml index 6834f1a38..af0446795 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml @@ -48,6 +48,7 @@ spec: application_admin_role: {{ .Values.application_admin_role }} ccs_version: "{{ .Values.ibm_spark.ccs_version }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_service_block_storage_class: "{{ .Values.ibm_spark.cpd_service_block_storage_class }}" cpd_service_scale_config: "{{ .Values.ibm_spark.cpd_service_scale_config }}" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index 7609a1110..03b5be98a 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -47,6 +47,7 @@ spec: sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" cpd_service_storage_class: "{{ .Values.ibm_spss.cpd_service_storage_class }}" cpd_service_block_storage_class: "{{ .Values.ibm_spss.cpd_service_block_storage_class }}" cpd_service_scale_config: "{{ .Values.ibm_spss.cpd_service_scale_config }}" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index 21c3074b9..43098f834 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -48,6 +48,7 @@ spec: sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" cpd_service_storage_class: "{{ .Values.ibm_wsl.cpd_service_storage_class }}" cpd_service_block_storage_class: "{{ .Values.ibm_wsl.cpd_service_block_storage_class }}" cpd_service_scale_config: "{{ .Values.ibm_wsl.cpd_service_scale_config }}" From 7f9302d47788e3fc909380b45aecc924b8d32544 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 12:18:55 +0530 Subject: [PATCH 023/115] MASCORE-15507: add HookFailed delete policy to CPD 5.3.1 Helm install Jobs Static-named ArgoCD sync hook Jobs (install-wsl-helm, install-wml-helm, install-spss-helm, install-spark-helm) were failing with: 'spec.template: Invalid value ... field is immutable' This happens when an old Job with the same name exists from a prior sync and ArgoCD tries to patch it. Since Job spec.template is immutable, the patch is rejected. Fix: add HookFailed to hook-delete-policy on all four Jobs so ArgoCD deletes the Job on both success AND failure, ensuring no stale Job exists when the next sync runs. --- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 2 +- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index be1a252fa..b7bd144bd 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -34,7 +34,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed spec: template: spec: diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 6f7c7368a..2600203b8 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -36,7 +36,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed spec: template: spec: diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 311232e18..cfc1e0477 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -34,7 +34,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed spec: template: spec: diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 477584a6f..de0ff0875 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -68,7 +68,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "091" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed spec: template: spec: From ca746ce3c9e0d3e51e5dc6b57805a04c20e30bf2 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 13:45:22 +0530 Subject: [PATCH 024/115] MASCORE-15507: fix wrong OpenSearch CRD name in WSL Helm Job wait loop The wait loop was polling for: opensearchclusters.opensearch.cloudpackopen.ibm.com (does not exist) The actual CRD name registered by the IBM OpenSearch Helm chart is: clusters.opensearch.cloudpackopen.ibm.com This caused the WSL Helm Job to always timeout after 5 minutes at the OpenSearch step, blocking CCS, DataRefinery, WS-Runtimes and WSL from ever installing. --- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 3b3920893..81925a30e 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -148,7 +148,7 @@ spec: "opencontent-opensearch-cluster-scoped" \ "1.2.0" - echo "Waiting for opensearchclusters.opensearch.cloudpackopen.ibm.com CRD to be established..." + echo "Waiting for clusters.opensearch.cloudpackopen.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -156,7 +156,7 @@ spec: echo "CRD not established after 5 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd opensearchclusters.opensearch.cloudpackopen.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd clusters.opensearch.cloudpackopen.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "CRD established." break From 861314a69c0bdcec3de46a2c60a32bcc8978f76f Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 13:59:58 +0530 Subject: [PATCH 025/115] MASCORE-15507: fix CCS CR wait - poll with ignore-not-found instead of oc wait oc wait exits immediately with error if the resource does not exist. The CCS CR (ccs-cr) is created by the CCS operator after Helm installs it, so it is not immediately present. Replace oc wait with a polling loop using --ignore-not-found, same pattern used for all other CRD waits in this script. Polls every 30s up to 60 minutes. --- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 24 +++++++++++++++---- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 81925a30e..205a23107 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -174,11 +174,25 @@ spec: "12.1.0" \ "--set ccs.scaleConfig=${SCALE}" - # Wait for CCS CR to be ready - echo "Waiting for CCS CR to be ready..." - oc wait ccs/ccs-cr -n ${INSTANCE_NS} \ - --for=jsonpath='{.status.controlPlaneStatus}'=Completed \ - --timeout=60m + # Wait for CCS CR to be created then reach Completed status + echo "Waiting for CCS CR to be created and ready..." + wait_period=0 + while true; do + wait_period=$((wait_period+30)) + if [ $wait_period -gt 3600 ]; then + echo "CCS CR not ready after 60 minutes. Exiting." + exit 1 + fi + CCS_STATUS=$(oc get ccs ccs-cr -n ${INSTANCE_NS} \ + -o jsonpath='{.status.controlPlaneStatus}' \ + --ignore-not-found 2>/dev/null) + if [ "${CCS_STATUS}" = "Completed" ]; then + echo "CCS CR is ready." + break + fi + echo " CCS status: '${CCS_STATUS:-not found}' - waiting 30s..." + sleep 30 + done # ---------------------------------------------------------------- # Step 3: DataRefinery (dependency) From 54ced4a345e1ce13bd93418ea0384a5f5233e319 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 14:33:01 +0530 Subject: [PATCH 026/115] fix WSL Helm Job: explicitly create ccs-cr with non_olm_deploy=true after CCS Helm install --- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 205a23107..189ca59f1 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -174,8 +174,17 @@ spec: "12.1.0" \ "--set ccs.scaleConfig=${SCALE}" - # Wait for CCS CR to be created then reach Completed status - echo "Waiting for CCS CR to be created and ready..." + # In CPD 5.3.1 Helm mode the namespace-scoped chart only deploys the + # operator; the CCS CR must be created explicitly with non_olm_deploy=true + # so the operator reconciles the actual CCS instance. + echo "Creating ccs-cr (non_olm_deploy=true) if not already present..." + printf 'apiVersion: ccs.cpd.ibm.com/v1beta1\nkind: Ccs\nmetadata:\n name: ccs-cr\n namespace: %s\nspec:\n license:\n accept: true\n license: Standard\n imagePullSecret: %s\n fileStorageClass: %s\n blockStorageClass: %s\n scaleConfig: %s\n non_olm_deploy: true\n' \ + "${INSTANCE_NS}" "${PULL_SECRET}" "${FILE_SC}" "${BLOCK_SC}" "${SCALE}" \ + > /tmp/ccs-cr.yaml + oc apply -f /tmp/ccs-cr.yaml + + # Wait for CCS CR to reach Completed status + echo "Waiting for CCS CR to be ready..." wait_period=0 while true; do wait_period=$((wait_period+30)) From b0793fdc97a4a50cad9f9e6f851b25870499546b Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 15:17:32 +0530 Subject: [PATCH 027/115] fix WSL Helm Job: correct CCS CR kind from 'Ccs' to 'CCS' --- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 189ca59f1..a03b32549 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -178,7 +178,7 @@ spec: # operator; the CCS CR must be created explicitly with non_olm_deploy=true # so the operator reconciles the actual CCS instance. echo "Creating ccs-cr (non_olm_deploy=true) if not already present..." - printf 'apiVersion: ccs.cpd.ibm.com/v1beta1\nkind: Ccs\nmetadata:\n name: ccs-cr\n namespace: %s\nspec:\n license:\n accept: true\n license: Standard\n imagePullSecret: %s\n fileStorageClass: %s\n blockStorageClass: %s\n scaleConfig: %s\n non_olm_deploy: true\n' \ + printf 'apiVersion: ccs.cpd.ibm.com/v1beta1\nkind: CCS\nmetadata:\n name: ccs-cr\n namespace: %s\nspec:\n license:\n accept: true\n license: Standard\n imagePullSecret: %s\n fileStorageClass: %s\n blockStorageClass: %s\n scaleConfig: %s\n non_olm_deploy: true\n' \ "${INSTANCE_NS}" "${PULL_SECRET}" "${FILE_SC}" "${BLOCK_SC}" "${SCALE}" \ > /tmp/ccs-cr.yaml oc apply -f /tmp/ccs-cr.yaml From 417bd713d9add1fa1b2550b95644c27548b1ffb4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 15:25:09 +0530 Subject: [PATCH 028/115] fix WSL Helm Job: poll .status.ccsStatus not .status.controlPlaneStatus for CCS CR readiness --- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index a03b32549..d8c72c400 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -193,7 +193,7 @@ spec: exit 1 fi CCS_STATUS=$(oc get ccs ccs-cr -n ${INSTANCE_NS} \ - -o jsonpath='{.status.controlPlaneStatus}' \ + -o jsonpath='{.status.ccsStatus}' \ --ignore-not-found 2>/dev/null) if [ "${CCS_STATUS}" = "Completed" ]; then echo "CCS CR is ready." From 796c2c94a6781ec5e4dfef1b6df93c1b9f1581aa Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 23:29:37 +0530 Subject: [PATCH 029/115] increase backoffLimit to 4 for all CPD 5.3.1 Helm service Jobs --- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 2 +- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 246ad32be..a27460904 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -93,5 +93,5 @@ spec: --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa - backoffLimit: 2 + backoffLimit: 4 {{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 592d18fa4..f68ad41aa 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -95,5 +95,5 @@ spec: --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa - backoffLimit: 2 + backoffLimit: 4 {{- end }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 204d8406f..969c75f1b 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -93,5 +93,5 @@ spec: --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa - backoffLimit: 2 + backoffLimit: 4 {{- end }} diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index d8c72c400..ee07620e4 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -268,5 +268,5 @@ spec: echo "================================================================" restartPolicy: Never serviceAccountName: cpd-sa - backoffLimit: 1 + backoffLimit: 4 {{- end }} From 25b432113e16a14a129eb71c7a918675cc12d6db Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 23:47:35 +0530 Subject: [PATCH 030/115] fix WSL YAML indentation: backoffLimit must align with spec fields --- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index ee07620e4..124d2deed 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -268,5 +268,5 @@ spec: echo "================================================================" restartPolicy: Never serviceAccountName: cpd-sa - backoffLimit: 4 + backoffLimit: 4 {{- end }} From b251a9a860df4447adb0ef0229bbeb988dfaefb2 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 7 Aug 2026 10:58:11 +0530 Subject: [PATCH 031/115] increase CRD wait timeout from 5min to 20min for DataRefinery and WS-Runtimes --- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 124d2deed..4138a49a8 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -216,8 +216,8 @@ spec: wait_period=0 while true; do wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." + if [ $wait_period -gt 1200 ]; then + echo "CRD not established after 20 minutes. Exiting." exit 1 fi STATUS=$(oc get crd datarefineries.datarefinery.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) @@ -241,8 +241,8 @@ spec: wait_period=0 while true; do wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." + if [ $wait_period -gt 1200 ]; then + echo "CRD not established after 20 minutes. Exiting." exit 1 fi STATUS=$(oc get crd wsruntimes.wsruntimes.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) From cd78e7335250fdba146a7b3bac10f78e22432a5a Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 7 Aug 2026 11:28:29 +0530 Subject: [PATCH 032/115] fix WSL Job: correct CRD names - datarefinery (singular) and runtimeassemblies --- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 4138a49a8..53331456c 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -212,7 +212,7 @@ spec: "datarefinery-cluster-scoped" \ "12.1.0" - echo "Waiting for datarefineries.datarefinery.cpd.ibm.com CRD to be established..." + echo "Waiting for datarefinery.datarefinery.cpd.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -220,7 +220,7 @@ spec: echo "CRD not established after 20 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd datarefineries.datarefinery.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd datarefinery.datarefinery.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "CRD established." break @@ -237,7 +237,7 @@ spec: "ws-runtimes-cluster-scoped" \ "12.1.0" - echo "Waiting for wsruntimes.wsruntimes.cpd.ibm.com CRD to be established..." + echo "Waiting for runtimeassemblies.runtimes.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -245,7 +245,7 @@ spec: echo "CRD not established after 20 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd wsruntimes.wsruntimes.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd runtimeassemblies.runtimes.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "CRD established." break From da4c3deb9fc42e72b435a2ee3d09303c32344a62 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 7 Aug 2026 14:39:23 +0530 Subject: [PATCH 033/115] fix SPSS Helm Job: increase CRD wait timeout from 5min to 20min --- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index f68ad41aa..0fe2ad430 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -67,8 +67,8 @@ spec: wait_period=0 while true; do wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." + if [ $wait_period -gt 1200 ]; then + echo "CRD not established after 20 minutes. Exiting." exit 1 fi STATUS=$(oc get crd spssmodelers.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) From 3df4a31a4759f6240384b3d6785b4bd0d8839ca1 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 7 Aug 2026 15:46:19 +0530 Subject: [PATCH 034/115] added 4th cpd service (CA) --- .../00-ibm-cognos-analytics_Subscription.yaml | 19 ++++ .../templates/01-ibm-cognos-analytics-cr.yaml | 98 +++++++++++++++++++ .../120-ibm-cognos-analytics/values.yaml | 8 ++ 3 files changed, 125 insertions(+) create mode 100644 instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml create mode 100644 instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml create mode 100644 instance-applications/120-ibm-cognos-analytics/values.yaml diff --git a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml new file mode 100644 index 000000000..169108421 --- /dev/null +++ b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml @@ -0,0 +1,19 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: cognos-analytics-subscription + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + channel: "{{ .Values.cognos_analytics_channel }}" + name: cognos-analytics-operator + source: ibm-operator-catalog + sourceNamespace: openshift-marketplace +{{- end }} diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml new file mode 100644 index 000000000..c54fb2565 --- /dev/null +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -0,0 +1,98 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +--- +apiVersion: cognosanalytics.cpd.ibm.com/v1 +kind: CognosAnalytics +metadata: + name: "cognos-analytics-sample" + namespace: "{{ .Values.cpd_instance_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + imagePullSecret: ibm-entitlement-key + ignoreForMaintenance: false + license: + accept: true + license: Standard + fileStorageClass: "{{ .Values.cpd_service_storage_class }}" + blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" + scaleConfig: "{{ .Values.cpd_service_scale_config }}" + version: "{{ .Values.cognos_analytics_version }}" + ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +# Cognos Analytics is an optional analytics and reporting service +apiVersion: batch/v1 +kind: Job +metadata: + name: install-cognos-analytics-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed + +spec: + template: + spec: + containers: + - name: helm-install + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + command: + - /bin/sh + - -c + - | + set -e + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + + echo "Installing cognos-analytics cluster-scoped chart (CRDs + ClusterRoles)..." + helm template cognos-analytics-cluster ibm-charts/cognos-analytics-cluster-scoped \ + --version 29.1.8 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for cognosanalytics.cognosanalytics.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd cognosanalytics.cognosanalytics.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing cognos-analytics namespace-scoped chart (operator + CR)..." + helm upgrade --install cognos-analytics ibm-charts/cognos-analytics \ + --version 29.1.8 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set cognosanalytics.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 60m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 4 +{{- end }} diff --git a/instance-applications/120-ibm-cognos-analytics/values.yaml b/instance-applications/120-ibm-cognos-analytics/values.yaml new file mode 100644 index 000000000..19981f481 --- /dev/null +++ b/instance-applications/120-ibm-cognos-analytics/values.yaml @@ -0,0 +1,8 @@ +--- +ccs_version: "" +cpd_service_block_storage_class: "" +cpd_service_scale_config: "" +cpd_service_storage_class: "" +cognos_analytics_channel: "" +cognos_analytics_version: "" +cpd_product_version: "" From 6d28a85b0ed2861b26dc813667c2ebe33eaec049 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 10:11:17 +0530 Subject: [PATCH 035/115] Remove SPSS CPD service - focus on Cognos Analytics only --- instance-applications/120-ibm-spss/Chart.yaml | 11 --- instance-applications/120-ibm-spss/README.md | 62 ------------ .../templates/00-ibm-spss_Subscription.yaml | 39 -------- .../templates/01-ibm-spss-cr.yaml | 99 ------------------- .../120-ibm-spss/values.yaml | 8 -- 5 files changed, 219 deletions(-) delete mode 100644 instance-applications/120-ibm-spss/Chart.yaml delete mode 100644 instance-applications/120-ibm-spss/README.md delete mode 100644 instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml delete mode 100644 instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml delete mode 100644 instance-applications/120-ibm-spss/values.yaml diff --git a/instance-applications/120-ibm-spss/Chart.yaml b/instance-applications/120-ibm-spss/Chart.yaml deleted file mode 100644 index 9c9f81ec4..000000000 --- a/instance-applications/120-ibm-spss/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: ibm-spss -description: SPSS Modeler -type: application -version: 1.0.0 - -dependencies: -- name: junitreporter - version: 1.0.0 - repository: "file://../../sub-charts/junitreporter/" - condition: junitreporter.devops_mongo_uri != "" \ No newline at end of file diff --git a/instance-applications/120-ibm-spss/README.md b/instance-applications/120-ibm-spss/README.md deleted file mode 100644 index 094e3e453..000000000 --- a/instance-applications/120-ibm-spss/README.md +++ /dev/null @@ -1,62 +0,0 @@ -SPSS Modeler -=============================================================================== -Deploys and configures the CP4D Service, SPSS Modeler. - - - - -[SPSS Modeler](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.8.x?topic=modeler-installing) optional dependency for [Predict](https://www.ibm.com/docs/en/mas-cd/mhmpmh-and-p-u/continuous-delivery) - -## Resources Created - -| Resource Type | Resource Name | Namespace | Condition | Installed By | -|--------------|---------------|-----------|-----------|--------------| -| `Subscription` | SPSS operator subscriptions | CP4D instance namespace | Always | `application_admin_role` | -| `Spss` | SPSS service CR | CP4D instance namespace | Always | `application_admin_role` | - -## Configuration - -This chart accepts the following configuration values in the ArgoCD Application values: - -```yaml -ibm_spss: - ccs_version: string (secret reference) - cpd_service_block_storage_class: string - cpd_service_scale_config: string - cpd_service_storage_class: string - spss_channel: string (secret reference) - spss_version: string (secret reference) - spss_install_plan: string - canvasbase_channel: string (secret reference) - canvasbase_install_plan: string -``` - -**Note**: Values marked with "(secret reference)" should use the format `` to reference secrets stored in the Secrets Vault. - -## Base Instance Values - -This chart inherits common instance configuration values. The most frequently used base values are: - -```yaml -account: - id: string # Account identifier - name: string # Account name - -region: - id: string # Region identifier - name: string # Region name - -cluster: - id: string # Cluster identifier - name: string # Cluster name - -instance: - id: string # MAS instance identifier - -sm: # Secrets Manager configuration - aws_secret_region: string - aws_access_key_id: string (secret reference) - aws_secret_access_key: string (secret reference) -``` - -For complete documentation of all base instance values including optional fields like `custom_labels`, `argocluster_instance`, `application_admin_service_account`, `mas_wipe_mongo_data`, `allow_list`, `additional_vpn`, `application_configuration`, `use_postdelete_hooks`, `additional_resources`, `extensions`, `enhanced_dr`, and `cli_image_repo`, see the [Instance Base Values Reference](../../docs/reference/instance-base-values.md). diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml deleted file mode 100644 index d54dac607..000000000 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ /dev/null @@ -1,39 +0,0 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: "cpd-spss-operator" - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - name: "ibm-cpd-spss" - channel: "{{ .Values.spss_channel }}" - source: ibm-operator-catalog - sourceNamespace: openshift-marketplace - installPlanApproval: {{ .Values.spss_install_plan | default "Automatic" | quote }} - ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: "ibm-cpd-canvasbase-operator-catalog-subscription" # needed only by spss - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - name: "ibm-cpd-canvasbase" - channel: "{{ .Values.canvasbase_channel }}" - source: ibm-operator-catalog - sourceNamespace: openshift-marketplace - installPlanApproval: {{ .Values.canvasbase_install_plan | default "Automatic" | quote }} -{{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml deleted file mode 100644 index 0fe2ad430..000000000 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ /dev/null @@ -1,99 +0,0 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} ---- -apiVersion: spssmodeler.cpd.ibm.com/v1 -kind: Spss -metadata: - name: "spss-sample" - namespace: "{{ .Values.cpd_instance_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - imagePullSecret: ibm-entitlement-key - ignoreForMaintenance: false - license: - accept: true - license: Standard - scaleConfig: "{{ .Values.cpd_service_scale_config }}" - fileStorageClass: "{{ .Values.cpd_service_storage_class }}" - blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" - version: "{{ .Values.spss_version }}" - ccs_operand_version: "{{ .Values.ccs_version }}" - datarefinery_operand_version: "{{ .Values.datarefinery_version }}" - wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" -{{- else }} ---- -# Helm-based installation for CPD 5.3.1+ -apiVersion: batch/v1 -kind: Job -metadata: - name: install-spss-helm - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/hook: Sync - - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed - -spec: - template: - spec: - containers: - - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 - command: - - /bin/sh - - -c - - | - set -e - helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm - helm repo update - - echo "Installing spss-modeler cluster-scoped chart (CRDs + ClusterRoles)..." - helm template spss-modeler-cluster ibm-charts/spss-modeler-cluster-scoped \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Waiting for spssmodelers.spssmodeler.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 1200 ]; then - echo "CRD not established after 20 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd spssmodelers.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - echo "Installing spss-modeler namespace-scoped chart (operator + CR)..." - helm upgrade --install spss-modeler ibm-charts/spss-modeler \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --set spssmodeler.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 60m - restartPolicy: Never - serviceAccountName: cpd-sa - backoffLimit: 4 -{{- end }} diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml deleted file mode 100644 index b7c0618d7..000000000 --- a/instance-applications/120-ibm-spss/values.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -ccs_version: "" -cpd_service_block_storage_class: "" -cpd_service_scale_config: "" -cpd_service_storage_class: "" -spss_channel: "" -spss_version: "" -cpd_product_version: "" From 7621047450d5fb66b5a291c01355d94e63f4703c Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 12:04:48 +0530 Subject: [PATCH 036/115] Add Cognos Analytics ArgoCD Application definition to instance root --- .../120-ibm-cognos-analytics-app.yaml | 83 +++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml new file mode 100644 index 000000000..9c29b0c07 --- /dev/null +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -0,0 +1,83 @@ +{{- if and (not (empty .Values.ibm_cognos_analytics)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} +{{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +--- +# IBM Cognos Analytics Application +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cognos.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "120" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + repoURL: "{{ .Values.source.repo_url }}" + path: instance-applications/120-ibm-cognos-analytics + targetRevision: "{{ .Values.source.revision }}" + plugin: + name: {{ .Values.avp.name }} + env: + - name: {{ .Values.avp.values_varname }} + value: | + account_id: "{{ .Values.account.id }}" + region_id: "{{ .Values.region.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + cli_image_repo: {{ .Values.cli_image_repo }} + cluster_admin_role: {{ .Values.cluster_admin_role }} + application_admin_role: {{ .Values.application_admin_role }} + sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" + sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" + cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" + cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" + cpd_service_storage_class: "{{ .Values.ibm_cognos_analytics.cpd_service_storage_class }}" + cpd_service_block_storage_class: "{{ .Values.ibm_cognos_analytics.cpd_service_block_storage_class }}" + cpd_service_scale_config: "{{ .Values.ibm_cognos_analytics.cpd_service_scale_config }}" + ccs_version: "{{ .Values.ibm_cognos_analytics.ccs_version }}" + {{- if .Values.custom_labels }} + custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} + {{- end }} + junitreporter: + reporter_name: "ibm-cognos-analytics-{{ .Values.instance.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" + devops_build_number: "{{ .Values.devops.build_number }}" + gitops_version: "{{ .Values.source.revision }}" + cli_image_repo: {{ .Values.cli_image_repo }} + - name: ARGOCD_APP_NAME + value: cpdcognosapp + {{- if not (empty .Values.avp.secret) }} + - name: AVP_SECRET + value: {{ .Values.avp.secret }} + {{- end }} + syncPolicy: + automated: + {{- if .Values.auto_delete }} + prune: true + {{- end }} + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false +{{- end }} From 5d69bf498419e660b21a83feee225d2035e6de7a Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 12:16:24 +0530 Subject: [PATCH 037/115] Remove SPSS application definition - SPSS service deleted --- .../templates/120-ibm-spss-app.yaml | 87 ------------------- 1 file changed, 87 deletions(-) delete mode 100644 root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml deleted file mode 100644 index 03b5be98a..000000000 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ /dev/null @@ -1,87 +0,0 @@ -{{- if and (not (empty .Values.ibm_spss)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} -{{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} ---- -# IBM Maximo Operator Catalog -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: spss.{{ .Values.cluster.id }}.{{ .Values.instance.id }} - namespace: {{ .Values.argo.namespace }} - labels: - environment: '{{ .Values.account.id }}' - region: '{{ .Values.region.id }}' - cluster: '{{ .Values.cluster.id }}' - {{- if .Values.argo.instance }} - argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' - {{- end }} - instance: '{{ .Values.instance.id }}' - annotations: - argocd.argoproj.io/sync-wave: "120" - {{- if and .Values.notifications .Values.notifications.slack_channel_id }} - notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} - notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} - {{- end }} - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: "{{ .Values.argo.projects.apps }}" - destination: - server: {{ .Values.cluster.url }} - namespace: {{ $cpd_operators_ns }} - source: - repoURL: "{{ .Values.source.repo_url }}" - path: instance-applications/120-ibm-spss - targetRevision: "{{ .Values.source.revision }}" - plugin: - name: {{ .Values.avp.name }} - env: - - name: {{ .Values.avp.values_varname }} - value: | - account_id: "{{ .Values.account.id }}" - region_id: "{{ .Values.region.id }}" - cluster_id: "{{ .Values.cluster.id }}" - instance_id: "{{ .Values.instance.id }}" - cluster_admin_role: {{ .Values.cluster_admin_role }} - application_admin_role: {{ .Values.application_admin_role }} - sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" - sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" - cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" - cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" - cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" - cpd_service_storage_class: "{{ .Values.ibm_spss.cpd_service_storage_class }}" - cpd_service_block_storage_class: "{{ .Values.ibm_spss.cpd_service_block_storage_class }}" - cpd_service_scale_config: "{{ .Values.ibm_spss.cpd_service_scale_config }}" - spss_version: "{{ .Values.ibm_spss.spss_version }}" - spss_channel: "{{ .Values.ibm_spss.spss_channel }}" - spss_install_plan: "{{ .Values.ibm_spss.spss_install_plan }}" - ccs_version: "{{ .Values.ibm_spss.ccs_version }}" - canvasbase_channel: "{{ .Values.ibm_spss.canvasbase_channel }}" - canvasbase_install_plan: "{{ .Values.ibm_spss.canvasbase_install_plan }}" - {{- if .Values.custom_labels }} - custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} - {{- end }} - junitreporter: - reporter_name: "ibm-spss-{{ .Values.instance.id }}" - cluster_id: "{{ .Values.cluster.id }}" - instance_id: "{{ .Values.instance.id }}" - devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" - devops_build_number: "{{ .Values.devops.build_number }}" - gitops_version: "{{ .Values.source.revision }}" - cli_image_repo: {{ .Values.cli_image_repo }} - - name: ARGOCD_APP_NAME - value: cpdspssapp - {{- if not (empty .Values.avp.secret) }} - - name: AVP_SECRET - value: {{ .Values.avp.secret }} - {{- end }} - syncPolicy: - automated: - {{- if .Values.auto_delete }} - prune: true - {{- end }} - selfHeal: true - retry: - limit: 20 - syncOptions: - - CreateNamespace=false -{{- end }} \ No newline at end of file From a59cb950884f24cbcc4e747fcb2b4c3d8e5740fb Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 12:23:00 +0530 Subject: [PATCH 038/115] Fix Cognos Analytics Application - use default values, remove ibm_cognos_analytics dependency --- .../templates/120-ibm-cognos-analytics-app.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index 9c29b0c07..a025e0711 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -1,4 +1,4 @@ -{{- if and (not (empty .Values.ibm_cognos_analytics)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} +{{- if and (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} --- # IBM Cognos Analytics Application @@ -49,10 +49,10 @@ spec: cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" - cpd_service_storage_class: "{{ .Values.ibm_cognos_analytics.cpd_service_storage_class }}" - cpd_service_block_storage_class: "{{ .Values.ibm_cognos_analytics.cpd_service_block_storage_class }}" - cpd_service_scale_config: "{{ .Values.ibm_cognos_analytics.cpd_service_scale_config }}" - ccs_version: "{{ .Values.ibm_cognos_analytics.ccs_version }}" + cpd_service_storage_class: "{{ .Values.ibm_cp4d.cpd_service_storage_class | default \"nfs-client\" }}" + cpd_service_block_storage_class: "{{ .Values.ibm_cp4d.cpd_service_block_storage_class | default \"nfs-client\" }}" + cpd_service_scale_config: "{{ .Values.ibm_cp4d.cpd_service_scale_config | default \"small\" }}" + ccs_version: "{{ .Values.ibm_cp4d.ccs_version | default \"12.1.0\" }}" {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} {{- end }} From 309fbaceeb5d7205c20f5392b9d886d2a524d665 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 12:42:34 +0530 Subject: [PATCH 039/115] MASCORE-15507: Fix parse error caused by escaped quotes in default values --- .../templates/120-ibm-cognos-analytics-app.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index a025e0711..2143a7188 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -49,10 +49,10 @@ spec: cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" - cpd_service_storage_class: "{{ .Values.ibm_cp4d.cpd_service_storage_class | default \"nfs-client\" }}" - cpd_service_block_storage_class: "{{ .Values.ibm_cp4d.cpd_service_block_storage_class | default \"nfs-client\" }}" - cpd_service_scale_config: "{{ .Values.ibm_cp4d.cpd_service_scale_config | default \"small\" }}" - ccs_version: "{{ .Values.ibm_cp4d.ccs_version | default \"12.1.0\" }}" + cpd_service_storage_class: "{{ .Values.ibm_cp4d.cpd_service_storage_class | default "nfs-client" }}" + cpd_service_block_storage_class: "{{ .Values.ibm_cp4d.cpd_service_block_storage_class | default "nfs-client" }}" + cpd_service_scale_config: "{{ .Values.ibm_cp4d.cpd_service_scale_config | default "small" }}" + ccs_version: "{{ .Values.ibm_cp4d.ccs_version | default "12.1.0" }}" {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} {{- end }} From 28fe970885e9d97800c016609a15b9bd08cefda6 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 13:00:54 +0530 Subject: [PATCH 040/115] MASCORE-15507: Add missing Chart.yaml for ibm-cognos-analytics chart --- .../120-ibm-cognos-analytics/Chart.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 instance-applications/120-ibm-cognos-analytics/Chart.yaml diff --git a/instance-applications/120-ibm-cognos-analytics/Chart.yaml b/instance-applications/120-ibm-cognos-analytics/Chart.yaml new file mode 100644 index 000000000..44c18d098 --- /dev/null +++ b/instance-applications/120-ibm-cognos-analytics/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: ibm-cognos-analytics +description: IBM Cognos Analytics +type: application +version: 1.0.0 + +dependencies: +- name: junitreporter + version: 1.0.0 + repository: "file://../../sub-charts/junitreporter/" + condition: junitreporter.devops_mongo_uri != "" From f1acbf52cef76037cfe3033bffe546c4ae6a559f Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 13:42:57 +0530 Subject: [PATCH 041/115] MASCORE-15507: Add ibm-redis-cp operator Subscription for CPD 5.3.1+ WML The WmlBase CR was failing with: 'Failed to find exact match for redis.ibm.com/v1.Rediscp' The WML operator Ansible playbook requires the IBM Redis CP operator (ibm-redis-cp) to be installed. For CPD < 5.3.1 this was handled via OLM, but the Helm-based path for CPD >= 5.3.1 had no Subscription for ibm-redis-cp, leaving the Rediscp CRD uninstalled. Changes: - Add ibm-redis-cp Subscription to 09-ibm-cp4d_services_base.yaml, gated on wml_channel being set and CPD version >= 5.3.1 - Add ibm_redis_cp_channel and ibm_redis_cp_install_plan to 110-ibm-cp4d/values.yaml - Pass ibm_redis_cp_channel and ibm_redis_cp_install_plan through 110-ibm-cp4d-app.yaml from ibm_cp4d_services_base config block - Regenerate RBAC rules --- .../templates/09-ibm-cp4d_services_base.yaml | 23 +++++++++++++++++++ .../110-ibm-cp4d/values.yaml | 2 ++ .../templates/per-namespace-rbac.yaml | 1 + .../base/application-admin-role.yaml | 1 + .../templates/110-ibm-cp4d-app.yaml | 2 ++ 5 files changed, 29 insertions(+) diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml index cb0ec381b..38b3cfc95 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml @@ -146,6 +146,29 @@ spec: backoffLimit: 4 + +{{- if and .Values.wml_channel (not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0)) }} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: ibm-redis-cp-operator + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "090" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + channel: "{{ .Values.ibm_redis_cp_channel }}" + installPlanApproval: {{ .Values.ibm_redis_cp_install_plan | default "Automatic" | quote }} + name: ibm-redis-cp + source: ibm-operator-catalog + sourceNamespace: openshift-marketplace +{{- end }} + + {{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} {{- if or .Values.wml_channel .Values.wsl_channel .Values.spss_channel }} --- diff --git a/instance-applications/110-ibm-cp4d/values.yaml b/instance-applications/110-ibm-cp4d/values.yaml index 631fbe216..8ac4c34d3 100644 --- a/instance-applications/110-ibm-cp4d/values.yaml +++ b/instance-applications/110-ibm-cp4d/values.yaml @@ -10,3 +10,5 @@ cpd_product_version: "" cpd_iam_integration: false cpd_primary_storage_class: "" cpd_metadata_storage_class: "" +ibm_redis_cp_channel: "" +ibm_redis_cp_install_plan: "" diff --git a/instance-applications/600-application-admin-rbac/templates/per-namespace-rbac.yaml b/instance-applications/600-application-admin-rbac/templates/per-namespace-rbac.yaml index 73e72ce7f..c2f8f96c4 100644 --- a/instance-applications/600-application-admin-rbac/templates/per-namespace-rbac.yaml +++ b/instance-applications/600-application-admin-rbac/templates/per-namespace-rbac.yaml @@ -122,6 +122,7 @@ rules: - apiGroups: - config.mas.ibm.com resources: + - aicfgs - appcfgs - bascfgs - idpcfgs diff --git a/rbac/kustomize/base/application-admin-role.yaml b/rbac/kustomize/base/application-admin-role.yaml index 4ca7260b7..110749def 100644 --- a/rbac/kustomize/base/application-admin-role.yaml +++ b/rbac/kustomize/base/application-admin-role.yaml @@ -95,6 +95,7 @@ rules: - apiGroups: - config.mas.ibm.com resources: + - aicfgs - appcfgs - bascfgs - idpcfgs diff --git a/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml b/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml index 490ccef2b..a7af31521 100644 --- a/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml @@ -94,6 +94,8 @@ spec: opencontent_opensearch_channel: "{{ .Values.ibm_cp4d_services_base.opencontent_opensearch_channel }}" elasticsearch_install_plan: "{{ .Values.ibm_cp4d_services_base.elasticsearch_install_plan }}" opensearch_install_plan: "{{ .Values.ibm_cp4d_services_base.opensearch_install_plan }}" + ibm_redis_cp_channel: "{{ .Values.ibm_cp4d_services_base.ibm_redis_cp_channel }}" + ibm_redis_cp_install_plan: "{{ .Values.ibm_cp4d_services_base.ibm_redis_cp_install_plan }}" {{- end }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} From 7e1636b708b7fd585547919b9c9844f7a52b392d Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 15:50:56 +0530 Subject: [PATCH 042/115] MASCORE-15507: Fix ibm-redis-cp install - use Helm not OLM Subscription The IBM Maximo catalog does not contain an ibm-redis-cp OLM package. The previous fix (OLM Subscription) was wrong for this environment. ibm-redis-cp for CPD 5.3.1 must be installed via Helm, the same way WML itself is installed. Changes: - Remove the ibm-redis-cp OLM Subscription added in previous commit (no such package exists in ibm-operator-catalog on this cluster) - Revert ibm_redis_cp_channel/install_plan values and root app changes - Add ibm-redis-cp Helm install steps to the existing install-wml-helm job in 02-ibm-wml-cr.yaml, running before WML itself so the Rediscp CRD is established before the WmlBase CR reconcile begins - Regenerate RBAC rules --- .../templates/09-ibm-cp4d_services_base.yaml | 22 ------------ .../110-ibm-cp4d/values.yaml | 2 -- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 34 +++++++++++++++++++ .../templates/110-ibm-cp4d-app.yaml | 2 -- 4 files changed, 34 insertions(+), 26 deletions(-) diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml index 38b3cfc95..ed8eb2cff 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml @@ -147,28 +147,6 @@ spec: -{{- if and .Values.wml_channel (not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0)) }} ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: ibm-redis-cp-operator - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "090" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - channel: "{{ .Values.ibm_redis_cp_channel }}" - installPlanApproval: {{ .Values.ibm_redis_cp_install_plan | default "Automatic" | quote }} - name: ibm-redis-cp - source: ibm-operator-catalog - sourceNamespace: openshift-marketplace -{{- end }} - - {{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} {{- if or .Values.wml_channel .Values.wsl_channel .Values.spss_channel }} --- diff --git a/instance-applications/110-ibm-cp4d/values.yaml b/instance-applications/110-ibm-cp4d/values.yaml index 8ac4c34d3..631fbe216 100644 --- a/instance-applications/110-ibm-cp4d/values.yaml +++ b/instance-applications/110-ibm-cp4d/values.yaml @@ -10,5 +10,3 @@ cpd_product_version: "" cpd_iam_integration: false cpd_primary_storage_class: "" cpd_metadata_storage_class: "" -ibm_redis_cp_channel: "" -ibm_redis_cp_install_plan: "" diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 969c75f1b..e7fb9a3f9 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -51,6 +51,40 @@ spec: helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm helm repo update + echo "Installing ibm-redis-cp cluster-scoped chart (CRDs + ClusterRoles)..." + helm template ibm-redis-cp-cluster ibm-charts/ibm-redis-cp-cluster-scoped \ + --version 1.6.11 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Installing ibm-redis-cp namespace-scoped chart (operator)..." + helm upgrade --install ibm-redis-cp ibm-charts/ibm-redis-cp \ + --version 1.6.11 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key + + echo "Waiting for redicps.redis.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "Rediscp CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd redicps.redis.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "Rediscp CRD established." + break + fi + sleep 10 + done + echo "Installing wml cluster-scoped chart (CRDs + ClusterRoles)..." helm template wml-cluster ibm-charts/wml-cluster-scoped \ --version 12.1.0 \ diff --git a/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml b/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml index a7af31521..490ccef2b 100644 --- a/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml @@ -94,8 +94,6 @@ spec: opencontent_opensearch_channel: "{{ .Values.ibm_cp4d_services_base.opencontent_opensearch_channel }}" elasticsearch_install_plan: "{{ .Values.ibm_cp4d_services_base.elasticsearch_install_plan }}" opensearch_install_plan: "{{ .Values.ibm_cp4d_services_base.opensearch_install_plan }}" - ibm_redis_cp_channel: "{{ .Values.ibm_cp4d_services_base.ibm_redis_cp_channel }}" - ibm_redis_cp_install_plan: "{{ .Values.ibm_cp4d_services_base.ibm_redis_cp_install_plan }}" {{- end }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} From 89f7365b248c7cd66f1f57d4b5ff733e521d955e Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 16:25:32 +0530 Subject: [PATCH 043/115] MASCORE-15507: Keep failed install-wml-helm pod for log inspection Temporarily remove HookFailed from delete policy so failed pods stay alive long enough to read their logs and diagnose the ibm-redis-cp Helm chart name issue. --- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index e7fb9a3f9..8581eedee 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -34,8 +34,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed + argocd.argoproj.io/hook-delete-policy: HookSucceeded spec: template: From cafe354e84cfd3b8a13f0764810703300523a599 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 17:03:02 +0530 Subject: [PATCH 044/115] MASCORE-15507: Fix ibm-redis-cp Helm chart version to 1.3.1 Version 1.6.11 does not exist in ibm-charts repo. Available versions are 1.3.1 and 1.4.0. Using 1.3.1 to match the sub_channel v1.3 defined in olm-utils-cm for CPD 5.3.1. --- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 8581eedee..1455b79b5 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -52,7 +52,7 @@ spec: echo "Installing ibm-redis-cp cluster-scoped chart (CRDs + ClusterRoles)..." helm template ibm-redis-cp-cluster ibm-charts/ibm-redis-cp-cluster-scoped \ - --version 1.6.11 \ + --version 1.3.1 \ --namespace {{ .Values.cpd_operators_namespace }} \ --set global.licenseAccept=true \ --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ @@ -61,7 +61,7 @@ spec: echo "Installing ibm-redis-cp namespace-scoped chart (operator)..." helm upgrade --install ibm-redis-cp ibm-charts/ibm-redis-cp \ - --version 1.6.11 \ + --version 1.3.1 \ --namespace {{ .Values.cpd_operators_namespace }} \ --set global.licenseAccept=true \ --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ From f45914d113966a02273ab275d20a3c63d99e8b8c Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 17:30:14 +0530 Subject: [PATCH 045/115] MASCORE-15507: Fix install-wml-helm Job - hash-based name and cleanup on failure --- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 1455b79b5..18ca565bc 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -26,22 +26,28 @@ spec: {{- else }} --- # Helm-based installation for CPD 5.3.1+ +{{- $_job_name_prefix := "install-wml-helm" }} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_job_config_values := omit .Values "junitreporter" }} +{{- $_job_version := "v1" }} +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} apiVersion: batch/v1 kind: Job metadata: - name: install-wml-helm + name: {{ $_job_name }} namespace: "{{ .Values.cpd_operators_namespace }}" annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed spec: template: spec: containers: - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} command: - /bin/sh - -c From 9f7b76c07ebb35feff751abc56808b43141b8ec7 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 17:45:53 +0530 Subject: [PATCH 046/115] MASCORE-15507: Fix typo redicps -> rediscps in CRD poll, bump job version to v2 --- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 18ca565bc..49cb50c0f 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -29,7 +29,7 @@ spec: {{- $_job_name_prefix := "install-wml-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v1" }} +{{- $_job_version := "v2" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} apiVersion: batch/v1 @@ -74,7 +74,7 @@ spec: --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ --set global.imagePullSecret=ibm-entitlement-key - echo "Waiting for redicps.redis.ibm.com CRD to be established..." + echo "Waiting for rediscps.redis.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -82,7 +82,7 @@ spec: echo "Rediscp CRD not established after 5 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd redicps.redis.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd rediscps.redis.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "Rediscp CRD established." break From 4a3203e80bf29b6ed19401198f144675e9f9bc17 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 19:01:13 +0530 Subject: [PATCH 047/115] MASCORE-15507: Add hashed job name and cleanup-group label to cognos-analytics helm install job --- .../templates/01-ibm-cognos-analytics-cr.yaml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index c54fb2565..df19bf161 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -27,23 +27,30 @@ spec: --- # Helm-based installation for CPD 5.3.1+ # Cognos Analytics is an optional analytics and reporting service +{{- $_job_name_prefix := "install-cognos-helm" }} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_job_config_values := omit .Values "junitreporter" }} +{{- $_job_version := "v1" }} +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} +{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} apiVersion: batch/v1 kind: Job metadata: - name: install-cognos-analytics-helm + name: {{ $_job_name }} namespace: "{{ .Values.cpd_operators_namespace }}" + labels: + mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed - spec: template: spec: containers: - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} command: - /bin/sh - -c From 4ec13b45da30a399df5ba2510d2b44f7b9b79956 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 19:40:05 +0530 Subject: [PATCH 048/115] MASCORE-15507: Fix CRD poll name for cognos-analytics, bump job version to v2 --- .../templates/01-ibm-cognos-analytics-cr.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index df19bf161..de5025325 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -30,7 +30,7 @@ spec: {{- $_job_name_prefix := "install-cognos-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v1" }} +{{- $_job_version := "v2" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -69,7 +69,7 @@ spec: --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - echo "Waiting for cognosanalytics.cognosanalytics.cpd.ibm.com CRD to be established..." + echo "Waiting for caservices.ca.cpd.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -77,7 +77,7 @@ spec: echo "CRD not established after 5 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd cognosanalytics.cognosanalytics.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd caservices.ca.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "CRD established." break From 7991777eb74bb3bf9830e180a27bb5b526ff9de2 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 21:26:06 +0530 Subject: [PATCH 049/115] MASCORE-15507: Revert unrelated SLS pod templates changes --- instance-applications/100-ibm-sls/README.md | 4 ---- .../100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml | 4 ---- 2 files changed, 8 deletions(-) diff --git a/instance-applications/100-ibm-sls/README.md b/instance-applications/100-ibm-sls/README.md index f0845de86..78ae3fbec 100644 --- a/instance-applications/100-ibm-sls/README.md +++ b/instance-applications/100-ibm-sls/README.md @@ -69,10 +69,6 @@ ibm_sls: - alias: string crt: string (multiline) - # Pod Templates (optional) - sls_pod_templates: - key: value - # Certificate Authority (optional) internal_certificate_authority: string ``` diff --git a/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml b/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml index 2277794be..b5b8b3aa8 100644 --- a/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml +++ b/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml @@ -17,10 +17,6 @@ spec: {{ .Values.mongo_spec | toYaml | indent 4 }} license: accept: true -{{- if not (empty .Values.sls_pod_templates) }} - podTemplates: -{{ .Values.sls_pod_templates | toYaml | indent 4 }} -{{- end }} settings: auth: enforce: true From 3b8775300e30836232fc6486ea68d59f9ce387af Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 21:43:57 +0530 Subject: [PATCH 050/115] MASCORE-15507: Revert unrelated SLS pod templates changes; add SPSS Modeler chart with CPD 5.3.1 Helm support --- instance-applications/120-ibm-spss/Chart.yaml | 11 ++ .../templates/00-ibm-spss_Subscription.yaml | 19 ++++ .../templates/01-ibm-spss-cr.yaml | 104 ++++++++++++++++++ .../120-ibm-spss/values.yaml | 8 ++ .../templates/120-ibm-spss-app.yaml | 85 ++++++++++++++ .../templates/100-ibm-sls-app.yaml | 3 - .../templates/06-ibm-sls_LicenseService.yaml | 4 - 7 files changed, 227 insertions(+), 7 deletions(-) create mode 100644 instance-applications/120-ibm-spss/Chart.yaml create mode 100644 instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml create mode 100644 instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml create mode 100644 instance-applications/120-ibm-spss/values.yaml create mode 100644 root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml diff --git a/instance-applications/120-ibm-spss/Chart.yaml b/instance-applications/120-ibm-spss/Chart.yaml new file mode 100644 index 000000000..9f703e5fb --- /dev/null +++ b/instance-applications/120-ibm-spss/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: ibm-spss +description: SPSS Modeler +type: application +version: 1.0.0 + +dependencies: +- name: junitreporter + version: 1.0.0 + repository: "file://../../sub-charts/junitreporter/" + condition: junitreporter.devops_mongo_uri != "" diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml new file mode 100644 index 000000000..5d5fd60f8 --- /dev/null +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -0,0 +1,19 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: spss-modeler-subscription + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + channel: "{{ .Values.spss_channel }}" + name: spss-modeler + source: ibm-operator-catalog + sourceNamespace: openshift-marketplace +{{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml new file mode 100644 index 000000000..f27800f64 --- /dev/null +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -0,0 +1,104 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +--- +apiVersion: spssmodeler.cpd.ibm.com/v1 +kind: SPSSModeler +metadata: + name: "spssmodeler-cr" + namespace: "{{ .Values.cpd_instance_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + imagePullSecret: ibm-entitlement-key + ignoreForMaintenance: false + license: + accept: true + license: Standard + fileStorageClass: "{{ .Values.cpd_service_storage_class }}" + blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" + scaleConfig: "{{ .Values.cpd_service_scale_config }}" + version: "{{ .Values.spss_version }}" + ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +{{- $_job_name_prefix := "install-spss-helm" }} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_job_config_values := omit .Values "junitreporter" }} +{{- $_job_version := "v1" }} +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} +{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ $_job_name }} + namespace: "{{ .Values.cpd_operators_namespace }}" + labels: + mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed +spec: + template: + spec: + containers: + - name: helm-install + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} + command: + - /bin/sh + - -c + - | + set -e + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + + echo "Installing spss-modeler cluster-scoped chart (CRDs + ClusterRoles)..." + helm template spss-modeler-cluster ibm-charts/spss-modeler-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for spssmodelerbases.spssmodeler.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd spssmodelerbases.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing spss-modeler namespace-scoped chart (operator + CR)..." + helm upgrade --install spss-modeler ibm-charts/spss-modeler \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set spssmodeler.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 60m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 4 +{{- end }} diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml new file mode 100644 index 000000000..b7c0618d7 --- /dev/null +++ b/instance-applications/120-ibm-spss/values.yaml @@ -0,0 +1,8 @@ +--- +ccs_version: "" +cpd_service_block_storage_class: "" +cpd_service_scale_config: "" +cpd_service_storage_class: "" +spss_channel: "" +spss_version: "" +cpd_product_version: "" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml new file mode 100644 index 000000000..ed753aca9 --- /dev/null +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -0,0 +1,85 @@ +{{- if and (not (empty .Values.ibm_spss)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} +{{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +--- +# IBM SPSS Modeler Application +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spss.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "120" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + repoURL: "{{ .Values.source.repo_url }}" + path: instance-applications/120-ibm-spss + targetRevision: "{{ .Values.source.revision }}" + plugin: + name: {{ .Values.avp.name }} + env: + - name: {{ .Values.avp.values_varname }} + value: | + account_id: "{{ .Values.account.id }}" + region_id: "{{ .Values.region.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + cli_image_repo: {{ .Values.cli_image_repo }} + cluster_admin_role: {{ .Values.cluster_admin_role }} + application_admin_role: {{ .Values.application_admin_role }} + sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" + sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" + cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" + cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" + cpd_service_storage_class: "{{ .Values.ibm_spss.cpd_service_storage_class }}" + cpd_service_block_storage_class: "{{ .Values.ibm_spss.cpd_service_block_storage_class }}" + cpd_service_scale_config: "{{ .Values.ibm_spss.cpd_service_scale_config }}" + spss_version: "{{ .Values.ibm_spss.spss_version }}" + spss_channel: "{{ .Values.ibm_spss.spss_channel }}" + ccs_version: "{{ .Values.ibm_spss.ccs_version }}" + {{- if .Values.custom_labels }} + custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} + {{- end }} + junitreporter: + reporter_name: "ibm-spss-{{ .Values.instance.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" + devops_build_number: "{{ .Values.devops.build_number }}" + gitops_version: "{{ .Values.source.revision }}" + cli_image_repo: {{ .Values.cli_image_repo }} + - name: ARGOCD_APP_NAME + value: cpdspssapp + {{- if not (empty .Values.avp.secret) }} + - name: AVP_SECRET + value: {{ .Values.avp.secret }} + {{- end }} + syncPolicy: + automated: + {{- if .Values.auto_delete }} + prune: true + {{- end }} + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false +{{- end }} diff --git a/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml b/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml index d852e67c4..71c353c2b 100644 --- a/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml +++ b/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml @@ -78,9 +78,6 @@ spec: devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" devops_build_number: "{{ .Values.devops.build_number }}" gitops_version: "{{ .Values.source.revision }}" - {{- if .Values.ibm_sls_standalone.sls_pod_templates }} - sls_pod_templates: {{ .Values.ibm_sls_standalone.sls_pod_templates | toYaml | nindent 14 }} - {{- end }} {{- if .Values.ibm_sls_standalone.internal_certificate_authority }} internal_certificate_authority: "{{ .Values.ibm_sls_standalone.internal_certificate_authority }}" {{- end }} diff --git a/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml b/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml index 3914dc7d8..276cbc3f1 100644 --- a/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml +++ b/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml @@ -18,10 +18,6 @@ spec: {{ .Values.mongo_spec | toYaml | indent 4 }} license: accept: true -{{- if not (empty .Values.sls_pod_templates) }} - podTemplates: -{{ .Values.sls_pod_templates | toYaml | indent 4 }} -{{- end }} settings: auth: enforce: true From 14709be5fffca71e113af5c1cbd935b09b596466 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 21:50:24 +0530 Subject: [PATCH 051/115] MASCORE-15507: Revert unrelated SLS pod templates change from instance-root --- .../ibm-mas-instance-root/templates/100-ibm-sls-app.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml b/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml index e3ce37274..e1d364f59 100644 --- a/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml @@ -80,9 +80,6 @@ spec: devops_build_number: "{{ .Values.devops.build_number }}" gitops_version: "{{ .Values.source.revision }}" cli_image_repo: {{ .Values.cli_image_repo }} - {{- if .Values.ibm_sls.sls_pod_templates }} - sls_pod_templates: {{ .Values.ibm_sls.sls_pod_templates | toYaml | nindent 14 }} - {{- end }} {{- if .Values.ibm_sls.internal_certificate_authority }} internal_certificate_authority: "{{ .Values.ibm_sls.internal_certificate_authority }}" {{- end }} From 362022cd9cec5d073bd6332dd2563fc4f34e33e4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 22:01:46 +0530 Subject: [PATCH 052/115] MASCORE-15507: Fix SPSS Helm chart names (spss-cluster-scoped/spss v13.0.4), bump job to v2 --- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index f27800f64..5a4415ff9 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -29,7 +29,7 @@ spec: {{- $_job_name_prefix := "install-spss-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v1" }} +{{- $_job_version := "v2" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -58,9 +58,9 @@ spec: helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm helm repo update - echo "Installing spss-modeler cluster-scoped chart (CRDs + ClusterRoles)..." - helm template spss-modeler-cluster ibm-charts/spss-modeler-cluster-scoped \ - --version 12.1.0 \ + echo "Installing spss cluster-scoped chart (CRDs + ClusterRoles)..." + helm template spss-cluster ibm-charts/spss-cluster-scoped \ + --version 13.0.4 \ --namespace {{ .Values.cpd_operators_namespace }} \ --set global.licenseAccept=true \ --set global.releaseVersion={{ .Values.cpd_product_version }} \ @@ -84,9 +84,9 @@ spec: sleep 10 done - echo "Installing spss-modeler namespace-scoped chart (operator + CR)..." - helm upgrade --install spss-modeler ibm-charts/spss-modeler \ - --version 12.1.0 \ + echo "Installing spss namespace-scoped chart (operator + CR)..." + helm upgrade --install spss ibm-charts/spss \ + --version 13.0.4 \ --namespace {{ .Values.cpd_instance_namespace }} \ --create-namespace \ --set global.licenseAccept=true \ @@ -96,7 +96,7 @@ spec: --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ --set global.imagePullSecret=ibm-entitlement-key \ - --set spssmodeler.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --set spss.scaleConfig={{ .Values.cpd_service_scale_config }} \ --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa From 46223fe061fd55701e17fab4310c5d575403a671 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 22:07:26 +0530 Subject: [PATCH 053/115] MASCORE-15507: Fix SPSS CRD poll name spss.spssmodeler.cpd.ibm.com, bump job to v3 --- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 5a4415ff9..982d54c4c 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -29,7 +29,7 @@ spec: {{- $_job_name_prefix := "install-spss-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v2" }} +{{- $_job_version := "v3" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -68,7 +68,7 @@ spec: --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - echo "Waiting for spssmodelerbases.spssmodeler.cpd.ibm.com CRD to be established..." + echo "Waiting for spss.spssmodeler.cpd.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -76,7 +76,7 @@ spec: echo "CRD not established after 5 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd spssmodelerbases.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd spss.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "CRD established." break From f8735f43075f9ba90cce1f11aafb347a8126baed Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 22:41:14 +0530 Subject: [PATCH 054/115] MASCORE-15507: Add canvasbase dependency before SPSS install, bump job to v4 --- .../templates/01-ibm-spss-cr.yaml | 42 ++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 982d54c4c..8521b9334 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -29,7 +29,7 @@ spec: {{- $_job_name_prefix := "install-spss-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v3" }} +{{- $_job_version := "v4" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -58,6 +58,46 @@ spec: helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm helm repo update + echo "Installing canvasbase cluster-scoped chart (CRDs + ClusterRoles)..." + helm template canvasbase-cluster ibm-charts/canvasbase-cluster-scoped \ + --version 13.0.4 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for canvasbases.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "Canvasbase CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd canvasbases.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "Canvasbase CRD established." + break + fi + sleep 10 + done + + echo "Installing canvasbase namespace-scoped chart (operator + CR)..." + helm upgrade --install canvasbase ibm-charts/canvasbase \ + --version 13.0.4 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --wait --timeout 60m + echo "Installing spss cluster-scoped chart (CRDs + ClusterRoles)..." helm template spss-cluster ibm-charts/spss-cluster-scoped \ --version 13.0.4 \ From 313f4c689af0ff3640050ae182ef4a66d787d9a4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 22:49:00 +0530 Subject: [PATCH 055/115] MASCORE-15507: Fix canvasbase CRD poll name, bump job to v5 --- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 8521b9334..48dd4ba25 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -29,7 +29,7 @@ spec: {{- $_job_name_prefix := "install-spss-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v4" }} +{{- $_job_version := "v5" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -68,7 +68,7 @@ spec: --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - echo "Waiting for canvasbases.cpd.ibm.com CRD to be established..." + echo "Waiting for canvasbase.canvasbase.cpd.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -76,7 +76,7 @@ spec: echo "Canvasbase CRD not established after 5 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd canvasbases.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd canvasbase.canvasbase.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "Canvasbase CRD established." break From 44d18ac1f863ad1339b2fe3d677251e7c26cbff7 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 11 Aug 2026 11:33:55 +0530 Subject: [PATCH 056/115] MASCORE-15507: Fix Helm chart versions to match CPD 5.3.1 release metadata (spss/canvasbase 12.1.0, cognos 29.1.0) --- .../templates/01-ibm-cognos-analytics-cr.yaml | 6 +++--- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 10 +++++----- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index de5025325..7752e28db 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -30,7 +30,7 @@ spec: {{- $_job_name_prefix := "install-cognos-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v2" }} +{{- $_job_version := "v3" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -61,7 +61,7 @@ spec: echo "Installing cognos-analytics cluster-scoped chart (CRDs + ClusterRoles)..." helm template cognos-analytics-cluster ibm-charts/cognos-analytics-cluster-scoped \ - --version 29.1.8 \ + --version 29.1.0 \ --namespace {{ .Values.cpd_operators_namespace }} \ --set global.licenseAccept=true \ --set global.releaseVersion={{ .Values.cpd_product_version }} \ @@ -87,7 +87,7 @@ spec: echo "Installing cognos-analytics namespace-scoped chart (operator + CR)..." helm upgrade --install cognos-analytics ibm-charts/cognos-analytics \ - --version 29.1.8 \ + --version 29.1.0 \ --namespace {{ .Values.cpd_instance_namespace }} \ --create-namespace \ --set global.licenseAccept=true \ diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 48dd4ba25..aaa464068 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -29,7 +29,7 @@ spec: {{- $_job_name_prefix := "install-spss-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v5" }} +{{- $_job_version := "v6" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -60,7 +60,7 @@ spec: echo "Installing canvasbase cluster-scoped chart (CRDs + ClusterRoles)..." helm template canvasbase-cluster ibm-charts/canvasbase-cluster-scoped \ - --version 13.0.4 \ + --version 12.1.0 \ --namespace {{ .Values.cpd_operators_namespace }} \ --set global.licenseAccept=true \ --set global.releaseVersion={{ .Values.cpd_product_version }} \ @@ -86,7 +86,7 @@ spec: echo "Installing canvasbase namespace-scoped chart (operator + CR)..." helm upgrade --install canvasbase ibm-charts/canvasbase \ - --version 13.0.4 \ + --version 12.1.0 \ --namespace {{ .Values.cpd_instance_namespace }} \ --create-namespace \ --set global.licenseAccept=true \ @@ -100,7 +100,7 @@ spec: echo "Installing spss cluster-scoped chart (CRDs + ClusterRoles)..." helm template spss-cluster ibm-charts/spss-cluster-scoped \ - --version 13.0.4 \ + --version 12.1.0 \ --namespace {{ .Values.cpd_operators_namespace }} \ --set global.licenseAccept=true \ --set global.releaseVersion={{ .Values.cpd_product_version }} \ @@ -126,7 +126,7 @@ spec: echo "Installing spss namespace-scoped chart (operator + CR)..." helm upgrade --install spss ibm-charts/spss \ - --version 13.0.4 \ + --version 12.1.0 \ --namespace {{ .Values.cpd_instance_namespace }} \ --create-namespace \ --set global.licenseAccept=true \ From 7123d28ab56ef819f5966682506a918233c04c84 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 11 Aug 2026 12:29:02 +0530 Subject: [PATCH 057/115] MASCORE-15507: Fix helm lint - add default 0.0.0 for cpd_product_version semver check in SPSS --- .../120-ibm-spss/templates/00-ibm-spss_Subscription.yaml | 2 +- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index 5d5fd60f8..2602216e4 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index aaa464068..9aaa9eba0 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: spssmodeler.cpd.ibm.com/v1 kind: SPSSModeler From 745622846b3f367ca38df9e4a0e5a8948315e7d2 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 11 Aug 2026 12:31:37 +0530 Subject: [PATCH 058/115] MASCORE-15507: Fix helm lint - add default 0.0.0 for all cpd_product_version semver checks --- .../110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml | 2 +- .../110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml | 2 +- .../templates/09-ibm-cp4d_services_dependencies.yaml | 2 +- .../templates/00-ibm-cognos-analytics_Subscription.yaml | 2 +- .../templates/01-ibm-cognos-analytics-cr.yaml | 2 +- .../120-ibm-spark/templates/00-ibm-spark_Subscription.yaml | 2 +- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 2 +- .../120-ibm-spark/templates/02-ibm-spark-control-plane.yaml | 2 +- .../120-ibm-wml/templates/01-ibm-wml_Subscription.yaml | 2 +- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- .../120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml | 2 +- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml index 2c8d3d747..4c9e7cff5 100644 --- a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml +++ b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml @@ -1527,7 +1527,7 @@ roleRef: kind: ClusterRole name: admin -{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0) }} +{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0) }} --- # For CPD 5.3.1+, cpd-sa needs cluster-level permissions to apply CRDs and # ClusterRoles from the Helm cluster-scoped charts during service installation. diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml index ed8eb2cff..bc0a3dc0a 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml @@ -147,7 +147,7 @@ spec: -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} {{- if or .Values.wml_channel .Values.wsl_channel .Values.spss_channel }} --- apiVersion: operators.coreos.com/v1alpha1 diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml index 6a270dcee..5fb58cfe3 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml @@ -1,4 +1,4 @@ -{{- if and (or .Values.wsl_channel .Values.spss_channel) (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0) }} +{{- if and (or .Values.wsl_channel .Values.spss_channel) (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0) }} # Custom Operand Registries # ----------------------------------------------------------------------------- --- diff --git a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml index 169108421..7c909d3ba 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index 7752e28db..64014240c 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: cognosanalytics.cpd.ibm.com/v1 kind: CognosAnalytics diff --git a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml index 392b67cf3..717d69362 100644 --- a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml +++ b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index a27460904..c7d6cb80a 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: ae.cpd.ibm.com/v1 kind: AnalyticsEngine diff --git a/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml b/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml index e2c7b5f8a..49c5f0d33 100644 --- a/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml +++ b/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml @@ -55,7 +55,7 @@ are required here. */}} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- kind: ServiceAccount apiVersion: v1 diff --git a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml index 01f75abbd..0bc0af93c 100644 --- a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml +++ b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 49cb50c0f..8fe2dea76 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: wml.cpd.ibm.com/v1beta1 kind: WmlBase diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index 2f30520a5..f207bbaae 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -18,7 +18,7 @@ # installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 53331456c..8e8855f17 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -27,7 +27,7 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: ws.cpd.ibm.com/v1beta1 kind: WS From 229d27b5c5fb18d7219e67648b7ffb87911db70c Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 11 Aug 2026 12:34:48 +0530 Subject: [PATCH 059/115] MASCORE-15507: Fix README validation - add cognos-analytics-app to instance-root README, add Job to WML README --- instance-applications/120-ibm-wml/README.md | 5 +++-- root-applications/ibm-mas-instance-root/README.md | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-wml/README.md b/instance-applications/120-ibm-wml/README.md index ae239a251..cd572f96e 100644 --- a/instance-applications/120-ibm-wml/README.md +++ b/instance-applications/120-ibm-wml/README.md @@ -10,8 +10,9 @@ Deploys and configures the CP4D Service, Watson Machine Learning (WML) needed fo | Resource Type | Resource Name | Namespace | Condition | Installed By | |--------------|---------------|-----------|-----------|--------------| -| `Subscription` | WML operator subscription | CP4D instance namespace | Always | `application_admin_role` | -| `WmlBase` | Watson Machine Learning service CR | CP4D instance namespace | Always | `application_admin_role` | +| `Subscription` | WML operator subscription | CP4D operators namespace | CPD < 5.3.1 | `application_admin_role` | +| `WmlBase` | Watson Machine Learning service CR | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `Job` | Helm install job (ibm-redis-cp + wml) | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | ## Configuration diff --git a/root-applications/ibm-mas-instance-root/README.md b/root-applications/ibm-mas-instance-root/README.md index b65e28ac1..74e2893d6 100644 --- a/root-applications/ibm-mas-instance-root/README.md +++ b/root-applications/ibm-mas-instance-root/README.md @@ -205,6 +205,7 @@ The following table lists all ArgoCD applications defined in the templates folde | [`110-ibm-db2u-app.yaml`](templates/110-ibm-db2u-app.yaml) | db2u | ✓ | | | 110 | | [`120-db2-databases-app.yaml`](templates/120-db2-databases-app.yaml) | db2-db | | ✓ | | 120 | | [`120-dbs-rds-databases-app.yaml`](templates/120-dbs-rds-databases-app.yaml) | dbs-rds-db | | | ✓ | 120 | +| [`120-ibm-cognos-analytics-app.yaml`](templates/120-ibm-cognos-analytics-app.yaml) | cognos | ✓ | | | 120 | | [`120-ibm-spark-app.yaml`](templates/120-ibm-spark-app.yaml) | spark | ✓ | | | 120 | | [`120-ibm-spss-app.yaml`](templates/120-ibm-spss-app.yaml) | spss | ✓ | | | 120 | | [`120-ibm-wml-app.yaml`](templates/120-ibm-wml-app.yaml) | wml | ✓ | | | 120 | From b4bd4cdbf60a0bf3a26d3461f7710773ec0565f4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 11 Aug 2026 12:37:02 +0530 Subject: [PATCH 060/115] MASCORE-15507: Fix verify-job-definitions - add hashed job name pattern and $_cli_image_digest to WSL and Spark Helm install jobs --- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 15 +++++++++++---- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 15 +++++++++++---- 2 files changed, 22 insertions(+), 8 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index c7d6cb80a..ca46aec4f 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -26,23 +26,30 @@ spec: {{- else }} --- # Helm-based installation for CPD 5.3.1+ +{{- $_job_name_prefix := "install-spark-helm" }} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_job_config_values := omit .Values "junitreporter" }} +{{- $_job_version := "v1" }} +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} +{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} apiVersion: batch/v1 kind: Job metadata: - name: install-spark-helm + name: {{ $_job_name }} namespace: "{{ .Values.cpd_operators_namespace }}" + labels: + mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed - spec: template: spec: containers: - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} command: - /bin/sh - -c diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 8e8855f17..a887d12b2 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -60,23 +60,30 @@ spec: # Installs WSL and all its dependencies (opensearch, ccs, datarefinery, ws-runtimes) # using IBM Helm charts. Each component requires a cluster-scoped chart (CRDs/ClusterRoles) # followed by a namespace-scoped chart (Operator + CR). +{{- $_job_name_prefix := "install-wsl-helm" }} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_job_config_values := omit .Values "junitreporter" }} +{{- $_job_version := "v1" }} +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} +{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} apiVersion: batch/v1 kind: Job metadata: - name: install-wsl-helm + name: {{ $_job_name }} namespace: "{{ .Values.cpd_operators_namespace }}" + labels: + mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} annotations: argocd.argoproj.io/sync-wave: "091" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed - spec: template: spec: containers: - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} command: - /bin/sh - -c From 43a7bf7be9411e8c3bc32856a5ff859f89e40c0a Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Wed, 12 Aug 2026 11:50:24 +0530 Subject: [PATCH 061/115] Update 07-postsync-setup-db2_Job.yaml --- .../templates/07-postsync-setup-db2_Job.yaml | 52 ++++++++++++++++++- 1 file changed, 51 insertions(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml index 05476c2cb..4b1286f36 100644 --- a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml @@ -35,7 +35,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v22" }} +{{- $_job_version := "v23" }} {{- /* 10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest This is to ensure ArgoCD will create a new job resource intead of attempting (and failing) to update an @@ -579,6 +579,56 @@ spec: oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "cd ${DB2_INSTANCE_HOME_PATH}/bin; ${CREATE_ROLES_SH_PATH} | tee /tmp/createroles.log" db2inst1 || exit $? fi + # Path to the audit policy setup script, on both this pod and on the db2u pod + AUDITPOLICY_SH_PATH="/tmp/auditpolicy.sh" + + echo "" + echo "================================================================================" + echo "Setting up DB2 audit policy for Manage" + echo "================================================================================" + + echo "" + echo "Create ${AUDITPOLICY_SH_PATH}" + echo "--------------------------------------------------------------------------------" + + # Generate the audit policy script to copy and run on the db2u pod + cat > ${AUDITPOLICY_SH_PATH} << EOF + #!/bin/bash + set -e + + echo "Creating audit policy USER_AUDIT (instance-level)" + db2 "CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATION STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL" || true + + echo "Connecting to database ${DB2_DBNAME}" + db2 connect to ${DB2_DBNAME} + if [ \$? != 0 ]; then + echo "Failed to connect to database!" + exit 1 + fi + + echo "Applying audit policy to MAXIMO_READ and MAXIMO_WRITE roles" + db2 "AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT" + + echo "Applying audit policy to db2inst1 user" + db2 "AUDIT USER db2inst1 USING POLICY USER_AUDIT" + + db2 connect reset + echo "Audit policy setup complete" + EOF + # IMPORTANT: Do not make any changes to the "EOF" line above (including its indentation) + + chmod +x ${AUDITPOLICY_SH_PATH} + + echo "" + echo "Copy ${AUDITPOLICY_SH_PATH} to ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0" + echo "--------------------------------------------------------------------------------" + oc cp ${AUDITPOLICY_SH_PATH} ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0:${AUDITPOLICY_SH_PATH} -c db2u || exit $? + + echo "" + echo "Executing ${AUDITPOLICY_SH_PATH} file on ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0" + echo "--------------------------------------------------------------------------------" + oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "${AUDITPOLICY_SH_PATH} | tee /tmp/auditpolicy.log" db2inst1 || exit $? + fi # [[ "$MAS_APP_ID" == "manage" ]] From c702932d0d6840a585a457ec34634a5715558ab0 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 15:37:34 +0530 Subject: [PATCH 062/115] MASCORE-15507: Remove Cognos Analytics OLM Subscription Cognos Analytics is only available on CPD >= 5.3.1 and is installed via Helm only. There is no OLM path for Cognos - it was never available on CPD < 5.3.1. The Subscription file was incorrect. --- .../00-ibm-cognos-analytics_Subscription.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml diff --git a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml deleted file mode 100644 index 7c909d3ba..000000000 --- a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml +++ /dev/null @@ -1,19 +0,0 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: cognos-analytics-subscription - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - channel: "{{ .Values.cognos_analytics_channel }}" - name: cognos-analytics-operator - source: ibm-operator-catalog - sourceNamespace: openshift-marketplace -{{- end }} From 759bdd94a2d9d8633782ce8e239a8aaa181b963c Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 15:41:48 +0530 Subject: [PATCH 063/115] MASCORE-15507: Remove OLM version gate from Cognos Analytics CR Cognos Analytics is only available on CPD >= 5.3.1 via Helm. There is no OLM/CR path for older versions. Removed the incorrect version gate and the CognosAnalytics CR block that was gating on CPD < 5.3.1. --- .../templates/01-ibm-cognos-analytics-cr.yaml | 27 ------------------- 1 file changed, 27 deletions(-) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index 64014240c..04fa2ce8d 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,29 +1,3 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} ---- -apiVersion: cognosanalytics.cpd.ibm.com/v1 -kind: CognosAnalytics -metadata: - name: "cognos-analytics-sample" - namespace: "{{ .Values.cpd_instance_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - imagePullSecret: ibm-entitlement-key - ignoreForMaintenance: false - license: - accept: true - license: Standard - fileStorageClass: "{{ .Values.cpd_service_storage_class }}" - blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" - scaleConfig: "{{ .Values.cpd_service_scale_config }}" - version: "{{ .Values.cognos_analytics_version }}" - ccs_operand_version: "{{ .Values.ccs_version }}" -{{- else }} --- # Helm-based installation for CPD 5.3.1+ # Cognos Analytics is an optional analytics and reporting service @@ -102,4 +76,3 @@ spec: restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 4 -{{- end }} From 8a162bc0b2623696b5a135c36d05d69859a2720e Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 15:46:35 +0530 Subject: [PATCH 064/115] Revert "MASCORE-15507: Remove OLM version gate from Cognos Analytics CR" This reverts commit 759bdd94a2d9d8633782ce8e239a8aaa181b963c. --- .../templates/01-ibm-cognos-analytics-cr.yaml | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index 04fa2ce8d..64014240c 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,3 +1,29 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} +--- +apiVersion: cognosanalytics.cpd.ibm.com/v1 +kind: CognosAnalytics +metadata: + name: "cognos-analytics-sample" + namespace: "{{ .Values.cpd_instance_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + imagePullSecret: ibm-entitlement-key + ignoreForMaintenance: false + license: + accept: true + license: Standard + fileStorageClass: "{{ .Values.cpd_service_storage_class }}" + blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" + scaleConfig: "{{ .Values.cpd_service_scale_config }}" + version: "{{ .Values.cognos_analytics_version }}" + ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} --- # Helm-based installation for CPD 5.3.1+ # Cognos Analytics is an optional analytics and reporting service @@ -76,3 +102,4 @@ spec: restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 4 +{{- end }} From e9d0039efd5bf607400ac5f9784e9d96936822eb Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 15:46:35 +0530 Subject: [PATCH 065/115] Revert "MASCORE-15507: Remove Cognos Analytics OLM Subscription" This reverts commit c702932d0d6840a585a457ec34634a5715558ab0. --- .../00-ibm-cognos-analytics_Subscription.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml diff --git a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml new file mode 100644 index 000000000..7c909d3ba --- /dev/null +++ b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml @@ -0,0 +1,19 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: cognos-analytics-subscription + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + channel: "{{ .Values.cognos_analytics_channel }}" + name: cognos-analytics-operator + source: ibm-operator-catalog + sourceNamespace: openshift-marketplace +{{- end }} From 138ad046f1ca88b562f0f318128a54701186fe61 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 16:01:21 +0530 Subject: [PATCH 066/115] MASCORE-15507: Cognos Analytics - remove OLM path, 5.3.1+ Helm only MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cognos Analytics was never deployed via this GitOps repo before this story. It was newly added as part of MASCORE-15507 for CPD 5.3.1+ only via Helm. No OLM path is needed. - Remove 00-ibm-cognos-analytics_Subscription.yaml entirely - Remove version gate and CognosAnalytics CR block from 01-ibm-cognos-analytics-cr.yaml — Helm install job always applies --- .../00-ibm-cognos-analytics_Subscription.yaml | 19 ------------- .../templates/01-ibm-cognos-analytics-cr.yaml | 27 ------------------- 2 files changed, 46 deletions(-) delete mode 100644 instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml diff --git a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml deleted file mode 100644 index 7c909d3ba..000000000 --- a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml +++ /dev/null @@ -1,19 +0,0 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: cognos-analytics-subscription - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - channel: "{{ .Values.cognos_analytics_channel }}" - name: cognos-analytics-operator - source: ibm-operator-catalog - sourceNamespace: openshift-marketplace -{{- end }} diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index 64014240c..04fa2ce8d 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,29 +1,3 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} ---- -apiVersion: cognosanalytics.cpd.ibm.com/v1 -kind: CognosAnalytics -metadata: - name: "cognos-analytics-sample" - namespace: "{{ .Values.cpd_instance_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - imagePullSecret: ibm-entitlement-key - ignoreForMaintenance: false - license: - accept: true - license: Standard - fileStorageClass: "{{ .Values.cpd_service_storage_class }}" - blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" - scaleConfig: "{{ .Values.cpd_service_scale_config }}" - version: "{{ .Values.cognos_analytics_version }}" - ccs_operand_version: "{{ .Values.ccs_version }}" -{{- else }} --- # Helm-based installation for CPD 5.3.1+ # Cognos Analytics is an optional analytics and reporting service @@ -102,4 +76,3 @@ spec: restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 4 -{{- end }} From a995fb44020cbb8a28c94b2b8b7c6c2fa2a40bc6 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 16:34:18 +0530 Subject: [PATCH 067/115] =?UTF-8?q?fix:=20correct=20imagePullSecret=20name?= =?UTF-8?q?=20in=20Ibmcpd=20CR=20(underscore=20=E2=86=92=20dash)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Ibmcpd CR spec.imagePullSecret was set to 'ibm_entitlement_key' (underscores) instead of the actual Kubernetes Secret name 'ibm-entitlement-key' (dashes). This caused the CP4D operator's Ansible playbook to fail to pull Common Services images, resulting in: 'Fail to wait for commonservice CR to reach Succeeded status' Fixes MASCORE-15507 --- .../110-ibm-cp4d/templates/07-ibm-cp4d_Ibmcpd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/110-ibm-cp4d/templates/07-ibm-cp4d_Ibmcpd.yaml b/instance-applications/110-ibm-cp4d/templates/07-ibm-cp4d_Ibmcpd.yaml index 2fc6e57ed..a00db1949 100644 --- a/instance-applications/110-ibm-cp4d/templates/07-ibm-cp4d_Ibmcpd.yaml +++ b/instance-applications/110-ibm-cp4d/templates/07-ibm-cp4d_Ibmcpd.yaml @@ -12,7 +12,7 @@ metadata: {{ .Values.custom_labels | toYaml | indent 4 }} {{- end }} spec: - imagePullSecret: ibm_entitlement_key + imagePullSecret: ibm-entitlement-key version: "{{ .Values.cpd_product_version }}" license: accept: true From 74238ce6ce69d77b913ca65cfb1649798d0ce394 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 17:06:16 +0530 Subject: [PATCH 068/115] fix: add persistent ConfigMap to CPD 5.3.1 Helm charts to stop ArgoCD OutOfSync loop When only an ArgoCD Hook Job exists in a chart (no non-hook resources), ArgoCD enters an OutOfSync/Progressing loop after the job deletes itself (HookSucceeded,HookFailed delete policy). The app shows OutOfSync because ArgoCD sees zero managed resources. Add a stable ConfigMap (sync-wave 091, before the hook job at 092) to WML, Spark, SPSS, Cognos Analytics and WSL 5.3.1 Helm branches so ArgoCD always has a persistent resource to track. Fixes: wml.noble8.inst02, spark.noble8.inst02, spss.noble8.inst02 cognos.noble8.inst02, wsl.noble8.inst02 OutOfSync/Progressing --- .../templates/01-ibm-cognos-analytics-cr.yaml | 13 +++++++++++++ .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 13 +++++++++++++ .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 13 +++++++++++++ .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 13 +++++++++++++ .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 13 +++++++++++++ 5 files changed, 65 insertions(+) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index 04fa2ce8d..6b826bd1e 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,4 +1,17 @@ --- +# Persistent resource so ArgoCD has a stable non-hook object to track. +# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. +apiVersion: v1 +kind: ConfigMap +metadata: + name: ibm-cognos-helm-install-config + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" +data: + cpd_product_version: "{{ .Values.cpd_product_version }}" + install_method: "helm" +--- # Helm-based installation for CPD 5.3.1+ # Cognos Analytics is an optional analytics and reporting service {{- $_job_name_prefix := "install-cognos-helm" }} diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index ca46aec4f..b7a6a913b 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -25,6 +25,19 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" {{- else }} --- +# Persistent resource so ArgoCD has a stable non-hook object to track. +# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. +apiVersion: v1 +kind: ConfigMap +metadata: + name: ibm-spark-helm-install-config + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" +data: + cpd_product_version: "{{ .Values.cpd_product_version }}" + install_method: "helm" +--- # Helm-based installation for CPD 5.3.1+ {{- $_job_name_prefix := "install-spark-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 9aaa9eba0..e75bf0777 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -25,6 +25,19 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" {{- else }} --- +# Persistent resource so ArgoCD has a stable non-hook object to track. +# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. +apiVersion: v1 +kind: ConfigMap +metadata: + name: ibm-spss-helm-install-config + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" +data: + cpd_product_version: "{{ .Values.cpd_product_version }}" + install_method: "helm" +--- # Helm-based installation for CPD 5.3.1+ {{- $_job_name_prefix := "install-spss-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 8fe2dea76..5a9acdfa7 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -25,6 +25,19 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" {{- else }} --- +# Persistent resource so ArgoCD has a stable non-hook object to track. +# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. +apiVersion: v1 +kind: ConfigMap +metadata: + name: ibm-wml-helm-install-config + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" +data: + cpd_product_version: "{{ .Values.cpd_product_version }}" + install_method: "helm" +--- # Helm-based installation for CPD 5.3.1+ {{- $_job_name_prefix := "install-wml-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index a887d12b2..9161ffffb 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -56,6 +56,19 @@ spec: wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" {{- else }} --- +# Persistent resource so ArgoCD has a stable non-hook object to track. +# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. +apiVersion: v1 +kind: ConfigMap +metadata: + name: ibm-wsl-helm-install-config + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" +data: + cpd_product_version: "{{ .Values.cpd_product_version }}" + install_method: "helm" +--- # Helm-based installation for CPD 5.3.1+ # Installs WSL and all its dependencies (opensearch, ccs, datarefinery, ws-runtimes) # using IBM Helm charts. Each component requires a cluster-scoped chart (CRDs/ClusterRoles) From a2ddc425ebfcab4b87fe270f3646ee72ba4100a6 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 17:11:47 +0530 Subject: [PATCH 069/115] fix: add ConfigMap to README Resources Created tables for Spark, WML, WSL CI verify_chart_readme_tables.py requires every resource kind in a chart to be documented in the README. The persistent ConfigMap added to the CPD 5.3.1 Helm branches was not yet listed. Fixes CI lint failure: 'resource kind not documented in README table: ConfigMap' --- instance-applications/120-ibm-spark/README.md | 7 ++++--- instance-applications/120-ibm-wml/README.md | 1 + instance-applications/120-ibm-wsl/README.md | 15 ++++++++------- 3 files changed, 13 insertions(+), 10 deletions(-) diff --git a/instance-applications/120-ibm-spark/README.md b/instance-applications/120-ibm-spark/README.md index 9798b6a59..2a3fab040 100644 --- a/instance-applications/120-ibm-spark/README.md +++ b/instance-applications/120-ibm-spark/README.md @@ -10,12 +10,13 @@ Spark extends jupyter notebooks features inside Watson Studio notebooks which ca | Resource Type | Resource Name | Namespace | Condition | Installed By | |--------------|---------------|-----------|-----------|--------------| -| `Subscription` | Spark operator subscription | CP4D instance namespace | Always | `application_admin_role` | -| `AnalyticsEngine` | Spark service CR | CP4D instance namespace | Always | `application_admin_role` | +| `Subscription` | Spark operator subscription | CP4D operators namespace | CPD < 5.3.1 | `application_admin_role` | +| `AnalyticsEngine` | Spark service CR | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | | `ServiceAccount` | Spark control-plane service account | CP4D instance namespace | When control-plane job is enabled | `application_admin_role` | | `ClusterRole` | Spark control-plane cluster roles | N/A (cluster-scoped) | When control-plane job is enabled | `application_admin_role` | | `ClusterRoleBinding` | Spark control-plane cluster role binding | N/A (cluster-scoped) | When control-plane job is enabled | `application_admin_role` | -| `Job` | Spark control-plane job | CP4D instance namespace | When control-plane job is enabled | `application_admin_role` | +| `ConfigMap` | Helm install state tracking | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | +| `Job` | Spark Helm install job | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | ## Configuration diff --git a/instance-applications/120-ibm-wml/README.md b/instance-applications/120-ibm-wml/README.md index cd572f96e..d309bc536 100644 --- a/instance-applications/120-ibm-wml/README.md +++ b/instance-applications/120-ibm-wml/README.md @@ -12,6 +12,7 @@ Deploys and configures the CP4D Service, Watson Machine Learning (WML) needed fo |--------------|---------------|-----------|-----------|--------------| | `Subscription` | WML operator subscription | CP4D operators namespace | CPD < 5.3.1 | `application_admin_role` | | `WmlBase` | Watson Machine Learning service CR | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `ConfigMap` | Helm install state tracking | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | | `Job` | Helm install job (ibm-redis-cp + wml) | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | ## Configuration diff --git a/instance-applications/120-ibm-wsl/README.md b/instance-applications/120-ibm-wsl/README.md index 953c16262..b5a0e9eb7 100644 --- a/instance-applications/120-ibm-wsl/README.md +++ b/instance-applications/120-ibm-wsl/README.md @@ -9,13 +9,14 @@ Deploys and configures the CP4D Service, Watson Studio Local (WSL) needed for `M | Resource Type | Resource Name | Namespace | Condition | Installed By | |--------------|---------------|-----------|-----------|--------------| -| `Subscription` | WSL operator subscription | CP4D instance namespace | Always | `application_admin_role` | -| `WS` | Watson Studio Local service CR | CP4D instance namespace | Always | `application_admin_role` | -| `ServiceAccount` | WSL post-verify service account | CP4D instance namespace | Always | `application_admin_role` | -| `Role` | WSL post-verify roles | CP4D instance namespace | Always | `application_admin_role` | -| `RoleBinding` | WSL post-verify role binding | CP4D instance namespace | Always | `application_admin_role` | -| `Secret` | WSL post-verify runtime secret | CP4D instance namespace | Always | `application_admin_role` | -| `Job` | WSL post-verify job | CP4D instance namespace | Always | `application_admin_role` | +| `Subscription` | WSL operator subscription | CP4D operators namespace | CPD < 5.3.1 | `application_admin_role` | +| `WS` | Watson Studio Local service CR | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `ServiceAccount` | WSL post-verify service account | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `Role` | WSL post-verify roles | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `RoleBinding` | WSL post-verify role binding | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `Secret` | WSL post-verify runtime secret | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `ConfigMap` | Helm install state tracking | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | +| `Job` | WSL Helm install job | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | ## Configuration From 9034589afc14ebe2b14efe8be3eb458057d8e51b Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 18 Aug 2026 13:29:34 +0530 Subject: [PATCH 070/115] fix: skip Cognos Analytics Application for CPD < 5.3.1 (Helm path only) --- .../templates/120-ibm-cognos-analytics-app.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index 2143a7188..6ceaf52db 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -1,4 +1,4 @@ -{{- if and (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} +{{- if and (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) (not (lt (semver "5.3.1" | (semver (.Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString)).Compare) 0)) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} --- # IBM Cognos Analytics Application From 37a359ffe3b35c31e64321dcc0f94e80d779f79e Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Wed, 19 Aug 2026 13:04:56 +0530 Subject: [PATCH 071/115] audit policy added for manage --- .../templates/07-postsync-setup-db2_Job.yaml | 51 ---- .../08-postsync-db2-audit-policy_Job.yaml | 226 ++++++++++++++++++ 2 files changed, 226 insertions(+), 51 deletions(-) create mode 100644 instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml diff --git a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml index 4b1286f36..0ac137de4 100644 --- a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml @@ -579,57 +579,6 @@ spec: oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "cd ${DB2_INSTANCE_HOME_PATH}/bin; ${CREATE_ROLES_SH_PATH} | tee /tmp/createroles.log" db2inst1 || exit $? fi - # Path to the audit policy setup script, on both this pod and on the db2u pod - AUDITPOLICY_SH_PATH="/tmp/auditpolicy.sh" - - echo "" - echo "================================================================================" - echo "Setting up DB2 audit policy for Manage" - echo "================================================================================" - - echo "" - echo "Create ${AUDITPOLICY_SH_PATH}" - echo "--------------------------------------------------------------------------------" - - # Generate the audit policy script to copy and run on the db2u pod - cat > ${AUDITPOLICY_SH_PATH} << EOF - #!/bin/bash - set -e - - echo "Creating audit policy USER_AUDIT (instance-level)" - db2 "CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATION STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL" || true - - echo "Connecting to database ${DB2_DBNAME}" - db2 connect to ${DB2_DBNAME} - if [ \$? != 0 ]; then - echo "Failed to connect to database!" - exit 1 - fi - - echo "Applying audit policy to MAXIMO_READ and MAXIMO_WRITE roles" - db2 "AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT" - - echo "Applying audit policy to db2inst1 user" - db2 "AUDIT USER db2inst1 USING POLICY USER_AUDIT" - - db2 connect reset - echo "Audit policy setup complete" - EOF - # IMPORTANT: Do not make any changes to the "EOF" line above (including its indentation) - - chmod +x ${AUDITPOLICY_SH_PATH} - - echo "" - echo "Copy ${AUDITPOLICY_SH_PATH} to ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0" - echo "--------------------------------------------------------------------------------" - oc cp ${AUDITPOLICY_SH_PATH} ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0:${AUDITPOLICY_SH_PATH} -c db2u || exit $? - - echo "" - echo "Executing ${AUDITPOLICY_SH_PATH} file on ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0" - echo "--------------------------------------------------------------------------------" - oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "${AUDITPOLICY_SH_PATH} | tee /tmp/auditpolicy.log" db2inst1 || exit $? - - fi # [[ "$MAS_APP_ID" == "manage" ]] if [[ "$MAS_APP_ID" == "facilities" ]]; then diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml new file mode 100644 index 000000000..d1c2183c3 --- /dev/null +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -0,0 +1,226 @@ +{{- if .Values.application_admin_role }} +{{- /* +Audit policy setup job for DB2. +Runs per-application audit policy commands on the db2u pod after the main +postsync setup job (sync-wave 129) has completed. + +Currently supported: manage +*/}} +{{- if .Values.should_execute }} + +{{- if not (contains "sdb" .Values.db2_instance_name) }} + +{{- $_job_name_prefix := "postsync-db2-audit-policy" }} + +{{- /* +Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. +*/}} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} + +{{- $_job_config_values := omit .Values "junitreporter" }} + +{{- /* +Increment this value whenever you make a change to an immutable field of the Job resource. +*/}} +{{- $_job_version := "v1" }} + +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} + +{{- $_job_cleanup_group := cat $_job_name_prefix .Values.db2_instance_name | sha1sum }} + +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ $_job_name }} + namespace: "{{ .Values.db2_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "130" + labels: + mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + template: +{{- if .Values.custom_labels }} + metadata: + labels: +{{ .Values.custom_labels | toYaml | indent 8 }} +{{- end }} + spec: + containers: + - name: run + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} + imagePullPolicy: IfNotPresent + + resources: + limits: + cpu: 200m + memory: 512Mi + requests: + cpu: 10m + memory: 64Mi + + env: + - name: MAS_APP_ID + value: {{ .Values.mas_application_id }} + - name: DB2_NAMESPACE + value: "{{ .Values.db2_namespace }}" + - name: DB2_INSTANCE_NAME + value: "{{ .Values.db2_instance_name }}" + - name: DB2_DBNAME + value: "{{ .Values.db2_dbname }}" + + command: + - /bin/sh + - -c + - | + + set -e + + DB2_POD="c-${DB2_INSTANCE_NAME}-db2u-0" + + # ============================================================ + # Audit policy: manage + # ============================================================ + if [ "$MAS_APP_ID" = "manage" ]; then + + echo "" + echo "================================================================================" + echo "Setting up DB2 audit policy for Manage" + echo "================================================================================" + + # ---------------------------------------------------------------- + # Connect to database + # ---------------------------------------------------------------- + echo "" + echo "Connecting to database ${DB2_DBNAME}" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc "db2 connect to ${DB2_DBNAME}" db2inst1 + + # ---------------------------------------------------------------- + # Create audit policy + # ---------------------------------------------------------------- + echo "" + echo "Creating audit policy USER_AUDIT" + echo "--------------------------------------------------------------------------------" + + if oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL"' db2inst1 + then + echo "Audit policy USER_AUDIT created successfully." + else + echo "Audit policy USER_AUDIT may already exist. Continuing." + fi + + # ---------------------------------------------------------------- + # Create MAXIMO_READ role + # ---------------------------------------------------------------- + echo "" + echo "Creating MAXIMO_READ role" + echo "--------------------------------------------------------------------------------" + + if oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "CREATE ROLE MAXIMO_READ"' db2inst1 + then + echo "Role MAXIMO_READ created successfully." + else + echo "Role MAXIMO_READ may already exist. Continuing." + fi + + # ---------------------------------------------------------------- + # Create MAXIMO_WRITE role + # ---------------------------------------------------------------- + echo "" + echo "Creating MAXIMO_WRITE role" + echo "--------------------------------------------------------------------------------" + + if oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "CREATE ROLE MAXIMO_WRITE"' db2inst1 + then + echo "Role MAXIMO_WRITE created successfully." + else + echo "Role MAXIMO_WRITE may already exist. Continuing." + fi + + # ---------------------------------------------------------------- + # Assign audit policy to MAXIMO_READ + # ---------------------------------------------------------------- + echo "" + echo "Applying USER_AUDIT to MAXIMO_READ" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT"' db2inst1 + + # ---------------------------------------------------------------- + # Assign audit policy to MAXIMO_WRITE + # ---------------------------------------------------------------- + echo "" + echo "Applying USER_AUDIT to MAXIMO_WRITE" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT"' db2inst1 + + # ---------------------------------------------------------------- + # Assign audit policy to db2inst1 + # ---------------------------------------------------------------- + echo "" + echo "Applying USER_AUDIT to db2inst1" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "AUDIT USER db2inst1 USING POLICY USER_AUDIT"' db2inst1 + + # ---------------------------------------------------------------- + # Verify audit policy assignments + # ---------------------------------------------------------------- + echo "" + echo "================================================================================" + echo "Verifying audit policy setup" + echo "================================================================================" + + echo "" + echo "Audit policy assignments:" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "SELECT AUDITPOLICYNAME, OBJECTTYPE, OBJECTNAME FROM SYSCAT.AUDITUSE WHERE AUDITPOLICYNAME='\''USER_AUDIT'\''"' db2inst1 + + echo "" + echo "Audit policy configuration:" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "SELECT AUDITPOLICYNAME, VALIDATESTATUS, EXECUTESTATUS, EXECUTEWITHDATA, ERRORTYPE FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='\''USER_AUDIT'\''"' db2inst1 + + # ---------------------------------------------------------------- + # Disconnect + # ---------------------------------------------------------------- + echo "" + echo "Disconnecting from database" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc "db2 connect reset" db2inst1 + + echo "" + echo "================================================================================" + echo "DB2 audit policy setup completed successfully for Manage" + echo "================================================================================" + + fi + + restartPolicy: Never + serviceAccountName: "postsync-sa-{{ .Values.db2_instance_name }}" + + backoffLimit: 4 + +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file From 67c58e7604546b0201f790045e7cf8f6d8052634 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Wed, 19 Aug 2026 14:26:13 +0530 Subject: [PATCH 072/115] update --- .../08-postsync-db2-audit-policy_Job.yaml | 135 ++++-------------- 1 file changed, 28 insertions(+), 107 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index d1c2183c3..53fb1e6d5 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -92,122 +92,43 @@ spec: echo "Setting up DB2 audit policy for Manage" echo "================================================================================" - # ---------------------------------------------------------------- - # Connect to database - # ---------------------------------------------------------------- - echo "" - echo "Connecting to database ${DB2_DBNAME}" - echo "--------------------------------------------------------------------------------" - - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc "db2 connect to ${DB2_DBNAME}" db2inst1 - - # ---------------------------------------------------------------- - # Create audit policy - # ---------------------------------------------------------------- - echo "" - echo "Creating audit policy USER_AUDIT" - echo "--------------------------------------------------------------------------------" - - if oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL"' db2inst1 - then - echo "Audit policy USER_AUDIT created successfully." - else - echo "Audit policy USER_AUDIT may already exist. Continuing." - fi - - # ---------------------------------------------------------------- - # Create MAXIMO_READ role - # ---------------------------------------------------------------- - echo "" - echo "Creating MAXIMO_READ role" - echo "--------------------------------------------------------------------------------" - - if oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "CREATE ROLE MAXIMO_READ"' db2inst1 - then - echo "Role MAXIMO_READ created successfully." - else - echo "Role MAXIMO_READ may already exist. Continuing." - fi - - # ---------------------------------------------------------------- - # Create MAXIMO_WRITE role - # ---------------------------------------------------------------- - echo "" - echo "Creating MAXIMO_WRITE role" - echo "--------------------------------------------------------------------------------" - - if oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "CREATE ROLE MAXIMO_WRITE"' db2inst1 - then - echo "Role MAXIMO_WRITE created successfully." - else - echo "Role MAXIMO_WRITE may already exist. Continuing." - fi - - # ---------------------------------------------------------------- - # Assign audit policy to MAXIMO_READ - # ---------------------------------------------------------------- - echo "" - echo "Applying USER_AUDIT to MAXIMO_READ" - echo "--------------------------------------------------------------------------------" - - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT"' db2inst1 - - # ---------------------------------------------------------------- - # Assign audit policy to MAXIMO_WRITE - # ---------------------------------------------------------------- - echo "" - echo "Applying USER_AUDIT to MAXIMO_WRITE" - echo "--------------------------------------------------------------------------------" + # All DB2 commands run in a single oc exec so the database + # connection established by 'db2 connect' is shared across + # every subsequent statement in the same session. + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- su -lc " + set -e - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT"' db2inst1 + echo 'Connecting to database ${DB2_DBNAME}' + db2 connect to ${DB2_DBNAME} - # ---------------------------------------------------------------- - # Assign audit policy to db2inst1 - # ---------------------------------------------------------------- - echo "" - echo "Applying USER_AUDIT to db2inst1" - echo "--------------------------------------------------------------------------------" + echo 'Creating audit policy USER_AUDIT (instance-level)' + db2 \"CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL\" || echo 'Audit policy USER_AUDIT already exists, continuing' - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "AUDIT USER db2inst1 USING POLICY USER_AUDIT"' db2inst1 + echo 'Creating MAXIMO_READ and MAXIMO_WRITE roles' + db2 \"CREATE ROLE MAXIMO_READ\" || echo 'Role MAXIMO_READ already exists, continuing' + db2 \"CREATE ROLE MAXIMO_WRITE\" || echo 'Role MAXIMO_WRITE already exists, continuing' - # ---------------------------------------------------------------- - # Verify audit policy assignments - # ---------------------------------------------------------------- - echo "" - echo "================================================================================" - echo "Verifying audit policy setup" - echo "================================================================================" + echo 'Applying USER_AUDIT policy to MAXIMO_READ and MAXIMO_WRITE roles' + db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" + db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" - echo "" - echo "Audit policy assignments:" - echo "--------------------------------------------------------------------------------" - - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "SELECT AUDITPOLICYNAME, OBJECTTYPE, OBJECTNAME FROM SYSCAT.AUDITUSE WHERE AUDITPOLICYNAME='\''USER_AUDIT'\''"' db2inst1 + echo 'Applying USER_AUDIT policy to db2inst1 user' + db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" - echo "" - echo "Audit policy configuration:" - echo "--------------------------------------------------------------------------------" + echo '' + echo '========================================' + echo 'Verifying audit policy setup' + echo '========================================' - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "SELECT AUDITPOLICYNAME, VALIDATESTATUS, EXECUTESTATUS, EXECUTEWITHDATA, ERRORTYPE FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='\''USER_AUDIT'\''"' db2inst1 + echo 'Users and roles assigned to USER_AUDIT:' + db2 \"SELECT * FROM SYSCAT.AUDITUSE WHERE AUDITPOLICYNAME='USER_AUDIT'\" - # ---------------------------------------------------------------- - # Disconnect - # ---------------------------------------------------------------- - echo "" - echo "Disconnecting from database" - echo "--------------------------------------------------------------------------------" + echo 'Audit policy categories for USER_AUDIT:' + db2 \"SELECT AUDITPOLICYNAME, VALIDATESTATUS, EXECUTESTATUS FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='USER_AUDIT'\" - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc "db2 connect reset" db2inst1 + db2 connect reset + echo 'Audit policy setup complete' + " db2inst1 || exit $? echo "" echo "================================================================================" From cf2d0043f6fba22ca5bd3149a17d9259b35c6f7c Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 20 Aug 2026 14:28:46 +0530 Subject: [PATCH 073/115] fix: add CPD >= 5.3.1 version gate to Cognos Analytics CR template --- .../templates/01-ibm-cognos-analytics-cr.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index 6b826bd1e..fd78a34b1 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,3 +1,4 @@ +{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0) }} --- # Persistent resource so ArgoCD has a stable non-hook object to track. # Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. @@ -89,3 +90,4 @@ spec: restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 4 +{{- end }} From c016a0bc5830f57c6c53f3666424c22f7659d373 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 20 Aug 2026 15:03:49 +0530 Subject: [PATCH 074/115] fix: restore SPSS OLM subscriptions and missing params for CPD < 5.3.1 --- ...5-3-1-gitops-support-full-explanation.html | 401 ++++++++++++++++++ .../templates/00-ibm-spss_Subscription.yaml | 22 +- .../120-ibm-spss/values.yaml | 1 + .../templates/120-ibm-spss-app.yaml | 3 + 4 files changed, 426 insertions(+), 1 deletion(-) create mode 100644 .bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html diff --git a/.bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html b/.bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html new file mode 100644 index 000000000..f5c2ee083 --- /dev/null +++ b/.bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html @@ -0,0 +1,401 @@ + + + + + +MASCORE-15507 Explainer + + + +
+

MASCORE-15507: CPD 5.3.1 GitOps Support

+

Complete explanation of every change — what was done, why, and how it works

+
+
+ +
+ Background + OLM Bootstrap + RBAC + WML + WSL + Spark + Cognos + SPSS + Post-sync + Bugs Fixed + Test Results +
+ + +
+
+ 📋 +

Background — Why This Change Was Needed

+
+
+
+
The Problem
+

CPD (Cloud Pak for Data) 5.3.1 changed how services are installed. In CPD ≤ 5.3, services were installed via OLM (Operator Lifecycle Manager) — you create a Subscription resource and an operator CR, and the OLM machinery handles everything. In CPD 5.3.1+, IBM moved to Helm-based installation — you run helm install directly to deploy the operator and service CR.

+
+
+
What This Means for GitOps
+

Our GitOps templates were only generating OLM Subscription + CR resources. On CPD 5.3.1 clusters, those resources either don't apply (no OLM catalog for them) or the operators aren't available via OLM. We needed to add a second code path that runs Helm charts instead, gated behind a version check.

+
+

Version Gate Pattern Used Throughout

+
{{/* CPD < 5.3.1: use OLM (Subscription + CR) */}} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +--- OLM Subscription resource here --- +{{- else }} +--- Helm install Job here --- +{{- end }}
+

This reads as: "if cpd_product_version < 5.3.1, use OLM; otherwise use Helm"

+
+
+ + +
+
+ 🔧 +

CPD 5.3.1 OLM Bootstrap

+ New Files +
+
+
+
Why
+

Even though services use Helm in 5.3.1, the CPD platform itself (zen, common services, etc.) still uses OLM. CPD 5.3.1 requires different catalog sources and a different olm-utils-cm ConfigMap (which tells CPD operators the correct component versions). Without this, the platform operators don't know which versions to reconcile.

+
+
+
+
instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml
instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml
+
Added olm-utils-cm ConfigMap + full release_components_meta for CPD 5.3.1
+
The olm-utils-cm ConfigMap is read by CPD operators to know component versions (case_version, csv_version, cr_version). Without it, operators fall back to wrong defaults. This is gated with {{- if eq .Values.cpd_product_version "5.3.1" }}.
+
+
+
instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml
+
Added 3 new CatalogSources for CPD 5.3.1: cpd-platform, opencloud-operators, ibm-zen-operator-catalog
+
These are pinned to specific digest-based image tags for CPD 5.3.1. Different from 5.3.0 — if you use the wrong catalog, operators install wrong versions or fail to find their CSVs.
+
+
+
+
+ + +
+
+ 🔐 +

RBAC — ClusterRole for cpd-sa

+ Security +
+
+
+
Why
+

The Helm install jobs run as the cpd-sa ServiceAccount. In Helm mode, the cluster-scoped charts install CRDs and ClusterRoles across the entire cluster (not just one namespace). cpd-sa only had namespace-scoped permissions before — it couldn't create CRDs or ClusterRoles. This caused every Helm install job to fail with Forbidden errors.

+
+
+
instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml
+
Added ClusterRole + ClusterRoleBinding for cpd-sa (gated on CPD ≥ 5.3.1)
+
Grants cpd-sa permission to: create/patch CRDs, create/patch ClusterRoles (with escalate), manage webhooks, and access CPD service API groups. The escalate verb is needed because the Helm charts grant permissions that cpd-sa doesn't initially hold.
+
+
+
+ + +
+
+ 🤖 +

Watson Machine Learning (WML)

+ Helm Path Added +
+
+
+
Why Helm for WML
+

WML on CPD 5.3.1 requires installing Redis as a dependency first (WML operator needs Redis CRDs to exist before it can be deployed), then installing the WML operator + CR via Helm charts.

+
+

Install Order (CPD 5.3.1+)

+
+
ibm-redis-cp-cluster-scoped (CRDs)
+ → +
ibm-redis-cp (operator)
+ → +
Poll rediscps.redis.ibm.com CRD
+ → +
wml-cluster-scoped (CRDs)
+ → +
Poll wmlbases.wml.cpd.ibm.com CRD
+ → +
wml (operator + CR)
+
+

Key Bug Fixed

+
+ 🐛 +
+
CRD poll typo: redicps → rediscps
+
The script polled for redicps.redis.ibm.com (missing 's') which never exists. The actual CRD is rediscps.redis.ibm.com. This caused the job to time out after 5 minutes every time.
+
+
+

Hashed Job Name Pattern

+
+
Why hashed names
+

ArgoCD Jobs have immutable spec.template. If we use a fixed name like install-wml-helm and the template changes, ArgoCD tries to patch the existing Job → fails with "field is immutable". By computing a hash from the template content + version string, each change produces a new unique job name, so ArgoCD creates a new Job instead of patching the old one.

+
+
{{- $_job_version := "v2" }} ← bump this to force new job +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} +→ produces: install-wml-helm-502535097
+
+
+ + +
+
+ 🔬 +

Watson Studio (WSL)

+ Helm Path Added +
+
+
+
Why WSL is Complex
+

WSL has 4 dependencies that must be installed in order before WSL itself can be installed. Each dependency needs its cluster-scoped chart (CRDs) before its namespace-scoped chart (operator+CR).

+
+

Install Order (CPD 5.3.1+)

+
+
1. opencontent-opensearch
+ → +
2. ccs (+ explicit CCS CR)
+ → +
3. datarefinery
+ → +
4. ws-runtimes
+ → +
5. ws (Watson Studio)
+
+
+
CCS CR created explicitly with non_olm_deploy: true
+
In Helm mode, the CCS namespace-scoped chart only deploys the operator, not the CR. The CR must be created manually with non_olm_deploy: true flag so the operator knows it's not running under OLM and proceeds to reconcile the CCS instance.
+
+
+
install_component() helper function
+
Reusable function that: (1) applies cluster-scoped chart via helm template | oc apply, (2) waits for CRDs, (3) runs helm upgrade --install for namespace-scoped chart. Makes the script DRY and readable.
+
+
+
+ + +
+
+ ⚡ +

Apache Spark (Analytics Engine)

+ Helm Path Added +
+
+
+
Changes
+

Gated OLM Subscription, AnalyticsEngine CR, and the control-plane verification job behind < 5.3.1. Added Helm install job for 5.3.1+ using analyticsengine-cluster-scoped + analyticsengine charts at version 12.1.0. Also added cpd_product_version to values.yaml and the instance-root app template — without this, the version gate Helm template would fail (no value to compare against).

+
+
+
+ + +
+
+ 📊 +

Cognos Analytics

+ New Chart + 3 Bugs Fixed +
+
+
+
Context
+

Cognos Analytics was previously bundled with the SPSS chart (they shared the same ArgoCD app template 120-ibm-spss-app.yaml). They were split into separate charts. In the split, the Chart.yaml was accidentally omitted from the Cognos chart.

+
+
+
+
Bug 1: Missing Chart.yaml
+
Helm requires Chart.yaml to treat a directory as a chart. Without it, helm dependency update fails with "Chart.yaml file is missing". Added Chart.yaml matching the pattern of all other charts in the repo.
+
+
+
Bug 2: Escaped quotes parse error in instance-root template
+
The 120-ibm-cognos-analytics-app.yaml used \"nfs-client\" inside a YAML literal block scalar (value: |). Inside a block scalar, backslash escapes are literal characters, not YAML escapes — causing Helm to fail with "unexpected \\ in operand". Fixed by using unescaped "nfs-client".
+
+
+
Bug 3: Wrong CRD poll name
+
The Helm install job polled for cognosanalytics.cognosanalytics.cpd.ibm.com but the cognos-analytics-cluster-scoped chart actually creates caservices.ca.cpd.ibm.com and caserviceinstances.ca.cpd.ibm.com. Fixed to poll caservices.ca.cpd.ibm.com.
+
+
+
+
+ + +
+
+ 📈 +

SPSS Modeler

+ Re-added + CPD 5.3.1 Support +
+
+
+
Context
+

SPSS was previously available only for CPD < 5.3.1 via OLM. For CPD 5.3.1+, IBM provides spss-cluster-scoped + spss Helm charts, but SPSS requires Canvasbase as a dependency (the SPSS operator tries to create a Canvasbase CR on startup).

+
+

Install Order (CPD 5.3.1+)

+
+
canvasbase-cluster-scoped (CRDs) v12.1.0
+ → +
Poll canvasbase.canvasbase.cpd.ibm.com
+ → +
canvasbase (operator+CR) v12.1.0
+ → +
Wait canvasbase Completed
+ → +
spss-cluster-scoped (CRDs) v12.1.0
+ → +
Poll spss.spssmodeler.cpd.ibm.com
+ → +
spss (operator+CR) v12.1.0
+
+

Bugs Found and Fixed During Testing

+
+ 🐛 +
+
Wrong chart names: spss-modeler-cluster-scoped / spss-modeler
+
Correct names in IBM Helm repo are spss-cluster-scoped and spss. Fixed by querying the IBM Helm index directly.
+
+
+
+ 🐛 +
+
Wrong chart versions: 13.0.4 (CPD 5.4.0) instead of 12.1.0 (CPD 5.3.1)
+
Initially used the latest version (13.0.4) which is for CPD 5.4.0. The CPD 5.3.1 release_components_meta specifies case_version: 12.1.0 for both canvasbase and spss. Using wrong version caused "CR version 13.0.4 does not match operator version 12.1.0" errors.
+
+
+
+ 🐛 +
+
Wrong CRD poll names
+
Polled for spssmodelerbases.spssmodeler.cpd.ibm.com (doesn't exist) → actual CRD is spss.spssmodeler.cpd.ibm.com. Polled for canvasbases.cpd.ibm.com → actual CRD is canvasbase.canvasbase.cpd.ibm.com. Both found by checking oc get crd | grep after the cluster-scoped chart ran.
+
+
+
+ 🐛 +
+
canvasbase CR version mismatch (13.0.4 vs 12.1.0)
+
The canvasbase Helm chart created the CR with version 12.1.0 but the operator was 13.0.4 (from the wrong chart version). Fixed by correcting chart version. Required manually patching the stuck CR and deleting/recreating the SPSS CR once canvasbase reached Completed.
+
+
+
+
+ + +
+
+ 🔄 +

Post-Sync Job (121-ibm-post-sync-job-cp4d-services)

+ Guard Added +
+
+
+
Why
+

The post-sync job patches CCS and OpenSearch CRs after they're deployed via OLM. In CPD 5.3.1 Helm mode, these CRs are managed by Helm — patching them via the post-sync job would break Helm's management of them. Added an early exit for CPD ≥ 5.3.1.

+
+
COMP_531=$(compare_versions ${CPD_PRODUCT_VERSION} 5.3.1) +if [[ ${COMP_531} -ge 0 ]]; then + echo "CPD >= 5.3.1 - skipping OLM post-sync patching" + exit 0 +fi
+
+
+ + +
+
+ 🐛 +

All Bugs Found & Fixed During Testing

+
+
+ + + + + + + + + + + + + +
FileBugFix
120-ibm-cognos-analytics-app.yamlEscaped quotes \" in block scalarRemoved backslash escapes
120-ibm-cognos-analytics/Missing Chart.yamlAdded Chart.yaml
02-ibm-wml-cr.yamlCRD poll: redicps → rediscpsFixed typo
01-ibm-cognos-analytics-cr.yamlCRD poll: wrong CRD namecaservices.ca.cpd.ibm.com
01-ibm-spss-cr.yamlChart names wrongspss-cluster-scoped / spss
01-ibm-spss-cr.yamlChart version 13.0.4 (CPD 5.4)12.1.0 (CPD 5.3.1)
01-ibm-spss-cr.yamlCRD poll: spssmodelerbasesspss.spssmodeler.cpd.ibm.com
01-ibm-spss-cr.yamlCRD poll: canvasbases.cpd.ibm.comcanvasbase.canvasbase.cpd.ibm.com
01-ibm-spss-cr.yamlMissing canvasbase dependencyAdded canvasbase install step before spss
01-ibm-cognos-analytics-cr.yamlChart version 29.1.8 (too new)29.1.0 (CPD 5.3.1 metadata)
02-ibm-wml-cr.yamlFixed job name (immutable field error)Added hashed job name pattern
+
+
+ + +
+
+ ✅ +

Test Results — noble8 cluster, CPD 5.3.1, inst02

+
+
+
wml.noble8.inst02✅ WmlBase/wml-cr — Completed 100%
+
wsl.noble8.inst02✅ Synced Healthy
+
spark.noble8.inst02✅ Synced Healthy
+
cognos.noble8.inst02✅ CAService/ca-addon-cr — Completed 100%
+
spss.noble8.inst02✅ canvasbase + spss — Completed 100%
+
+
+ +
+ + diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index 2602216e4..0e5fc2c69 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -12,8 +12,28 @@ metadata: {{ .Values.custom_labels | toYaml | indent 4 }} {{- end }} spec: + name: "ibm-cpd-spss" channel: "{{ .Values.spss_channel }}" - name: spss-modeler source: ibm-operator-catalog sourceNamespace: openshift-marketplace + installPlanApproval: {{ .Values.spss_install_plan | default "Automatic" | quote }} + +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: "ibm-cpd-canvasbase-operator-catalog-subscription" # needed only by spss + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + name: "ibm-cpd-canvasbase" + channel: "{{ .Values.canvasbase_channel }}" + source: ibm-operator-catalog + sourceNamespace: openshift-marketplace + installPlanApproval: {{ .Values.canvasbase_install_plan | default "Automatic" | quote }} {{- end }} diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml index b7c0618d7..b41375d99 100644 --- a/instance-applications/120-ibm-spss/values.yaml +++ b/instance-applications/120-ibm-spss/values.yaml @@ -4,5 +4,6 @@ cpd_service_block_storage_class: "" cpd_service_scale_config: "" cpd_service_storage_class: "" spss_channel: "" +spss_install_plan: "" spss_version: "" cpd_product_version: "" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index ed753aca9..738d3e86b 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -54,7 +54,10 @@ spec: cpd_service_scale_config: "{{ .Values.ibm_spss.cpd_service_scale_config }}" spss_version: "{{ .Values.ibm_spss.spss_version }}" spss_channel: "{{ .Values.ibm_spss.spss_channel }}" + spss_install_plan: "{{ .Values.ibm_spss.spss_install_plan }}" ccs_version: "{{ .Values.ibm_spss.ccs_version }}" + canvasbase_channel: "{{ .Values.ibm_spss.canvasbase_channel }}" + canvasbase_install_plan: "{{ .Values.ibm_spss.canvasbase_install_plan }}" {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} {{- end }} From 7cebd4bc0060c60c87844484ce0a45ba715e692d Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 20 Aug 2026 20:13:15 +0530 Subject: [PATCH 075/115] fix: revert kind back to Spss for CPD < 5.3.1 OLM path --- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index e75bf0777..ab90517d4 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,7 +1,7 @@ {{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: spssmodeler.cpd.ibm.com/v1 -kind: SPSSModeler +kind: Spss metadata: name: "spssmodeler-cr" namespace: "{{ .Values.cpd_instance_namespace }}" From 768133a1d00499f57d90b2c97bdd50d0685d4cd7 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 20 Aug 2026 23:14:13 +0530 Subject: [PATCH 076/115] fix: read chart versions from olm-utils-cm, move SkipDryRunOnMissingResource to cluster-scoped MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three fixes across all 5 CPD >= 5.3.1 native ArgoCD Helm App templates: 1. Version lookup from olm-utils-cm - Replace all hardcoded targetRevision strings with values read at render time from the olm-utils-cm ConfigMap (deployed by wave 110). - Uses Helm lookup() with per-component fallback defaults so helm template dry-runs (where the cluster is not reachable) still work. - Components resolved: wml, ibm_redis_cp, analyticsengine, canvasbase, spss, opencontent_opensearch, ccs, datarefinery, ws_runtimes, ws, cognos_analytics 2. SkipDryRunOnMissingResource moved to cluster-scoped apps - Cluster-scoped charts install CRDs; ArgoCD needs to skip the dry-run for those apps on first deploy when the CRDs don't exist yet. - Namespace-scoped apps no longer carry this option — they run after the CRDs are established by the preceding cluster-scoped wave. 3. OLM Subscription files unchanged - Existing files gated < 5.3.1 are correct and intentional; no changes. --- .../120-ibm-cognos-analytics-app.yaml | 123 +++-- .../templates/120-ibm-spark-app.yaml | 118 ++++- .../templates/120-ibm-spss-app.yaml | 204 ++++++++ .../templates/120-ibm-wml-app.yaml | 204 +++++++- .../templates/120-ibm-wsl-app.yaml | 472 ++++++++++++++++++ 5 files changed, 1070 insertions(+), 51 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index 6ceaf52db..6299666f9 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -1,7 +1,65 @@ {{- if and (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) (not (lt (semver "5.3.1" | (semver (.Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString)).Compare) 0)) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +{{ $cpd_instance_ns := .Values.ibm_cp4d.cpd_instance_namespace }} +{{ $cpd_version := .Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString }} +{{- /* + Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). + Falls back to known-good defaults if the ConfigMap is not yet present + (e.g. during a helm template dry-run). +*/}} +{{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} +{{- $meta := dict }} +{{- if $olmUtils }} +{{- $meta = $olmUtils.data.release_components_meta | fromYaml }} +{{- end }} +{{- $cognosVersion := (index $meta "cognos_analytics" | default dict).case_version | default "29.1.0" }} +--- +# CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) +# Wave 119: cognos-analytics cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cognos-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "119" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: cognos-analytics-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $cognosVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true --- -# IBM Cognos Analytics Application +# Wave 120: cognos-analytics namespace-scoped (operator + CR) apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -27,57 +85,28 @@ spec: project: "{{ .Values.argo.projects.apps }}" destination: server: {{ .Values.cluster.url }} - namespace: {{ $cpd_operators_ns }} + namespace: {{ $cpd_instance_ns }} source: - repoURL: "{{ .Values.source.repo_url }}" - path: instance-applications/120-ibm-cognos-analytics - targetRevision: "{{ .Values.source.revision }}" - plugin: - name: {{ .Values.avp.name }} - env: - - name: {{ .Values.avp.values_varname }} - value: | - account_id: "{{ .Values.account.id }}" - region_id: "{{ .Values.region.id }}" - cluster_id: "{{ .Values.cluster.id }}" - instance_id: "{{ .Values.instance.id }}" - cli_image_repo: {{ .Values.cli_image_repo }} - cluster_admin_role: {{ .Values.cluster_admin_role }} - application_admin_role: {{ .Values.application_admin_role }} - sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" - sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" - cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" - cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" - cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" - cpd_service_storage_class: "{{ .Values.ibm_cp4d.cpd_service_storage_class | default "nfs-client" }}" - cpd_service_block_storage_class: "{{ .Values.ibm_cp4d.cpd_service_block_storage_class | default "nfs-client" }}" - cpd_service_scale_config: "{{ .Values.ibm_cp4d.cpd_service_scale_config | default "small" }}" - ccs_version: "{{ .Values.ibm_cp4d.ccs_version | default "12.1.0" }}" - {{- if .Values.custom_labels }} - custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} - {{- end }} - junitreporter: - reporter_name: "ibm-cognos-analytics-{{ .Values.instance.id }}" - cluster_id: "{{ .Values.cluster.id }}" - instance_id: "{{ .Values.instance.id }}" - devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" - devops_build_number: "{{ .Values.devops.build_number }}" - gitops_version: "{{ .Values.source.revision }}" - cli_image_repo: {{ .Values.cli_image_repo }} - - name: ARGOCD_APP_NAME - value: cpdcognosapp - {{- if not (empty .Values.avp.secret) }} - - name: AVP_SECRET - value: {{ .Values.avp.secret }} - {{- end }} + chart: cognos-analytics + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $cognosVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_cp4d.cpd_service_storage_class | default "nfs-client" }} + blockStorageClass: {{ .Values.ibm_cp4d.cpd_service_block_storage_class | default "nfs-client" }} + imagePullSecret: ibm-entitlement-key + cognos-analytics: + scaleConfig: {{ .Values.ibm_cp4d.cpd_service_scale_config | default "small" }} syncPolicy: automated: - {{- if .Values.auto_delete }} - prune: true - {{- end }} selfHeal: true retry: limit: 20 syncOptions: - - CreateNamespace=false + - CreateNamespace=true {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml index af0446795..832973259 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml @@ -1,7 +1,12 @@ {{- if and (not (empty .Values.ibm_spark)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +{{ $cpd_instance_ns := .Values.ibm_cp4d.cpd_instance_namespace }} +{{ $cpd_version := .Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString }} +{{ $is531 := not (lt (semver "5.3.1" | (semver $cpd_version).Compare) 0) }} +{{- if not $is531 }} --- -# IBM Maximo Operator Catalog +# CPD < 5.3.1 — OLM path +# IBM Spark Application apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -38,7 +43,7 @@ spec: path: instance-applications/120-ibm-spark targetRevision: "{{ .Values.source.revision }}" plugin: - name: {{ .Values.avp.name }} + name: {{ .Values.avp.name }} env: - name: {{ .Values.avp.values_varname }} value: | @@ -84,4 +89,113 @@ spec: syncOptions: - CreateNamespace=false - RespectIgnoreDifferences=true +{{- else }} +{{- /* + Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). + Falls back to known-good defaults if the ConfigMap is not yet present + (e.g. during a helm template dry-run). +*/}} +{{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} +{{- $meta := dict }} +{{- if $olmUtils }} +{{- $meta = $olmUtils.data.release_components_meta | fromYaml }} +{{- end }} +{{- $sparkVersion := (index $meta "analyticsengine" | default dict).case_version | default "12.1.0" }} +--- +# CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) +# Wave 119: analyticsengine cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spark-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "119" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: analyticsengine-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $sparkVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 120: analyticsengine namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spark.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "120" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: analyticsengine + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $sparkVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_spark.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_spark.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + analyticsengine: + scaleConfig: {{ .Values.ibm_spark.cpd_service_scale_config }} + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +{{- end }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index 738d3e86b..f28ff34df 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -1,6 +1,11 @@ {{- if and (not (empty .Values.ibm_spss)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +{{ $cpd_instance_ns := .Values.ibm_cp4d.cpd_instance_namespace }} +{{ $cpd_version := .Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString }} +{{ $is531 := not (lt (semver "5.3.1" | (semver $cpd_version).Compare) 0) }} +{{- if not $is531 }} --- +# CPD < 5.3.1 — OLM path # IBM SPSS Modeler Application apiVersion: argoproj.io/v1alpha1 kind: Application @@ -85,4 +90,203 @@ spec: limit: 20 syncOptions: - CreateNamespace=false +{{- else }} +{{- /* + Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). + Falls back to known-good defaults if the ConfigMap is not yet present + (e.g. during a helm template dry-run). +*/}} +{{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} +{{- $meta := dict }} +{{- if $olmUtils }} +{{- $meta = $olmUtils.data.release_components_meta | fromYaml }} +{{- end }} +{{- $canvasbaseVersion := (index $meta "canvasbase" | default dict).case_version | default "12.1.0" }} +{{- $spssVersion := (index $meta "spss" | default dict).case_version | default "12.1.0" }} +--- +# CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) +# Wave 119: canvasbase cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spss-canvasbase-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "119" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: canvasbase-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $canvasbaseVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 120: canvasbase namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spss-canvasbase.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "120" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: canvasbase + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $canvasbaseVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_spss.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_spss.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +--- +# Wave 121: SPSS cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spss-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "121" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: spss-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $spssVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 122: SPSS namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spss.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "122" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: spss + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $spssVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_spss.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_spss.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + spss: + scaleConfig: {{ .Values.ibm_spss.cpd_service_scale_config }} + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +{{- end }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml index f5779542f..5a8374b89 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml @@ -1,7 +1,12 @@ {{- if and (not (empty .Values.ibm_wml)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +{{ $cpd_instance_ns := .Values.ibm_cp4d.cpd_instance_namespace }} +{{ $cpd_version := .Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString }} +{{ $is531 := not (lt (semver "5.3.1" | (semver $cpd_version).Compare) 0) }} +{{- if not $is531 }} --- -# IBM Maximo Operator Catalog +# CPD < 5.3.1 — OLM path +# IBM WML Application apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -38,7 +43,7 @@ spec: path: instance-applications/120-ibm-wml targetRevision: "{{ .Values.source.revision }}" plugin: - name: {{ .Values.avp.name }} + name: {{ .Values.avp.name }} env: - name: {{ .Values.avp.values_varname }} value: | @@ -82,4 +87,199 @@ spec: syncOptions: - CreateNamespace=false - RespectIgnoreDifferences=true +{{- else }} +{{- /* + Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). + Falls back to known-good defaults if the ConfigMap is not yet present + (e.g. during a helm template dry-run). +*/}} +{{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} +{{- $meta := dict }} +{{- if $olmUtils }} +{{- $meta = $olmUtils.data.release_components_meta | fromYaml }} +{{- end }} +{{- $redisVersion := (index $meta "ibm_redis_cp" | default dict).case_version | default "1.3.1" }} +{{- $wmlVersion := (index $meta "wml" | default dict).case_version | default "12.1.0" }} +--- +# CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) +# Wave 119: ibm-redis-cp cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wml-redis-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "119" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: ibm-redis-cp-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $redisVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 120: ibm-redis-cp namespace-scoped (operator) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wml-redis.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "120" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: ibm-redis-cp + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $redisVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false +--- +# Wave 121: WML cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wml-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "121" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: wml-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $wmlVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 122: WML namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wml.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "122" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: wml + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $wmlVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_wml.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_wml.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + wml: + scaleConfig: {{ .Values.ibm_wml.cpd_service_scale_config }} + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +{{- end }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index 43098f834..76d3bcf17 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -1,6 +1,11 @@ {{- if and (not (empty .Values.ibm_wsl)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +{{ $cpd_instance_ns := .Values.ibm_cp4d.cpd_instance_namespace }} +{{ $cpd_version := .Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString }} +{{ $is531 := not (lt (semver "5.3.1" | (semver $cpd_version).Compare) 0) }} +{{- if not $is531 }} --- +# CPD < 5.3.1 — OLM path # IBM Maximo Operator Catalog apiVersion: argoproj.io/v1alpha1 kind: Application @@ -85,4 +90,471 @@ spec: limit: 20 syncOptions: - CreateNamespace=false +{{- else }} +{{- /* + Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). + Falls back to known-good defaults if the ConfigMap is not yet present + (e.g. during a helm template dry-run). +*/}} +{{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} +{{- $meta := dict }} +{{- if $olmUtils }} +{{- $meta = $olmUtils.data.release_components_meta | fromYaml }} +{{- end }} +{{- $opensearchVersion := (index $meta "opencontent_opensearch" | default dict).case_version | default "1.2.0" }} +{{- $ccsVersion := (index $meta "ccs" | default dict).case_version | default "12.1.0" }} +{{- $datarefineryVersion := (index $meta "datarefinery" | default dict).case_version | default "12.1.0" }} +{{- $wsRuntimesVersion := (index $meta "ws_runtimes" | default dict).case_version | default "12.1.0" }} +{{- $wsVersion := (index $meta "ws" | default dict).case_version | default "12.1.0" }} +--- +# CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) +# Wave 115: opencontent-opensearch cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-opensearch-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "115" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: opencontent-opensearch-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $opensearchVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 116: opencontent-opensearch namespace-scoped (operator) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-opensearch.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "116" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: opencontent-opensearch + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $opensearchVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false +--- +# Wave 117: ccs cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-ccs-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "117" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: ccs-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $ccsVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 118: ccs namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-ccs.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "118" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: ccs + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $ccsVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_wsl.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_wsl.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + ccs: + scaleConfig: {{ .Values.ibm_wsl.cpd_service_scale_config }} + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +--- +# Wave 119: datarefinery cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-datarefinery-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "119" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: datarefinery-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $datarefineryVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 120: datarefinery namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-datarefinery.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "120" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: datarefinery + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $datarefineryVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_wsl.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_wsl.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +--- +# Wave 121: ws-runtimes cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-ws-runtimes-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "121" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: ws-runtimes-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $wsRuntimesVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 122: ws-runtimes namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-ws-runtimes.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "122" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: ws-runtimes + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $wsRuntimesVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_wsl.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_wsl.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +--- +# Wave 123: ws cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "123" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: ws-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $wsVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 124: ws namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "124" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: ws + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $wsVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_wsl.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_wsl.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + ws: + scaleConfig: {{ .Values.ibm_wsl.cpd_service_scale_config }} + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +{{- end }} {{- end }} From 34ea07b966ddcc6a60a1a786691358e9b8445651 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 20 Aug 2026 23:23:13 +0530 Subject: [PATCH 077/115] fix: expose chart versions as gitops config values for CPD >= 5.3.1 services MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously, Helm chart targetRevision values for WML, WSL, Spark, SPSS and Cognos Analytics were resolved only from olm-utils-cm (cluster lookup) or hardcoded defaults. This meant operators could not pin or override versions through the gitops config repo — any CPD version >= 5.3.1 would always get the 5.3.1 chart versions baked into the ConfigMap at install time. Resolution priority is now (highest first): 1. Explicit gitops config value (e.g. ibm_wml.wml_chart_version) 2. olm-utils-cm ConfigMap lookup (auto, from wave 110-ibm-cp4d) 3. Hardcoded default (dry-run safety net only) New optional values added to each service values.yaml: WML: wml_chart_version, redis_chart_version Spark: spark_chart_version SPSS: spss_chart_version, canvasbase_chart_version WSL: ws_chart_version, ccs_chart_version, datarefinery_chart_version, ws_runtimes_chart_version, opensearch_chart_version Cognos: cognos_chart_version (under ibm_cp4d) All values default to empty string so existing deployments are unaffected — the olm-utils-cm lookup continues to provide the version automatically when no explicit value is set. --- instance-applications/120-ibm-spark/values.yaml | 3 +++ instance-applications/120-ibm-spss/values.yaml | 4 ++++ instance-applications/120-ibm-wml/values.yaml | 4 ++++ instance-applications/120-ibm-wsl/values.yaml | 7 +++++++ .../templates/120-ibm-cognos-analytics-app.yaml | 9 +++++---- .../templates/120-ibm-spark-app.yaml | 9 +++++---- .../templates/120-ibm-spss-app.yaml | 11 ++++++----- .../templates/120-ibm-wml-app.yaml | 11 ++++++----- .../templates/120-ibm-wsl-app.yaml | 17 +++++++++-------- 9 files changed, 49 insertions(+), 26 deletions(-) diff --git a/instance-applications/120-ibm-spark/values.yaml b/instance-applications/120-ibm-spark/values.yaml index 25e5c803b..87a73f348 100644 --- a/instance-applications/120-ibm-spark/values.yaml +++ b/instance-applications/120-ibm-spark/values.yaml @@ -6,3 +6,6 @@ cpd_service_storage_class: "" spark_channel: "" spark_version: "" cpd_product_version: "" +# Optional: pin Helm chart version for CPD >= 5.3.1 native install. +# When empty, version is read from olm-utils-cm (deployed by wave 110). +spark_chart_version: "" diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml index b41375d99..49245cfa5 100644 --- a/instance-applications/120-ibm-spss/values.yaml +++ b/instance-applications/120-ibm-spss/values.yaml @@ -7,3 +7,7 @@ spss_channel: "" spss_install_plan: "" spss_version: "" cpd_product_version: "" +# Optional: pin Helm chart versions for CPD >= 5.3.1 native install. +# When empty, versions are read from olm-utils-cm (deployed by wave 110). +spss_chart_version: "" +canvasbase_chart_version: "" diff --git a/instance-applications/120-ibm-wml/values.yaml b/instance-applications/120-ibm-wml/values.yaml index 56dedaab2..1cae71e22 100644 --- a/instance-applications/120-ibm-wml/values.yaml +++ b/instance-applications/120-ibm-wml/values.yaml @@ -6,3 +6,7 @@ cpd_service_storage_class: "" wml_channel: "" wml_version: "" cpd_product_version: "" +# Optional: pin Helm chart versions for CPD >= 5.3.1 native install. +# When empty, versions are read from olm-utils-cm (deployed by wave 110). +wml_chart_version: "" +redis_chart_version: "" diff --git a/instance-applications/120-ibm-wsl/values.yaml b/instance-applications/120-ibm-wsl/values.yaml index 9f5bfb988..2f1f33bb7 100644 --- a/instance-applications/120-ibm-wsl/values.yaml +++ b/instance-applications/120-ibm-wsl/values.yaml @@ -7,3 +7,10 @@ wsl_channel: "" ccs_version: "" datarefinery_version: "" ws_runtimes_version: "" +# Optional: pin Helm chart versions for CPD >= 5.3.1 native install. +# When empty, versions are read from olm-utils-cm (deployed by wave 110). +ws_chart_version: "" +ccs_chart_version: "" +datarefinery_chart_version: "" +ws_runtimes_chart_version: "" +opensearch_chart_version: "" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index 6299666f9..0a3ff9675 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -3,16 +3,17 @@ {{ $cpd_instance_ns := .Values.ibm_cp4d.cpd_instance_namespace }} {{ $cpd_version := .Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString }} {{- /* - Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). - Falls back to known-good defaults if the ConfigMap is not yet present - (e.g. during a helm template dry-run). + Chart version resolution (highest priority first): + 1. Explicit gitops config value (ibm_cp4d.cognos_chart_version) + 2. olm-utils-cm ConfigMap lookup (deployed by wave 110-ibm-cp4d) + 3. Hardcoded default (safety net for helm template dry-runs) */}} {{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} {{- $meta := dict }} {{- if $olmUtils }} {{- $meta = $olmUtils.data.release_components_meta | fromYaml }} {{- end }} -{{- $cognosVersion := (index $meta "cognos_analytics" | default dict).case_version | default "29.1.0" }} +{{- $cognosVersion := .Values.ibm_cp4d.cognos_chart_version | default ((index $meta "cognos_analytics" | default dict).case_version | default "29.1.0") }} --- # CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) # Wave 119: cognos-analytics cluster-scoped (CRDs + ClusterRoles) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml index 832973259..40204e5da 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml @@ -91,16 +91,17 @@ spec: - RespectIgnoreDifferences=true {{- else }} {{- /* - Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). - Falls back to known-good defaults if the ConfigMap is not yet present - (e.g. during a helm template dry-run). + Chart version resolution (highest priority first): + 1. Explicit gitops config value (e.g. ibm_spark.spark_chart_version) + 2. olm-utils-cm ConfigMap lookup (deployed by wave 110-ibm-cp4d) + 3. Hardcoded default (safety net for helm template dry-runs) */}} {{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} {{- $meta := dict }} {{- if $olmUtils }} {{- $meta = $olmUtils.data.release_components_meta | fromYaml }} {{- end }} -{{- $sparkVersion := (index $meta "analyticsengine" | default dict).case_version | default "12.1.0" }} +{{- $sparkVersion := .Values.ibm_spark.spark_chart_version | default ((index $meta "analyticsengine" | default dict).case_version | default "12.1.0") }} --- # CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) # Wave 119: analyticsengine cluster-scoped (CRDs + ClusterRoles) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index f28ff34df..43a108b31 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -92,17 +92,18 @@ spec: - CreateNamespace=false {{- else }} {{- /* - Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). - Falls back to known-good defaults if the ConfigMap is not yet present - (e.g. during a helm template dry-run). + Chart version resolution (highest priority first): + 1. Explicit gitops config value (e.g. ibm_spss.spss_chart_version) + 2. olm-utils-cm ConfigMap lookup (deployed by wave 110-ibm-cp4d) + 3. Hardcoded default (safety net for helm template dry-runs) */}} {{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} {{- $meta := dict }} {{- if $olmUtils }} {{- $meta = $olmUtils.data.release_components_meta | fromYaml }} {{- end }} -{{- $canvasbaseVersion := (index $meta "canvasbase" | default dict).case_version | default "12.1.0" }} -{{- $spssVersion := (index $meta "spss" | default dict).case_version | default "12.1.0" }} +{{- $canvasbaseVersion := .Values.ibm_spss.canvasbase_chart_version | default ((index $meta "canvasbase" | default dict).case_version | default "12.1.0") }} +{{- $spssVersion := .Values.ibm_spss.spss_chart_version | default ((index $meta "spss" | default dict).case_version | default "12.1.0") }} --- # CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) # Wave 119: canvasbase cluster-scoped (CRDs + ClusterRoles) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml index 5a8374b89..bbaaa771e 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml @@ -89,17 +89,18 @@ spec: - RespectIgnoreDifferences=true {{- else }} {{- /* - Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). - Falls back to known-good defaults if the ConfigMap is not yet present - (e.g. during a helm template dry-run). + Chart version resolution (highest priority first): + 1. Explicit gitops config value (e.g. ibm_wml.wml_chart_version) + 2. olm-utils-cm ConfigMap lookup (deployed by wave 110-ibm-cp4d) + 3. Hardcoded default (safety net for helm template dry-runs) */}} {{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} {{- $meta := dict }} {{- if $olmUtils }} {{- $meta = $olmUtils.data.release_components_meta | fromYaml }} {{- end }} -{{- $redisVersion := (index $meta "ibm_redis_cp" | default dict).case_version | default "1.3.1" }} -{{- $wmlVersion := (index $meta "wml" | default dict).case_version | default "12.1.0" }} +{{- $redisVersion := .Values.ibm_wml.redis_chart_version | default ((index $meta "ibm_redis_cp" | default dict).case_version | default "1.3.1") }} +{{- $wmlVersion := .Values.ibm_wml.wml_chart_version | default ((index $meta "wml" | default dict).case_version | default "12.1.0") }} --- # CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) # Wave 119: ibm-redis-cp cluster-scoped (CRDs + ClusterRoles) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index 76d3bcf17..dc91e476e 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -92,20 +92,21 @@ spec: - CreateNamespace=false {{- else }} {{- /* - Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). - Falls back to known-good defaults if the ConfigMap is not yet present - (e.g. during a helm template dry-run). + Chart version resolution (highest priority first): + 1. Explicit gitops config value (e.g. ibm_wsl.ws_chart_version) + 2. olm-utils-cm ConfigMap lookup (deployed by wave 110-ibm-cp4d) + 3. Hardcoded default (safety net for helm template dry-runs) */}} {{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} {{- $meta := dict }} {{- if $olmUtils }} {{- $meta = $olmUtils.data.release_components_meta | fromYaml }} {{- end }} -{{- $opensearchVersion := (index $meta "opencontent_opensearch" | default dict).case_version | default "1.2.0" }} -{{- $ccsVersion := (index $meta "ccs" | default dict).case_version | default "12.1.0" }} -{{- $datarefineryVersion := (index $meta "datarefinery" | default dict).case_version | default "12.1.0" }} -{{- $wsRuntimesVersion := (index $meta "ws_runtimes" | default dict).case_version | default "12.1.0" }} -{{- $wsVersion := (index $meta "ws" | default dict).case_version | default "12.1.0" }} +{{- $opensearchVersion := .Values.ibm_wsl.opensearch_chart_version | default ((index $meta "opencontent_opensearch" | default dict).case_version | default "1.2.0") }} +{{- $ccsVersion := .Values.ibm_wsl.ccs_chart_version | default ((index $meta "ccs" | default dict).case_version | default "12.1.0") }} +{{- $datarefineryVersion := .Values.ibm_wsl.datarefinery_chart_version | default ((index $meta "datarefinery" | default dict).case_version | default "12.1.0") }} +{{- $wsRuntimesVersion := .Values.ibm_wsl.ws_runtimes_chart_version | default ((index $meta "ws_runtimes" | default dict).case_version | default "12.1.0") }} +{{- $wsVersion := .Values.ibm_wsl.ws_chart_version | default ((index $meta "ws" | default dict).case_version | default "12.1.0") }} --- # CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) # Wave 115: opencontent-opensearch cluster-scoped (CRDs + ClusterRoles) From 6d2e644e2c8888fc005dfda40f738d96d74273cb Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 21 Aug 2026 00:43:22 +0530 Subject: [PATCH 078/115] fix: remove dead cpd-sa Helm ClusterRole now that K8s Jobs are replaced MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The cpd-sa-helm-cluster-role-{instance_id} ClusterRole and its ClusterRoleBinding were created to give the cpd-sa ServiceAccount cluster-level permissions (CRD management, escalate on ClusterRoles, SCC use) so it could run 'helm install' for the CPD 5.3.1+ service charts inside a K8s Job pod. Those Helm Job pods are now gone — all CPD >= 5.3.1 service installs are handled by native ArgoCD Applications which run as ArgoCD itself (already has cluster admin). cpd-sa is no longer used for Helm installs. Leaving this ClusterRole in place: - Creates an over-privileged escalate-capable ClusterRole with no consumer - Violates least-privilege (escalate + CRD delete + SCC use granted unnecessarily) - Was flagged by rbinns as a PR blocker ClusterRole and ClusterRoleBinding removed. The cpd-sa ServiceAccount and its existing namespace-scoped Role (admin RoleBinding to the instance namespace) are unaffected. --- .../templates/02-ibm-cp4d_rbac.yaml | 140 ------------------ 1 file changed, 140 deletions(-) diff --git a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml index 4c9e7cff5..de6530309 100644 --- a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml +++ b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml @@ -1527,143 +1527,3 @@ roleRef: kind: ClusterRole name: admin -{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0) }} ---- -# For CPD 5.3.1+, cpd-sa needs cluster-level permissions to apply CRDs and -# ClusterRoles from the Helm cluster-scoped charts during service installation. -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: "cpd-sa-helm-cluster-role-{{ .Values.instance_id }}" - annotations: - argocd.argoproj.io/sync-wave: "084" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -rules: - # CRD management (needed to apply cluster-scoped Helm charts) - - verbs: - - get - - list - - create - - update - - patch - - delete - apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - # ClusterRole/Binding management with escalate (allows granting permissions not yet held) - - verbs: - - get - - list - - create - - update - - patch - - delete - - bind - - escalate - apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - # Namespaced roles/rolebindings (needed by Helm namespace-scoped charts) - - verbs: - - get - - list - - create - - update - - patch - - delete - - watch - apiGroups: - - rbac.authorization.k8s.io - resources: - - roles - - rolebindings - # Namespace/node read - - verbs: - - get - - list - apiGroups: - - "" - resources: - - namespaces - - nodes - # OpenShift infra - - verbs: - - get - - list - apiGroups: - - config.openshift.io - resources: - - clusterversions - - infrastructures - # SCCs - - verbs: - - use - apiGroups: - - security.openshift.io - resources: - - securitycontextconstraints - resourceNames: - - anyuid - - restricted - - nonroot - - privileged - # CPD service API groups (needed to grant these permissions in cluster-scoped ClusterRoles) - - verbs: - - get - - list - - create - - update - - patch - - delete - - watch - apiGroups: - - ae.cpd.ibm.com - - wml.cpd.ibm.com - - spssmodeler.cpd.ibm.com - - ws.cpd.ibm.com - - ccs.cpd.ibm.com - - opensearch.cloudpackopen.ibm.com - - datarefinery.cpd.ibm.com - - wsruntimes.cpd.ibm.com - resources: - - "*" - # Webhook configs (needed by some Helm charts) - - verbs: - - get - - list - - create - - update - - patch - - delete - apiGroups: - - admissionregistration.k8s.io - resources: - - mutatingwebhookconfigurations - - validatingwebhookconfigurations - ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: "cpd-sa-helm-cluster-rb-{{ .Values.instance_id }}" - annotations: - argocd.argoproj.io/sync-wave: "085" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -subjects: - - kind: ServiceAccount - name: cpd-sa - namespace: "{{ .Values.cpd_operators_namespace }}" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: "cpd-sa-helm-cluster-role-{{ .Values.instance_id }}" -{{- end }} From 5d8bf0f9c36aedba250f41cc007727b60e29d58f Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 21 Aug 2026 00:54:51 +0530 Subject: [PATCH 079/115] fix: remove remaining Helm Job blocks from instance chart templates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The {{- else }} branches containing batch/v1 Job objects (the old helm-install shell-script approach) and their stub ConfigMap anchors were still present in the >= 5.3.1 paths of these instance chart templates. These are now unreachable dead code — the root-app ibm-mas-instance-root never creates an ArgoCD Application pointing at these instance charts for CPD >= 5.3.1. Removed from: - 120-ibm-wml/templates/02-ibm-wml-cr.yaml - 120-ibm-spark/templates/01-ibm-spark-cr.yaml - 120-ibm-spss/templates/01-ibm-spss-cr.yaml - 120-ibm-wsl/templates/01-ibm-wsl-cr.yaml - 120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml Each file now contains only the OLM path gated behind {{- if lt ... 5.3.1 }} — rendering nothing for CPD >= 5.3.1. --- .../templates/01-ibm-cognos-analytics-cr.yaml | 95 +------ .../templates/01-ibm-spark-cr.yaml | 91 ------- .../templates/01-ibm-spss-cr.yaml | 131 ---------- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 123 --------- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 235 ------------------ 5 files changed, 2 insertions(+), 673 deletions(-) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index fd78a34b1..a230633ee 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,93 +1,2 @@ -{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0) }} ---- -# Persistent resource so ArgoCD has a stable non-hook object to track. -# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. -apiVersion: v1 -kind: ConfigMap -metadata: - name: ibm-cognos-helm-install-config - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -data: - cpd_product_version: "{{ .Values.cpd_product_version }}" - install_method: "helm" ---- -# Helm-based installation for CPD 5.3.1+ -# Cognos Analytics is an optional analytics and reporting service -{{- $_job_name_prefix := "install-cognos-helm" }} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} -{{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v3" }} -{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} -{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} -{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $_job_name }} - namespace: "{{ .Values.cpd_operators_namespace }}" - labels: - mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed -spec: - template: - spec: - containers: - - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} - command: - - /bin/sh - - -c - - | - set -e - helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm - helm repo update - - echo "Installing cognos-analytics cluster-scoped chart (CRDs + ClusterRoles)..." - helm template cognos-analytics-cluster ibm-charts/cognos-analytics-cluster-scoped \ - --version 29.1.0 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Waiting for caservices.ca.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd caservices.ca.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - echo "Installing cognos-analytics namespace-scoped chart (operator + CR)..." - helm upgrade --install cognos-analytics ibm-charts/cognos-analytics \ - --version 29.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --set cognosanalytics.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 60m - restartPolicy: Never - serviceAccountName: cpd-sa - backoffLimit: 4 -{{- end }} +# CPD >= 5.3.1 Cognos Analytics is deployed via native ArgoCD Helm Application +# defined in root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index b7a6a913b..dd1fab53b 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -23,95 +23,4 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.spark_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" -{{- else }} ---- -# Persistent resource so ArgoCD has a stable non-hook object to track. -# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. -apiVersion: v1 -kind: ConfigMap -metadata: - name: ibm-spark-helm-install-config - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -data: - cpd_product_version: "{{ .Values.cpd_product_version }}" - install_method: "helm" ---- -# Helm-based installation for CPD 5.3.1+ -{{- $_job_name_prefix := "install-spark-helm" }} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} -{{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v1" }} -{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} -{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} -{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $_job_name }} - namespace: "{{ .Values.cpd_operators_namespace }}" - labels: - mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed -spec: - template: - spec: - containers: - - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} - command: - - /bin/sh - - -c - - | - set -e - helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm - helm repo update - - echo "Installing analyticsengine cluster-scoped chart (CRDs + ClusterRoles)..." - helm template analyticsengine-cluster ibm-charts/analyticsengine-cluster-scoped \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Waiting for analyticsengines.ae.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd analyticsengines.ae.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - echo "Installing analyticsengine namespace-scoped chart (operator + CR)..." - helm upgrade --install analyticsengine ibm-charts/analyticsengine \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --set analyticsengine.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 60m - restartPolicy: Never - serviceAccountName: cpd-sa - backoffLimit: 4 {{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index ab90517d4..310a6f214 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -23,135 +23,4 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.spss_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" -{{- else }} ---- -# Persistent resource so ArgoCD has a stable non-hook object to track. -# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. -apiVersion: v1 -kind: ConfigMap -metadata: - name: ibm-spss-helm-install-config - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -data: - cpd_product_version: "{{ .Values.cpd_product_version }}" - install_method: "helm" ---- -# Helm-based installation for CPD 5.3.1+ -{{- $_job_name_prefix := "install-spss-helm" }} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} -{{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v6" }} -{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} -{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} -{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $_job_name }} - namespace: "{{ .Values.cpd_operators_namespace }}" - labels: - mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed -spec: - template: - spec: - containers: - - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} - command: - - /bin/sh - - -c - - | - set -e - helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm - helm repo update - - echo "Installing canvasbase cluster-scoped chart (CRDs + ClusterRoles)..." - helm template canvasbase-cluster ibm-charts/canvasbase-cluster-scoped \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Waiting for canvasbase.canvasbase.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "Canvasbase CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd canvasbase.canvasbase.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "Canvasbase CRD established." - break - fi - sleep 10 - done - - echo "Installing canvasbase namespace-scoped chart (operator + CR)..." - helm upgrade --install canvasbase ibm-charts/canvasbase \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --wait --timeout 60m - - echo "Installing spss cluster-scoped chart (CRDs + ClusterRoles)..." - helm template spss-cluster ibm-charts/spss-cluster-scoped \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Waiting for spss.spssmodeler.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd spss.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - echo "Installing spss namespace-scoped chart (operator + CR)..." - helm upgrade --install spss ibm-charts/spss \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --set spss.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 60m - restartPolicy: Never - serviceAccountName: cpd-sa - backoffLimit: 4 {{- end }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 5a9acdfa7..1a544536d 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -23,127 +23,4 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.wml_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" -{{- else }} ---- -# Persistent resource so ArgoCD has a stable non-hook object to track. -# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. -apiVersion: v1 -kind: ConfigMap -metadata: - name: ibm-wml-helm-install-config - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -data: - cpd_product_version: "{{ .Values.cpd_product_version }}" - install_method: "helm" ---- -# Helm-based installation for CPD 5.3.1+ -{{- $_job_name_prefix := "install-wml-helm" }} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} -{{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v2" }} -{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} -{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $_job_name }} - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed - -spec: - template: - spec: - containers: - - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} - command: - - /bin/sh - - -c - - | - set -e - helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm - helm repo update - - echo "Installing ibm-redis-cp cluster-scoped chart (CRDs + ClusterRoles)..." - helm template ibm-redis-cp-cluster ibm-charts/ibm-redis-cp-cluster-scoped \ - --version 1.3.1 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Installing ibm-redis-cp namespace-scoped chart (operator)..." - helm upgrade --install ibm-redis-cp ibm-charts/ibm-redis-cp \ - --version 1.3.1 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key - - echo "Waiting for rediscps.redis.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "Rediscp CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd rediscps.redis.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "Rediscp CRD established." - break - fi - sleep 10 - done - - echo "Installing wml cluster-scoped chart (CRDs + ClusterRoles)..." - helm template wml-cluster ibm-charts/wml-cluster-scoped \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Waiting for wmlbases.wml.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd wmlbases.wml.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - echo "Installing wml namespace-scoped chart (operator + CR)..." - helm upgrade --install wml ibm-charts/wml \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --set wml.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 60m - restartPolicy: Never - serviceAccountName: cpd-sa - backoffLimit: 4 {{- end }} diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 9161ffffb..48c093f93 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -54,239 +54,4 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" -{{- else }} ---- -# Persistent resource so ArgoCD has a stable non-hook object to track. -# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. -apiVersion: v1 -kind: ConfigMap -metadata: - name: ibm-wsl-helm-install-config - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -data: - cpd_product_version: "{{ .Values.cpd_product_version }}" - install_method: "helm" ---- -# Helm-based installation for CPD 5.3.1+ -# Installs WSL and all its dependencies (opensearch, ccs, datarefinery, ws-runtimes) -# using IBM Helm charts. Each component requires a cluster-scoped chart (CRDs/ClusterRoles) -# followed by a namespace-scoped chart (Operator + CR). -{{- $_job_name_prefix := "install-wsl-helm" }} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} -{{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v1" }} -{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} -{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} -{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $_job_name }} - namespace: "{{ .Values.cpd_operators_namespace }}" - labels: - mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} - annotations: - argocd.argoproj.io/sync-wave: "091" - argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed -spec: - template: - spec: - containers: - - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} - command: - - /bin/sh - - -c - - | - set -e - - HELM_REPO=ibm-charts - HELM_REPO_URL=https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm - OPERATORS_NS={{ .Values.cpd_operators_namespace }} - INSTANCE_NS={{ .Values.cpd_instance_namespace }} - FILE_SC={{ .Values.cpd_service_storage_class }} - BLOCK_SC={{ .Values.cpd_service_block_storage_class }} - SCALE={{ .Values.cpd_service_scale_config }} - CPD_VERSION={{ .Values.cpd_product_version }} - PULL_SECRET=ibm-entitlement-key - - echo "================================================================" - echo "Adding IBM Helm repository" - echo "================================================================" - helm repo add ${HELM_REPO} ${HELM_REPO_URL} || true - helm repo update - - # Shared values file used by all components - printf 'global:\n licenseAccept: true\n releaseVersion: %s\n operatorNamespace: %s\n instanceNamespace: %s\n fileStorageClass: %s\n blockStorageClass: %s\n imagePullSecret: %s\n imagePullPrefix: cp.icr.io\n' \ - "${CPD_VERSION}" "${OPERATORS_NS}" "${INSTANCE_NS}" "${FILE_SC}" "${BLOCK_SC}" "${PULL_SECRET}" \ - > /tmp/cpd-global-values.yaml - - install_component() { - local NAME=$1 - local CHART=$2 - local CLUSTER_CHART=$3 - local VERSION=$4 - local EXTRA_VALUES=$5 - - echo "================================================================" - echo "Installing ${NAME} (version ${VERSION})" - echo "================================================================" - - # 1. Cluster-scoped chart (CRDs, ClusterRoles) - echo " [${NAME}] Installing cluster-scoped chart..." - helm template ${NAME}-cluster ${HELM_REPO}/${CLUSTER_CHART} \ - --version ${VERSION} \ - -f /tmp/cpd-global-values.yaml \ - --namespace ${OPERATORS_NS} | oc apply -f - - - # Wait for all CRDs from the cluster-scoped chart to be established - # before running the namespace-scoped chart that depends on them. - echo " [${NAME}] Waiting for CRDs to be established..." - sleep 5 - oc wait crd --all --for=condition=Established --timeout=120s 2>/dev/null || true - - # 2. Namespace-scoped chart (Operator + CR) - echo " [${NAME}] Installing namespace-scoped chart..." - helm upgrade --install ${NAME} ${HELM_REPO}/${CHART} \ - --version ${VERSION} \ - -f /tmp/cpd-global-values.yaml \ - ${EXTRA_VALUES} \ - --namespace ${INSTANCE_NS} \ - --create-namespace \ - --wait --timeout 60m - } - - # ---------------------------------------------------------------- - # Step 1: OpenSearch (dependency) - # ---------------------------------------------------------------- - install_component \ - "opencontent-opensearch" \ - "opencontent-opensearch" \ - "opencontent-opensearch-cluster-scoped" \ - "1.2.0" - - echo "Waiting for clusters.opensearch.cloudpackopen.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd clusters.opensearch.cloudpackopen.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - # ---------------------------------------------------------------- - # Step 2: CCS - Common Core Services (dependency) - # ---------------------------------------------------------------- - install_component \ - "ccs" \ - "ccs" \ - "ccs-cluster-scoped" \ - "12.1.0" \ - "--set ccs.scaleConfig=${SCALE}" - - # In CPD 5.3.1 Helm mode the namespace-scoped chart only deploys the - # operator; the CCS CR must be created explicitly with non_olm_deploy=true - # so the operator reconciles the actual CCS instance. - echo "Creating ccs-cr (non_olm_deploy=true) if not already present..." - printf 'apiVersion: ccs.cpd.ibm.com/v1beta1\nkind: CCS\nmetadata:\n name: ccs-cr\n namespace: %s\nspec:\n license:\n accept: true\n license: Standard\n imagePullSecret: %s\n fileStorageClass: %s\n blockStorageClass: %s\n scaleConfig: %s\n non_olm_deploy: true\n' \ - "${INSTANCE_NS}" "${PULL_SECRET}" "${FILE_SC}" "${BLOCK_SC}" "${SCALE}" \ - > /tmp/ccs-cr.yaml - oc apply -f /tmp/ccs-cr.yaml - - # Wait for CCS CR to reach Completed status - echo "Waiting for CCS CR to be ready..." - wait_period=0 - while true; do - wait_period=$((wait_period+30)) - if [ $wait_period -gt 3600 ]; then - echo "CCS CR not ready after 60 minutes. Exiting." - exit 1 - fi - CCS_STATUS=$(oc get ccs ccs-cr -n ${INSTANCE_NS} \ - -o jsonpath='{.status.ccsStatus}' \ - --ignore-not-found 2>/dev/null) - if [ "${CCS_STATUS}" = "Completed" ]; then - echo "CCS CR is ready." - break - fi - echo " CCS status: '${CCS_STATUS:-not found}' - waiting 30s..." - sleep 30 - done - - # ---------------------------------------------------------------- - # Step 3: DataRefinery (dependency) - # ---------------------------------------------------------------- - install_component \ - "datarefinery" \ - "datarefinery" \ - "datarefinery-cluster-scoped" \ - "12.1.0" - - echo "Waiting for datarefinery.datarefinery.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 1200 ]; then - echo "CRD not established after 20 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd datarefinery.datarefinery.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - # ---------------------------------------------------------------- - # Step 4: WS Runtimes (dependency) - # ---------------------------------------------------------------- - install_component \ - "ws-runtimes" \ - "ws-runtimes" \ - "ws-runtimes-cluster-scoped" \ - "12.1.0" - - echo "Waiting for runtimeassemblies.runtimes.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 1200 ]; then - echo "CRD not established after 20 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd runtimeassemblies.runtimes.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - # ---------------------------------------------------------------- - # Step 5: Watson Studio (main component) - # ---------------------------------------------------------------- - install_component \ - "wsl" \ - "ws" \ - "ws-cluster-scoped" \ - "12.1.0" \ - "--set ws.scaleConfig=${SCALE}" - - echo "================================================================" - echo "WSL installation complete" - echo "================================================================" - restartPolicy: Never - serviceAccountName: cpd-sa - backoffLimit: 4 {{- end }} From 4271b8f16e9742bde5539334f564c723fffbd881 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 21 Aug 2026 01:56:15 +0530 Subject: [PATCH 080/115] feat(wml): add post-verify job for CPD >= 5.3.1 For CPD >= 5.3.1 the native ArgoCD Helm App (wave 122) installs the WML Helm chart but there is no mechanism to confirm the WmlBase CR reaches Completed status and to surface WML credentials to AWS Secrets Manager. This commit adds: - instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml A Job (gated >= 5.3.1) that polls WmlBase wml-cr until wmlStatus=Completed, then writes url/username/password to SM path ///wml-cp4d. RBAC (SA, Role, RoleBinding) is scoped to cpd_operators_namespace and cpd_instance_namespace following the WSL post-verify pattern. - root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml Wave-123 ArgoCD Application (wml-post-verify..) using the AVP plugin to inject SM credentials into the post-verify Job. Renders only for CPD >= 5.3.1 (inside the existing $is531 block). - instance-applications/120-ibm-wml/values.yaml Added account_id, region_id, cluster_id, instance_id, sm_aws_access_key_id, sm_aws_secret_access_key, cli_image_repo keys consumed by the post-verify job. --- .../templates/03-ibm-wml-post-verify.yaml | 331 ++++++++++++++++++ instance-applications/120-ibm-wml/values.yaml | 8 + .../templates/120-ibm-wml-app.yaml | 88 +++++ 3 files changed, 427 insertions(+) create mode 100644 instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml diff --git a/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml b/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml new file mode 100644 index 000000000..42a627a25 --- /dev/null +++ b/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml @@ -0,0 +1,331 @@ +{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0) }} +{{- /* +Meaningful prefix for the job resource name. Must be under 52 chars in length to leave room for the 11 chars reserved for '-' and $_job_hash. +*/}} +{{- $_job_name_prefix := "cpd-wml-post-verify" }} + +{{- /* +Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. +Included in $_job_hash (see below). +*/}} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} + +{{- /* +A dict of values that influence the behaviour of the job in some way. +Any changes to values in this dict will trigger a rerun of the job. +Since jobs must be idemopotent, it's generally safe to pass in values here that are not +strictly necessary (i.e. including some values that don't actually influence job behaviour). +We may want to refine this further though for jobs that can take a long time to complete. +Included in $_job_hash (see below). +*/}} +{{- $_job_config_values := omit .Values "junitreporter" }} + +{{- /* +Increment this value whenever you make a change to an immutable field of the Job resource. +E.g. passing in a new environment variable. +Included in $_job_hash (see below). +*/}} +{{- $_job_version := "v1" }} + +{{- /* +10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest +This is to ensure ArgoCD will create a new job resource intead of attempting (and failing) to update an +immutable field of any existing Job resource. +*/}} +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} + +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash )}} + + +{{- /* +Set as the value for the mas.ibm.com/job-cleanup-group label on the Job resource. + +When the auto_delete flag is not set on the root application, a CronJob in the cluster uses this label +to identify old Job resources that should be pruned on behalf of ArgoCD. + +Any Job resources in the same namespace that have the mas.ibm.com/job-cleanup-group with this value +will be considered to belong to the same cleanup group. All but the most recent (i.e. with the latest "creation_timestamp") +Jobs will be automatically deleted. + +$_job_cleanup_group can usually just be based on $_job_name_prefix. There are some special cases +where multiple Jobs are created in our templates using a Helm loop. In those cases, additional descriminators +must be added to $_job_cleanup_group. + +By convention, we sha1sum this value to guarantee we never exceed the 63 char limit regardless of which discriminators +are required here. + +*/}} +{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} + +--- +kind: ServiceAccount +apiVersion: v1 +metadata: + name: wml-postverify-sa + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} + +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: wml-postverify-role-{{ .Values.instance_id }} + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +rules: + - verbs: + - get + - list + apiGroups: + - '' + resources: + - secrets + +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: wml-postverify-rb-{{ .Values.instance_id }} + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "093" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +subjects: + - kind: ServiceAccount + name: wml-postverify-sa + namespace: "{{ .Values.cpd_operators_namespace }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: wml-postverify-role-{{ .Values.instance_id }} + +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: wml-postverify-role-instance-{{ .Values.instance_id }} + namespace: "{{ .Values.cpd_instance_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +rules: + - verbs: + - get + - list + apiGroups: + - '' + resources: + - secrets + - verbs: + - get + - list + apiGroups: + - zen.cpd.ibm.com + resources: + - zenservices + - verbs: + - get + apiGroups: + - wml.cpd.ibm.com + resources: + - wmlbases + +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: wml-postverify-rb-instance-{{ .Values.instance_id }} + namespace: "{{ .Values.cpd_instance_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "093" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +subjects: + - kind: ServiceAccount + name: wml-postverify-sa + namespace: "{{ .Values.cpd_operators_namespace }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: wml-postverify-role-instance-{{ .Values.instance_id }} + + +--- +kind: Secret +apiVersion: v1 +metadata: + name: aws + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "093" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +stringData: + aws_access_key_id: {{ .Values.sm_aws_access_key_id }} + aws_secret_access_key: {{ .Values.sm_aws_secret_access_key }} +type: Opaque + +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ $_job_name }} + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "094" + labels: + mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + template: +{{- if .Values.custom_labels }} + metadata: + labels: +{{ .Values.custom_labels | toYaml | indent 8 }} +{{- end }} + spec: + containers: + - name: run + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} + imagePullPolicy: IfNotPresent + resources: + limits: + cpu: 200m + memory: 512Mi + requests: + cpu: 10m + memory: 64Mi + env: + - name: CPD_INSTANCE_NAMESPACE + value: {{ .Values.cpd_instance_namespace }} + - name: ACCOUNT_ID + value: {{ .Values.account_id }} + - name: REGION_ID + value: {{ .Values.region_id }} + - name: CLUSTER_ID + value: {{ .Values.cluster_id }} + - name: INSTANCE_ID + value: {{ .Values.instance_id }} + # Hard-coded for now: + - name: AVP_TYPE + value: "aws" + volumeMounts: + - name: aws + mountPath: /etc/mas/creds/aws + command: + - /bin/sh + - -c + - | + + set -e + echo + echo "================================================================================" + echo "WML Post-Verify: Waiting for WmlBase CR to reach Completed status" + echo "================================================================================" + + POLL_INTERVAL=30 + MAX_WAIT=3600 # 60 minutes + + elapsed=0 + while true; do + STATUS=$(oc get wmlbase wml-cr -n ${CPD_INSTANCE_NAMESPACE} --ignore-not-found \ + -o jsonpath='{.status.wmlStatus}' 2>/dev/null || true) + echo " WmlBase wml-cr status: '${STATUS}' (${elapsed}s elapsed)" + + if [[ "${STATUS}" == "Completed" ]]; then + echo " WmlBase is Completed." + break + fi + + if [[ ${elapsed} -ge ${MAX_WAIT} ]]; then + echo " ERROR: Timed out after ${MAX_WAIT}s waiting for WmlBase to reach Completed." + exit 1 + fi + + sleep ${POLL_INTERVAL} + elapsed=$((elapsed + POLL_INTERVAL)) + done + + echo + echo "================================================================================" + echo "WML Post-Verify: Writing WML credentials to Secrets Manager" + echo "================================================================================" + + echo "Lookup Cloud Pak for Data admin username" + USERNAME=$(oc get secret ibm-iam-bindinfo-platform-auth-idp-credentials -n ${CPD_INSTANCE_NAMESPACE} --ignore-not-found -o json | jq -r '.data.admin_username' | base64 -d) + + if [[ -z ${USERNAME} ]]; then + export CPD_ADMIN_USERNAME="admin" + export SECRET_NAME="admin-user-details" + export ADMIN_PASSWORD_PROPERTY="initial_admin_password" + else + export CPD_ADMIN_USERNAME="cpadmin" + export SECRET_NAME="ibm-iam-bindinfo-platform-auth-idp-credentials" + export ADMIN_PASSWORD_PROPERTY="admin_password" + fi + + echo "Lookup Cloud Pak for Data admin password" + CPD_ADMIN_PASSWORD=$(oc get secret $SECRET_NAME -n ${CPD_INSTANCE_NAMESPACE} -o json | jq -r ".data.${ADMIN_PASSWORD_PROPERTY}" | base64 -d) + + echo "Lookup Cloud Pak for Data admin url" + URL=$(oc get ZenService lite-cr -o jsonpath="{.status.url}{'\n'}" -n ${CPD_INSTANCE_NAMESPACE}) + + if [[ -z ${URL} || -z ${CPD_ADMIN_USERNAME} || -z ${CPD_ADMIN_PASSWORD} ]]; then + echo "CPD admin username/password/url details are missing, please check your Cloud Pak For Data instance health!" + exit 1 + fi + + CPD_ADMIN_URL="https://${URL}" + + echo + echo "================================================================================" + echo "Debug Cloud Pak for Data Admin details" + echo "================================================================================" + echo "- CP4D Dashboard ......................... ${CPD_ADMIN_URL}" + echo "- CP4D Admin Username .................... ${CPD_ADMIN_USERNAME}" + echo "- CP4D Admin Password .................... ${CPD_ADMIN_PASSWORD:0:2}" + + source /mascli/functions/gitops_utils + SM_AWS_ACCESS_KEY_ID=$(cat /etc/mas/creds/aws/aws_access_key_id) + SM_AWS_SECRET_ACCESS_KEY=$(cat /etc/mas/creds/aws/aws_secret_access_key) + export SM_AWS_REGION=${REGION_ID} + sm_login + + SECRET_NAME_WML=${ACCOUNT_ID}/${CLUSTER_ID}/${INSTANCE_ID}/wml-cp4d + TAGS="[{\"Key\": \"source\", \"Value\": \"cpd-wml-post-verify\"}, {\"Key\": \"account\", \"Value\": \"${ACCOUNT_ID}\"}, {\"Key\": \"cluster\", \"Value\": \"${CLUSTER_ID}\"}]" + sm_update_secret $SECRET_NAME_WML "{\"url\": \"$CPD_ADMIN_URL\", \"username\": \"$CPD_ADMIN_USERNAME\", \"password\": \"$CPD_ADMIN_PASSWORD\" }" "${TAGS}" + + echo "Done" + + restartPolicy: Never + serviceAccountName: wml-postverify-sa + volumes: + - name: aws + secret: + secretName: aws + defaultMode: 420 + optional: false + backoffLimit: 4 +{{- end }} diff --git a/instance-applications/120-ibm-wml/values.yaml b/instance-applications/120-ibm-wml/values.yaml index 1cae71e22..cf97cc949 100644 --- a/instance-applications/120-ibm-wml/values.yaml +++ b/instance-applications/120-ibm-wml/values.yaml @@ -10,3 +10,11 @@ cpd_product_version: "" # When empty, versions are read from olm-utils-cm (deployed by wave 110). wml_chart_version: "" redis_chart_version: "" +# Post-verify job (CPD >= 5.3.1 only) — AWS Secrets Manager credentials +account_id: "" +region_id: "" +cluster_id: "" +instance_id: "" +sm_aws_access_key_id: "" +sm_aws_secret_access_key: "" +cli_image_repo: "" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml index bbaaa771e..c7a18393e 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml @@ -282,5 +282,93 @@ spec: limit: 20 syncOptions: - CreateNamespace=true +--- +# Wave 123: WML post-verify (polls WmlBase CR to Completed, writes wml-cp4d secret to SM) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wml-post-verify.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "123" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + ignoreDifferences: + - group: '*' + kind: ServiceAccount + jsonPointers: + - /imagePullSecrets + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + repoURL: "{{ .Values.source.repo_url }}" + path: instance-applications/120-ibm-wml + targetRevision: "{{ .Values.source.revision }}" + plugin: + name: {{ .Values.avp.name }} + env: + - name: {{ .Values.avp.values_varname }} + value: | + account_id: "{{ .Values.account.id }}" + region_id: "{{ .Values.region.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + cli_image_repo: {{ .Values.cli_image_repo }} + cluster_admin_role: {{ .Values.cluster_admin_role }} + application_admin_role: {{ .Values.application_admin_role }} + sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" + sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" + cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" + cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" + cpd_service_storage_class: "{{ .Values.ibm_wml.cpd_service_storage_class }}" + cpd_service_block_storage_class: "{{ .Values.ibm_wml.cpd_service_block_storage_class }}" + cpd_service_scale_config: "{{ .Values.ibm_wml.cpd_service_scale_config }}" + wml_channel: "{{ .Values.ibm_wml.wml_channel }}" + wml_version: "{{ .Values.ibm_wml.wml_version }}" + wml_install_plan: "{{ .Values.ibm_wml.wml_install_plan }}" + {{- if .Values.custom_labels }} + custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} + {{- end }} + junitreporter: + reporter_name: "ibm-wml-{{ .Values.instance.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" + devops_build_number: "{{ .Values.devops.build_number }}" + gitops_version: "{{ .Values.source.revision }}" + cli_image_repo: {{ .Values.cli_image_repo }} + - name: ARGOCD_APP_NAME + value: cpdwmlpostverify + {{- if not (empty .Values.avp.secret) }} + - name: AVP_SECRET + value: {{ .Values.avp.secret }} + {{- end }} + syncPolicy: + automated: + {{- if .Values.auto_delete }} + prune: true + {{- end }} + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - RespectIgnoreDifferences=true {{- end }} {{- end }} From 381f26c49bc0ad559d44862355ea7f150ba8f81b Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 21 Aug 2026 02:24:47 +0530 Subject: [PATCH 081/115] fix(cognos): ignoreDifferences for CAService operator-mutated fields The cognos-analytics Helm chart renders a CAService CR. The operator immediately mutates spec.license (adding license: Enterprise) and adds spec.enableInstanaMetricCollection: false. ArgoCD sees these as drift and keeps the app OutOfSync. Add ignoreDifferences for both fields plus ServiceAccount/imagePullSecrets (standard pattern across all service apps). Add RespectIgnoreDifferences to syncOptions so ArgoCD applies the exclusions during sync. --- .../templates/120-ibm-cognos-analytics-app.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index 0a3ff9675..df8963b6b 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -83,6 +83,16 @@ metadata: finalizers: - resources-finalizer.argocd.argoproj.io spec: + ignoreDifferences: + - group: ca.cpd.ibm.com + kind: CAService + jsonPointers: + - /spec/license/license + - /spec/enableInstanaMetricCollection + - group: '*' + kind: ServiceAccount + jsonPointers: + - /imagePullSecrets project: "{{ .Values.argo.projects.apps }}" destination: server: {{ .Values.cluster.url }} @@ -110,4 +120,5 @@ spec: limit: 20 syncOptions: - CreateNamespace=true + - RespectIgnoreDifferences=true {{- end }} From c2f7ac35ab09bbfb9c0c47a2949a5503f91c4a80 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 10:51:27 +0530 Subject: [PATCH 082/115] error handling checks added --- .../08-postsync-db2-audit-policy_Job.yaml | 30 ++++++++++++------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index 53fb1e6d5..e11628658 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -22,7 +22,7 @@ Use the build/bin/set-cli-image-digest.sh script to update this value across all {{- /* Increment this value whenever you make a change to an immutable field of the Job resource. */}} -{{- $_job_version := "v1" }} +{{- $_job_version := "v3" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} @@ -101,19 +101,29 @@ spec: echo 'Connecting to database ${DB2_DBNAME}' db2 connect to ${DB2_DBNAME} - echo 'Creating audit policy USER_AUDIT (instance-level)' - db2 \"CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL\" || echo 'Audit policy USER_AUDIT already exists, continuing' - - echo 'Creating MAXIMO_READ and MAXIMO_WRITE roles' - db2 \"CREATE ROLE MAXIMO_READ\" || echo 'Role MAXIMO_READ already exists, continuing' - db2 \"CREATE ROLE MAXIMO_WRITE\" || echo 'Role MAXIMO_WRITE already exists, continuing' + echo 'Checking if USER_AUDIT policy already exists' + POLICY_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='USER_AUDIT'\" | tr -d ' ') + if [ \"\$POLICY_EXISTS\" -eq \"0\" ]; then + echo 'Creating USER_AUDIT policy...' + db2 \"CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL\" + echo 'USER_AUDIT policy created successfully' + else + echo 'USER_AUDIT policy already exists, skipping' + fi echo 'Applying USER_AUDIT policy to MAXIMO_READ and MAXIMO_WRITE roles' - db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" - db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" + ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_READ'\" | tr -d ' ') + ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_WRITE'\" | tr -d ' ') + if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then + db2 \"AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to MAXIMO roles, skipping' + echo 'Audit policy USER_AUDIT applied to MAXIMO_READ and MAXIMO_WRITE' + else + echo 'MAXIMO roles not found, skipping role audit policy assignment' + fi echo 'Applying USER_AUDIT policy to db2inst1 user' - db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" + db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to db2inst1, skipping' + echo 'Audit policy USER_AUDIT applied to db2inst1' echo '' echo '========================================' From 25264425b2b0ec4a7dfcad93f771549ea8c48eda Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 13:13:30 +0530 Subject: [PATCH 083/115] add audit for facilities --- .../08-postsync-db2-audit-policy_Job.yaml | 148 ++++++++++-------- 1 file changed, 85 insertions(+), 63 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index e11628658..8e4b65d76 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -4,25 +4,42 @@ Audit policy setup job for DB2. Runs per-application audit policy commands on the db2u pod after the main postsync setup job (sync-wave 129) has completed. -Currently supported: manage +Common to all applications: + - Create USER_AUDIT policy if not exists + - AUDIT USER db2inst1 USING POLICY USER_AUDIT + +Per-application role audit (only if roles already exist): + - manage : AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT + - facilities: AUDIT ROLE TRIRIGA_READ, ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT */}} {{- if .Values.should_execute }} {{- if not (contains "sdb" .Values.db2_instance_name) }} -{{- $_job_name_prefix := "postsync-db2-audit-policy" }} +{{- /* +Meaningful prefix for the job resource name. Must be under 52 chars in length to leave room for the 11 chars reserved for '-' and $_job_hash. +*/}} +{{- $_job_name_prefix := "postsync-audit-policy" }} {{- /* Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. +Included in $_job_hash (see below). */}} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- /* +A dict of values that influence the behaviour of the job in some way. +Any changes to values in this dict will trigger a rerun of the job. +Included in $_job_hash (see below). +*/}} {{- $_job_config_values := omit .Values "junitreporter" }} {{- /* Increment this value whenever you make a change to an immutable field of the Job resource. +E.g. passing in a new environment variable. +Included in $_job_hash (see below). */}} -{{- $_job_version := "v3" }} +{{- $_job_version := "v1" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} @@ -54,7 +71,6 @@ spec: - name: run image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} imagePullPolicy: IfNotPresent - resources: limits: cpu: 200m @@ -62,17 +78,15 @@ spec: requests: cpu: 10m memory: 64Mi - env: - - name: MAS_APP_ID - value: {{ .Values.mas_application_id }} - name: DB2_NAMESPACE value: "{{ .Values.db2_namespace }}" - name: DB2_INSTANCE_NAME value: "{{ .Values.db2_instance_name }}" - name: DB2_DBNAME value: "{{ .Values.db2_dbname }}" - + - name: MAS_APP_ID + value: "{{ .Values.mas_application_id }}" command: - /bin/sh - -c @@ -82,76 +96,84 @@ spec: DB2_POD="c-${DB2_INSTANCE_NAME}-db2u-0" - # ============================================================ - # Audit policy: manage - # ============================================================ - if [ "$MAS_APP_ID" = "manage" ]; then - - echo "" - echo "================================================================================" - echo "Setting up DB2 audit policy for Manage" - echo "================================================================================" - - # All DB2 commands run in a single oc exec so the database - # connection established by 'db2 connect' is shared across - # every subsequent statement in the same session. - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- su -lc " - set -e - - echo 'Connecting to database ${DB2_DBNAME}' - db2 connect to ${DB2_DBNAME} - - echo 'Checking if USER_AUDIT policy already exists' - POLICY_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='USER_AUDIT'\" | tr -d ' ') - if [ \"\$POLICY_EXISTS\" -eq \"0\" ]; then - echo 'Creating USER_AUDIT policy...' - db2 \"CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL\" - echo 'USER_AUDIT policy created successfully' - else - echo 'USER_AUDIT policy already exists, skipping' - fi - - echo 'Applying USER_AUDIT policy to MAXIMO_READ and MAXIMO_WRITE roles' + echo "" + echo "================================================================================" + echo "DB2 Audit Policy Setup" + echo "================================================================================" + echo "DB2_NAMESPACE ....................... ${DB2_NAMESPACE}" + echo "DB2_INSTANCE_NAME ................... ${DB2_INSTANCE_NAME}" + echo "DB2_DBNAME .......................... ${DB2_DBNAME}" + echo "MAS_APP_ID .......................... ${MAS_APP_ID}" + + # All DB2 commands run in a single oc exec so the database + # connection established by 'db2 connect' is shared across + # every subsequent statement in the same session. + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- su -lc " + set -e + + echo 'Connecting to database ${DB2_DBNAME}' + db2 connect to ${DB2_DBNAME} + + # ---------------------------------------------------------------- + # Create USER_AUDIT policy if it does not already exist (common) + # ---------------------------------------------------------------- + echo 'Checking USER_AUDIT policy...' + POLICY_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='USER_AUDIT'\" | tr -d ' ') + if [ \"\$POLICY_EXISTS\" -eq \"0\" ]; then + echo 'Creating USER_AUDIT policy...' + db2 \"CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL\" + echo 'USER_AUDIT policy created successfully' + else + echo 'USER_AUDIT policy already exists, skipping' + fi + + # ---------------------------------------------------------------- + # Per-application role audit (manage and facilities only) + # ---------------------------------------------------------------- + if [ \"${MAS_APP_ID}\" = \"manage\" ]; then + echo 'Applying USER_AUDIT policy to MAXIMO_READ and MAXIMO_WRITE roles...' ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_READ'\" | tr -d ' ') ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then db2 \"AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to MAXIMO roles, skipping' echo 'Audit policy USER_AUDIT applied to MAXIMO_READ and MAXIMO_WRITE' else - echo 'MAXIMO roles not found, skipping role audit policy assignment' + echo 'MAXIMO_READ/MAXIMO_WRITE roles not found, skipping role audit policy assignment' fi + fi - echo 'Applying USER_AUDIT policy to db2inst1 user' - db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to db2inst1, skipping' - echo 'Audit policy USER_AUDIT applied to db2inst1' - - echo '' - echo '========================================' - echo 'Verifying audit policy setup' - echo '========================================' - - echo 'Users and roles assigned to USER_AUDIT:' - db2 \"SELECT * FROM SYSCAT.AUDITUSE WHERE AUDITPOLICYNAME='USER_AUDIT'\" - - echo 'Audit policy categories for USER_AUDIT:' - db2 \"SELECT AUDITPOLICYNAME, VALIDATESTATUS, EXECUTESTATUS FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='USER_AUDIT'\" + if [ \"${MAS_APP_ID}\" = \"facilities\" ]; then + echo 'Applying USER_AUDIT policy to TRIRIGA_READ and TRIRIGA_WRITE roles...' + ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_READ'\" | tr -d ' ') + ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_WRITE'\" | tr -d ' ') + if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then + db2 \"AUDIT ROLE TRIRIGA_READ, ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to TRIRIGA roles, skipping' + echo 'Audit policy USER_AUDIT applied to TRIRIGA_READ and TRIRIGA_WRITE' + else + echo 'TRIRIGA_READ/TRIRIGA_WRITE roles not found, skipping role audit policy assignment' + fi + fi - db2 connect reset - echo 'Audit policy setup complete' - " db2inst1 || exit $? + # ---------------------------------------------------------------- + # Assign USER_AUDIT policy to db2inst1 user (common) + # ---------------------------------------------------------------- + echo 'Applying USER_AUDIT policy to db2inst1 user...' + db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to db2inst1, skipping' + echo 'Audit policy USER_AUDIT applied to db2inst1' - echo "" - echo "================================================================================" - echo "DB2 audit policy setup completed successfully for Manage" - echo "================================================================================" + db2 connect reset + echo 'Audit policy setup complete' + " db2inst1 || exit $? - fi + echo "" + echo "================================================================================" + echo "DB2 audit policy setup completed successfully" + echo "================================================================================" restartPolicy: Never serviceAccountName: "postsync-sa-{{ .Values.db2_instance_name }}" - backoffLimit: 4 {{- end }} {{- end }} -{{- end }} \ No newline at end of file +{{- end }} From 2cc40b2c4b7a7ced2032d4738a5c0a1d53740ea8 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 13:48:24 +0530 Subject: [PATCH 084/115] update echo --- .../08-postsync-db2-audit-policy_Job.yaml | 137 +++++++++++++----- 1 file changed, 100 insertions(+), 37 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index 8e4b65d76..20880ef90 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -98,12 +98,15 @@ spec: echo "" echo "================================================================================" - echo "DB2 Audit Policy Setup" + echo " DB2 AUDIT POLICY SETUP" echo "================================================================================" - echo "DB2_NAMESPACE ....................... ${DB2_NAMESPACE}" - echo "DB2_INSTANCE_NAME ................... ${DB2_INSTANCE_NAME}" - echo "DB2_DBNAME .......................... ${DB2_DBNAME}" - echo "MAS_APP_ID .......................... ${MAS_APP_ID}" + echo "" + echo "Configuration" + echo "--------------------------------------------------------------------------------" + echo "DB2 Namespace : ${DB2_NAMESPACE}" + echo "DB2 Instance : ${DB2_INSTANCE_NAME}" + echo "Database : ${DB2_DBNAME}" + echo "MAS Application : ${MAS_APP_ID}" # All DB2 commands run in a single oc exec so the database # connection established by 'db2 connect' is shared across @@ -111,63 +114,123 @@ spec: oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- su -lc " set -e - echo 'Connecting to database ${DB2_DBNAME}' + echo '' + echo '--------------------------------------------------------------------------------' + echo '[1/4] Database Connection' + echo '--------------------------------------------------------------------------------' + echo \"Connecting to database '${DB2_DBNAME}'...\" db2 connect to ${DB2_DBNAME} - - # ---------------------------------------------------------------- - # Create USER_AUDIT policy if it does not already exist (common) - # ---------------------------------------------------------------- - echo 'Checking USER_AUDIT policy...' + echo '[OK] Database connection successful.' + + echo '' + echo '--------------------------------------------------------------------------------' + echo '[2/4] USER_AUDIT Policy' + echo '--------------------------------------------------------------------------------' + echo \"Checking whether audit policy 'USER_AUDIT' exists...\" + echo '' POLICY_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='USER_AUDIT'\" | tr -d ' ') if [ \"\$POLICY_EXISTS\" -eq \"0\" ]; then - echo 'Creating USER_AUDIT policy...' + echo \"[CREATE] USER_AUDIT policy does not exist - creating...\" db2 \"CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL\" - echo 'USER_AUDIT policy created successfully' + echo '[OK] USER_AUDIT policy created.' else - echo 'USER_AUDIT policy already exists, skipping' + echo '[SKIP] USER_AUDIT policy already exists.' + echo ' No changes required.' fi - # ---------------------------------------------------------------- - # Per-application role audit (manage and facilities only) - # ---------------------------------------------------------------- + echo '' + echo '--------------------------------------------------------------------------------' + echo '[3/4] USER_AUDIT Role Assignments' + echo '--------------------------------------------------------------------------------' + echo 'Checking USER_AUDIT assignment to roles:' + echo '' if [ \"${MAS_APP_ID}\" = \"manage\" ]; then - echo 'Applying USER_AUDIT policy to MAXIMO_READ and MAXIMO_WRITE roles...' ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_READ'\" | tr -d ' ') ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then - db2 \"AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to MAXIMO roles, skipping' - echo 'Audit policy USER_AUDIT applied to MAXIMO_READ and MAXIMO_WRITE' + ROLE_READ_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='MAXIMO_READ'\" | tr -d ' ') + echo ' - MAXIMO_READ' + if [ \"\$ROLE_READ_AUDIT_EXISTS\" -eq \"0\" ]; then + db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" + echo ' [OK] USER_AUDIT assigned.' + else + echo ' [SKIP] Already assigned.' + fi + ROLE_WRITE_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='MAXIMO_WRITE'\" | tr -d ' ') + echo ' - MAXIMO_WRITE' + if [ \"\$ROLE_WRITE_AUDIT_EXISTS\" -eq \"0\" ]; then + db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" + echo ' [OK] USER_AUDIT assigned.' + else + echo ' [SKIP] Already assigned.' + fi else - echo 'MAXIMO_READ/MAXIMO_WRITE roles not found, skipping role audit policy assignment' + echo ' [SKIP] MAXIMO_READ/MAXIMO_WRITE roles not found - skipping role audit.' fi - fi - - if [ \"${MAS_APP_ID}\" = \"facilities\" ]; then - echo 'Applying USER_AUDIT policy to TRIRIGA_READ and TRIRIGA_WRITE roles...' + ROLE_LABEL='MAXIMO_READ, MAXIMO_WRITE' + elif [ \"${MAS_APP_ID}\" = \"facilities\" ]; then ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_READ'\" | tr -d ' ') ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then - db2 \"AUDIT ROLE TRIRIGA_READ, ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to TRIRIGA roles, skipping' - echo 'Audit policy USER_AUDIT applied to TRIRIGA_READ and TRIRIGA_WRITE' + ROLE_READ_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='TRIRIGA_READ'\" | tr -d ' ') + echo ' - TRIRIGA_READ' + if [ \"\$ROLE_READ_AUDIT_EXISTS\" -eq \"0\" ]; then + db2 \"AUDIT ROLE TRIRIGA_READ USING POLICY USER_AUDIT\" + echo ' [OK] USER_AUDIT assigned.' + else + echo ' [SKIP] Already assigned.' + fi + ROLE_WRITE_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='TRIRIGA_WRITE'\" | tr -d ' ') + echo ' - TRIRIGA_WRITE' + if [ \"\$ROLE_WRITE_AUDIT_EXISTS\" -eq \"0\" ]; then + db2 \"AUDIT ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" + echo ' [OK] USER_AUDIT assigned.' + else + echo ' [SKIP] Already assigned.' + fi else - echo 'TRIRIGA_READ/TRIRIGA_WRITE roles not found, skipping role audit policy assignment' + echo ' [SKIP] TRIRIGA_READ/TRIRIGA_WRITE roles not found - skipping role audit.' fi + ROLE_LABEL='TRIRIGA_READ, TRIRIGA_WRITE' + else + ROLE_LABEL='N/A' + echo ' [SKIP] No role audit configured for this application.' fi - - # ---------------------------------------------------------------- - # Assign USER_AUDIT policy to db2inst1 user (common) - # ---------------------------------------------------------------- - echo 'Applying USER_AUDIT policy to db2inst1 user...' - db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to db2inst1, skipping' - echo 'Audit policy USER_AUDIT applied to db2inst1' + echo '' + echo '[OK] USER_AUDIT role assignments verified.' + + echo '' + echo '--------------------------------------------------------------------------------' + echo '[4/4] USER_AUDIT User Assignment' + echo '--------------------------------------------------------------------------------' + echo 'Checking USER_AUDIT assignment to user:' + echo '' + USER_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='U' AND OBJECTNAME='DB2INST1'\" | tr -d ' ') + echo ' - DB2INST1' + if [ \"\$USER_AUDIT_EXISTS\" -eq \"0\" ]; then + db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" + echo ' [OK] USER_AUDIT assigned.' + else + echo ' [SKIP] Already assigned.' + fi + echo '' + echo '[OK] USER_AUDIT user assignment verified.' db2 connect reset - echo 'Audit policy setup complete' + + echo '' + echo '--------------------------------------------------------------------------------' + echo ' AUDIT CONFIGURATION SUMMARY' + echo '--------------------------------------------------------------------------------' + echo \"Audit Policy : USER_AUDIT\" + echo \"Roles : \${ROLE_LABEL}\" + echo \"User : DB2INST1\" + echo '' " db2inst1 || exit $? echo "" echo "================================================================================" - echo "DB2 audit policy setup completed successfully" + echo " DB2 AUDIT POLICY SETUP COMPLETE" echo "================================================================================" restartPolicy: Never From 55ebc10b3fe2968056ebe92e716485388a9c25b5 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 14:07:20 +0530 Subject: [PATCH 085/115] Update 08-postsync-db2-audit-policy_Job.yaml --- .../08-postsync-db2-audit-policy_Job.yaml | 52 ++++++------------- 1 file changed, 16 insertions(+), 36 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index 20880ef90..2ae56c38b 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -39,7 +39,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v1" }} +{{- $_job_version := "v2" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} @@ -148,22 +148,14 @@ spec: ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_READ'\" | tr -d ' ') ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then - ROLE_READ_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='MAXIMO_READ'\" | tr -d ' ') echo ' - MAXIMO_READ' - if [ \"\$ROLE_READ_AUDIT_EXISTS\" -eq \"0\" ]; then - db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" - echo ' [OK] USER_AUDIT assigned.' - else - echo ' [SKIP] Already assigned.' - fi - ROLE_WRITE_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='MAXIMO_WRITE'\" | tr -d ' ') + db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" \ + && echo ' [OK] USER_AUDIT assigned.' \ + || echo ' [SKIP] Already assigned.' echo ' - MAXIMO_WRITE' - if [ \"\$ROLE_WRITE_AUDIT_EXISTS\" -eq \"0\" ]; then - db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" - echo ' [OK] USER_AUDIT assigned.' - else - echo ' [SKIP] Already assigned.' - fi + db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" \ + && echo ' [OK] USER_AUDIT assigned.' \ + || echo ' [SKIP] Already assigned.' else echo ' [SKIP] MAXIMO_READ/MAXIMO_WRITE roles not found - skipping role audit.' fi @@ -172,22 +164,14 @@ spec: ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_READ'\" | tr -d ' ') ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then - ROLE_READ_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='TRIRIGA_READ'\" | tr -d ' ') echo ' - TRIRIGA_READ' - if [ \"\$ROLE_READ_AUDIT_EXISTS\" -eq \"0\" ]; then - db2 \"AUDIT ROLE TRIRIGA_READ USING POLICY USER_AUDIT\" - echo ' [OK] USER_AUDIT assigned.' - else - echo ' [SKIP] Already assigned.' - fi - ROLE_WRITE_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='TRIRIGA_WRITE'\" | tr -d ' ') + db2 \"AUDIT ROLE TRIRIGA_READ USING POLICY USER_AUDIT\" \ + && echo ' [OK] USER_AUDIT assigned.' \ + || echo ' [SKIP] Already assigned.' echo ' - TRIRIGA_WRITE' - if [ \"\$ROLE_WRITE_AUDIT_EXISTS\" -eq \"0\" ]; then - db2 \"AUDIT ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" - echo ' [OK] USER_AUDIT assigned.' - else - echo ' [SKIP] Already assigned.' - fi + db2 \"AUDIT ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" \ + && echo ' [OK] USER_AUDIT assigned.' \ + || echo ' [SKIP] Already assigned.' else echo ' [SKIP] TRIRIGA_READ/TRIRIGA_WRITE roles not found - skipping role audit.' fi @@ -205,14 +189,10 @@ spec: echo '--------------------------------------------------------------------------------' echo 'Checking USER_AUDIT assignment to user:' echo '' - USER_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='U' AND OBJECTNAME='DB2INST1'\" | tr -d ' ') echo ' - DB2INST1' - if [ \"\$USER_AUDIT_EXISTS\" -eq \"0\" ]; then - db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" - echo ' [OK] USER_AUDIT assigned.' - else - echo ' [SKIP] Already assigned.' - fi + db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" \ + && echo ' [OK] USER_AUDIT assigned.' \ + || echo ' [SKIP] Already assigned.' echo '' echo '[OK] USER_AUDIT user assignment verified.' From bfa61f19629248efa3c377f4708bad8afdcefcc0 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 14:32:29 +0530 Subject: [PATCH 086/115] update echo --- .../templates/08-postsync-db2-audit-policy_Job.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index 2ae56c38b..8041221ba 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -149,11 +149,11 @@ spec: ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then echo ' - MAXIMO_READ' - db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" \ + db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" >/dev/null 2>&1 \ && echo ' [OK] USER_AUDIT assigned.' \ || echo ' [SKIP] Already assigned.' echo ' - MAXIMO_WRITE' - db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" \ + db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" >/dev/null 2>&1 \ && echo ' [OK] USER_AUDIT assigned.' \ || echo ' [SKIP] Already assigned.' else @@ -165,11 +165,11 @@ spec: ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then echo ' - TRIRIGA_READ' - db2 \"AUDIT ROLE TRIRIGA_READ USING POLICY USER_AUDIT\" \ + db2 \"AUDIT ROLE TRIRIGA_READ USING POLICY USER_AUDIT\" >/dev/null 2>&1 \ && echo ' [OK] USER_AUDIT assigned.' \ || echo ' [SKIP] Already assigned.' echo ' - TRIRIGA_WRITE' - db2 \"AUDIT ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" \ + db2 \"AUDIT ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" >/dev/null 2>&1 \ && echo ' [OK] USER_AUDIT assigned.' \ || echo ' [SKIP] Already assigned.' else @@ -190,7 +190,7 @@ spec: echo 'Checking USER_AUDIT assignment to user:' echo '' echo ' - DB2INST1' - db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" \ + db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" >/dev/null 2>&1 \ && echo ' [OK] USER_AUDIT assigned.' \ || echo ' [SKIP] Already assigned.' echo '' From 9902ef5862a721117da329c5a9b7fb48691ae3f8 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 15:36:05 +0530 Subject: [PATCH 087/115] Update 08-postsync-db2-audit-policy_Job.yaml --- .../08-postsync-db2-audit-policy_Job.yaml | 20 +++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index 8041221ba..de72a17cc 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -4,14 +4,18 @@ Audit policy setup job for DB2. Runs per-application audit policy commands on the db2u pod after the main postsync setup job (sync-wave 129) has completed. -Common to all applications: - - Create USER_AUDIT policy if not exists - - AUDIT USER db2inst1 USING POLICY USER_AUDIT - -Per-application role audit (only if roles already exist): +Only executed for applications that use DB2 audit policy: - manage : AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT - facilities: AUDIT ROLE TRIRIGA_READ, ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT + - monitor : no role audit - db2inst1 user audit only + - iot : no role audit - db2inst1 user audit only + +Common to all supported applications: + - Create USER_AUDIT policy if not exists + - AUDIT USER db2inst1 USING POLICY USER_AUDIT */}} +{{- $supported_apps := list "manage" "facilities" "monitor" "iot" }} +{{- if has .Values.mas_application_id $supported_apps }} {{- if .Values.should_execute }} {{- if not (contains "sdb" .Values.db2_instance_name) }} @@ -176,9 +180,12 @@ spec: echo ' [SKIP] TRIRIGA_READ/TRIRIGA_WRITE roles not found - skipping role audit.' fi ROLE_LABEL='TRIRIGA_READ, TRIRIGA_WRITE' + elif [ \"${MAS_APP_ID}\" = \"monitor\" ] || [ \"${MAS_APP_ID}\" = \"iot\" ]; then + ROLE_LABEL='N/A - user audit only' + echo ' [SKIP] No role audit required for ${MAS_APP_ID} - db2inst1 user audit only.' else ROLE_LABEL='N/A' - echo ' [SKIP] No role audit configured for this application.' + echo ' [SKIP] No role audit configured for ${MAS_APP_ID}.' fi echo '' echo '[OK] USER_AUDIT role assignments verified.' @@ -220,3 +227,4 @@ spec: {{- end }} {{- end }} {{- end }} +{{- end }} From 85e83d88eac971958aebf7787b51a54edffb2189 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 16:52:55 +0530 Subject: [PATCH 088/115] update job version --- .../templates/07-postsync-setup-db2_Job.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml index 0ac137de4..923e19a3c 100644 --- a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml @@ -35,7 +35,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v23" }} +{{- $_job_version := "v22" }} {{- /* 10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest This is to ensure ArgoCD will create a new job resource intead of attempting (and failing) to update an @@ -578,7 +578,6 @@ spec: echo "--------------------------------------------------------------------------------" oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "cd ${DB2_INSTANCE_HOME_PATH}/bin; ${CREATE_ROLES_SH_PATH} | tee /tmp/createroles.log" db2inst1 || exit $? fi - fi # [[ "$MAS_APP_ID" == "manage" ]] if [[ "$MAS_APP_ID" == "facilities" ]]; then From 7cd9f0f9e296687a2172f176bba6db2a201610ed Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 16:53:51 +0530 Subject: [PATCH 089/115] Update 07-postsync-setup-db2_Job.yaml --- .../templates/07-postsync-setup-db2_Job.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml index 923e19a3c..cdd1e763f 100644 --- a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml @@ -578,6 +578,8 @@ spec: echo "--------------------------------------------------------------------------------" oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "cd ${DB2_INSTANCE_HOME_PATH}/bin; ${CREATE_ROLES_SH_PATH} | tee /tmp/createroles.log" db2inst1 || exit $? fi + + fi # [[ "$MAS_APP_ID" == "manage" ]] if [[ "$MAS_APP_ID" == "facilities" ]]; then From ce62fcecee9401c6e329880f0e46b943d7a31c67 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 17:50:29 +0530 Subject: [PATCH 090/115] readme updated --- .../120-ibm-db2u-database/README.md | 42 +++++++++++++++++++ .../08-postsync-db2-audit-policy_Job.yaml | 4 +- 2 files changed, 44 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/README.md b/instance-applications/120-ibm-db2u-database/README.md index 5ec429989..71bce775e 100644 --- a/instance-applications/120-ibm-db2u-database/README.md +++ b/instance-applications/120-ibm-db2u-database/README.md @@ -28,6 +28,7 @@ Contains a job that runs last (`05-postsync-setup-db2_Job.yaml`). This registers | `Secret` | Post-sync DB2 generated secret | DB2 application namespace | Always | `application_admin_role` | | `NetworkPolicy` | HADR network policy | DB2 application namespace | When HADR is enabled | `application_admin_role` | | `Job` | Pre/post-sync DB2 setup jobs | DB2 application namespace | Always | `application_admin_role` | +| `Job` | DB2 audit policy setup job | DB2 application namespace | When `mas_application_id` is `manage`, `facilities`, `monitor`, or `iot` | `application_admin_role` | ## Configuration @@ -203,6 +204,47 @@ Both can use port 50001 without conflict since they are separate AWS NLB resourc The NLB is created independently for each instance (e.g. facilities, manage) using the instance-specific selector. +## DB2 Audit Policy + +### When It Is Applied + +The audit policy Job ([`08-postsync-db2-audit-policy_Job.yaml`](templates/08-postsync-db2-audit-policy_Job.yaml)) runs at sync-wave `130` (after the main DB2 setup job at wave `129`) and is **only created** when all of the following conditions are met: + +1. `application_admin_role: true` +2. `mas_application_id` is one of: `manage`, `facilities`, `monitor`, `iot` +3. `should_execute: true` +4. `db2_instance_name` does not contain `sdb` (shared instances are excluded) + +For any other `mas_application_id` (e.g. `health`, `visualinspection`, `predict`), no Job resource is rendered. + +### What Gets Audited per Application + +The job creates a single `USER_AUDIT` policy (idempotent — skipped if already exists) and assigns it to roles and/or users depending on the application: + +| Application | Audit Policy | Roles Audited | User Audited | +|---|---|---|---| +| `manage` | `USER_AUDIT` | `MAXIMO_READ`, `MAXIMO_WRITE` (only if roles exist) | `db2inst1` | +| `facilities` | `USER_AUDIT` | `TRIRIGA_READ`, `TRIRIGA_WRITE` (only if roles exist) | `db2inst1` | +| `monitor` | `USER_AUDIT` | None | `db2inst1` | +| `iot` | `USER_AUDIT` | None | `db2inst1` | + +### Audit Policy Definition + +```sql +CREATE AUDIT POLICY USER_AUDIT + CATEGORIES VALIDATE STATUS BOTH, + EXECUTE WITHOUT DATA STATUS BOTH + ERROR TYPE NORMAL +``` + +### Execution Steps + +1. **Connect** to the database (`db2 connect to `) +2. **Create** `USER_AUDIT` policy if it does not already exist +3. **Assign policy to roles** — per-app role audit (skipped if roles do not yet exist) +4. **Assign policy to user** — `AUDIT USER db2inst1 USING POLICY USER_AUDIT` (all 4 apps) +5. **Disconnect** (`db2 connect reset`) + ### Validation If `private_nlb.enabled: true` and either `subnet_ids` or `allowed_cidrs` is diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index de72a17cc..5820e21f8 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -29,7 +29,7 @@ Meaningful prefix for the job resource name. Must be under 52 chars in length to Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. Included in $_job_hash (see below). */}} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_cli_image_digest := "sha256:db6dba0d58592a1bbed459bbe8285316c36d0d8c0bf8b39e1d0f910b3400f441" }} {{- /* A dict of values that influence the behaviour of the job in some way. @@ -43,7 +43,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v2" }} +{{- $_job_version := "v23" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} From 4ece441a3701cc46c8ca56856d493c016881923a Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 21 Aug 2026 21:40:22 +0530 Subject: [PATCH 091/115] fix(wsl): move ws-cluster-scoped to wave 119 to install WS CRD before SPSS (wave 122) SPSS operator at wave 122 tries to create a WS dependency CR of kind ws.cpd.ibm.com/v1beta1.WS. If ws-cluster-scoped runs at wave 123 (after SPSS), the CRD doesn't exist yet and SPSS fails with: 'Failed to find exact match for ws.cpd.ibm.com/v1beta1.WS' Move ws-cluster-scoped from wave 123 to wave 119 so it runs alongside the other cluster-scoped CRD installs, well before SPSS at wave 122. --- .../ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index dc91e476e..81690db70 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -478,7 +478,7 @@ metadata: {{- end }} instance: '{{ .Values.instance.id }}' annotations: - argocd.argoproj.io/sync-wave: "123" + argocd.argoproj.io/sync-wave: "119" finalizers: - resources-finalizer.argocd.argoproj.io spec: From d3b138d32576780a3aa352021e1cec21ad75d96a Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Sat, 22 Aug 2026 00:10:05 +0530 Subject: [PATCH 092/115] fix(spss): move spss app from wave 122 to 125 (after WSL operator at 124) SPSS operator creates a WS CR and waits for Watson Studio as a dependency. The WSL operator (ws chart) deploys at wave 124, so SPSS namespace-scoped app must be at wave 125 or later to avoid a race condition where SPSS tries to create a WS CR before the WS operator is running. Also update wave comment from 123 to 119 on wsl-cluster section (cosmetic). --- .../ibm-mas-instance-root/templates/120-ibm-spss-app.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index 43a108b31..180128949 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -239,7 +239,9 @@ spec: - CreateNamespace=false - SkipDryRunOnMissingResource=true --- -# Wave 122: SPSS namespace-scoped (operator + CR) +# Wave 125: SPSS namespace-scoped (operator + CR) +# Must run AFTER WSL at wave 124 — SPSS operator creates a WS CR and waits for it, +# so the WSL operator must already be running when SPSS reconciles. apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -254,7 +256,7 @@ metadata: {{- end }} instance: '{{ .Values.instance.id }}' annotations: - argocd.argoproj.io/sync-wave: "122" + argocd.argoproj.io/sync-wave: "125" {{- if and .Values.notifications .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} From 63f87548da058cdfa0e3f711f3b4891613cdcd4a Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Sat, 22 Aug 2026 15:06:49 +0530 Subject: [PATCH 093/115] feat(wsl): add wsl-post-verify AVP app at wave 126 for CPD >= 5.3.1 The instance-applications/120-ibm-wsl post-verify job (cpd-wsl-post-verify) was only deployed via the CPD < 5.3.1 AVP app path. For CPD >= 5.3.1 the native Helm apps are used for the WS operator/CR, but the post-verify job still needs to run to write the wsl-cp4d and wsl-project-id secrets to AWS SM. Without these secrets, inst02-watsonstudio-system AVP render fails. Wave 126 ensures it runs after wsl (124) and spss (125). --- .../templates/120-ibm-wsl-app.yaml | 87 +++++++++++++++++++ 1 file changed, 87 insertions(+) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index 81690db70..8c5047ace 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -557,5 +557,92 @@ spec: limit: 20 syncOptions: - CreateNamespace=true +--- +# Wave 126: WSL post-verify (polls WS CR to Completed, writes wsl-cp4d secret to AWS SM) +# Must run AFTER wsl (wave 124) and spss (wave 125). +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-post-verify.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "126" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + ignoreDifferences: + - group: '*' + kind: ServiceAccount + jsonPointers: + - /imagePullSecrets + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + repoURL: "{{ .Values.source.repo_url }}" + path: instance-applications/120-ibm-wsl + targetRevision: "{{ .Values.source.revision }}" + plugin: + name: {{ .Values.avp.name }} + env: + - name: {{ .Values.avp.values_varname }} + value: | + account_id: "{{ .Values.account.id }}" + region_id: "{{ .Values.region.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + cli_image_repo: {{ .Values.cli_image_repo }} + cluster_admin_role: {{ .Values.cluster_admin_role }} + application_admin_role: {{ .Values.application_admin_role }} + sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" + sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" + cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" + cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" + cpd_service_storage_class: "{{ .Values.ibm_wsl.cpd_service_storage_class }}" + cpd_service_block_storage_class: "{{ .Values.ibm_wsl.cpd_service_block_storage_class }}" + cpd_service_scale_config: "{{ .Values.ibm_wsl.cpd_service_scale_config }}" + wsl_channel: "{{ .Values.ibm_wsl.wsl_channel }}" + wsl_version: "{{ .Values.ibm_wsl.wsl_version }}" + {{- if .Values.custom_labels }} + custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} + {{- end }} + junitreporter: + reporter_name: "ibm-wsl-{{ .Values.instance.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" + devops_build_number: "{{ .Values.devops.build_number }}" + gitops_version: "{{ .Values.source.revision }}" + cli_image_repo: {{ .Values.cli_image_repo }} + - name: ARGOCD_APP_NAME + value: cpdwslpostverify + {{- if not (empty .Values.avp.secret) }} + - name: AVP_SECRET + value: {{ .Values.avp.secret }} + {{- end }} + syncPolicy: + automated: + {{- if .Values.auto_delete }} + prune: true + {{- end }} + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true {{- end }} {{- end }} From 049ff760f15c91b760733187143a728cb83b42ac Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 24 Aug 2026 10:04:20 +0530 Subject: [PATCH 094/115] dummy commit for cpd 5.3.1 --- ...5-3-1-gitops-support-full-explanation.html | 401 ------------------ 1 file changed, 401 deletions(-) delete mode 100644 .bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html diff --git a/.bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html b/.bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html deleted file mode 100644 index f5c2ee083..000000000 --- a/.bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html +++ /dev/null @@ -1,401 +0,0 @@ - - - - - -MASCORE-15507 Explainer - - - -
-

MASCORE-15507: CPD 5.3.1 GitOps Support

-

Complete explanation of every change — what was done, why, and how it works

-
-
- -
- Background - OLM Bootstrap - RBAC - WML - WSL - Spark - Cognos - SPSS - Post-sync - Bugs Fixed - Test Results -
- - -
-
- 📋 -

Background — Why This Change Was Needed

-
-
-
-
The Problem
-

CPD (Cloud Pak for Data) 5.3.1 changed how services are installed. In CPD ≤ 5.3, services were installed via OLM (Operator Lifecycle Manager) — you create a Subscription resource and an operator CR, and the OLM machinery handles everything. In CPD 5.3.1+, IBM moved to Helm-based installation — you run helm install directly to deploy the operator and service CR.

-
-
-
What This Means for GitOps
-

Our GitOps templates were only generating OLM Subscription + CR resources. On CPD 5.3.1 clusters, those resources either don't apply (no OLM catalog for them) or the operators aren't available via OLM. We needed to add a second code path that runs Helm charts instead, gated behind a version check.

-
-

Version Gate Pattern Used Throughout

-
{{/* CPD < 5.3.1: use OLM (Subscription + CR) */}} -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} ---- OLM Subscription resource here --- -{{- else }} ---- Helm install Job here --- -{{- end }}
-

This reads as: "if cpd_product_version < 5.3.1, use OLM; otherwise use Helm"

-
-
- - -
-
- 🔧 -

CPD 5.3.1 OLM Bootstrap

- New Files -
-
-
-
Why
-

Even though services use Helm in 5.3.1, the CPD platform itself (zen, common services, etc.) still uses OLM. CPD 5.3.1 requires different catalog sources and a different olm-utils-cm ConfigMap (which tells CPD operators the correct component versions). Without this, the platform operators don't know which versions to reconcile.

-
-
-
-
instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml
instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml
-
Added olm-utils-cm ConfigMap + full release_components_meta for CPD 5.3.1
-
The olm-utils-cm ConfigMap is read by CPD operators to know component versions (case_version, csv_version, cr_version). Without it, operators fall back to wrong defaults. This is gated with {{- if eq .Values.cpd_product_version "5.3.1" }}.
-
-
-
instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml
-
Added 3 new CatalogSources for CPD 5.3.1: cpd-platform, opencloud-operators, ibm-zen-operator-catalog
-
These are pinned to specific digest-based image tags for CPD 5.3.1. Different from 5.3.0 — if you use the wrong catalog, operators install wrong versions or fail to find their CSVs.
-
-
-
-
- - -
-
- 🔐 -

RBAC — ClusterRole for cpd-sa

- Security -
-
-
-
Why
-

The Helm install jobs run as the cpd-sa ServiceAccount. In Helm mode, the cluster-scoped charts install CRDs and ClusterRoles across the entire cluster (not just one namespace). cpd-sa only had namespace-scoped permissions before — it couldn't create CRDs or ClusterRoles. This caused every Helm install job to fail with Forbidden errors.

-
-
-
instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml
-
Added ClusterRole + ClusterRoleBinding for cpd-sa (gated on CPD ≥ 5.3.1)
-
Grants cpd-sa permission to: create/patch CRDs, create/patch ClusterRoles (with escalate), manage webhooks, and access CPD service API groups. The escalate verb is needed because the Helm charts grant permissions that cpd-sa doesn't initially hold.
-
-
-
- - -
-
- 🤖 -

Watson Machine Learning (WML)

- Helm Path Added -
-
-
-
Why Helm for WML
-

WML on CPD 5.3.1 requires installing Redis as a dependency first (WML operator needs Redis CRDs to exist before it can be deployed), then installing the WML operator + CR via Helm charts.

-
-

Install Order (CPD 5.3.1+)

-
-
ibm-redis-cp-cluster-scoped (CRDs)
- → -
ibm-redis-cp (operator)
- → -
Poll rediscps.redis.ibm.com CRD
- → -
wml-cluster-scoped (CRDs)
- → -
Poll wmlbases.wml.cpd.ibm.com CRD
- → -
wml (operator + CR)
-
-

Key Bug Fixed

-
- 🐛 -
-
CRD poll typo: redicps → rediscps
-
The script polled for redicps.redis.ibm.com (missing 's') which never exists. The actual CRD is rediscps.redis.ibm.com. This caused the job to time out after 5 minutes every time.
-
-
-

Hashed Job Name Pattern

-
-
Why hashed names
-

ArgoCD Jobs have immutable spec.template. If we use a fixed name like install-wml-helm and the template changes, ArgoCD tries to patch the existing Job → fails with "field is immutable". By computing a hash from the template content + version string, each change produces a new unique job name, so ArgoCD creates a new Job instead of patching the old one.

-
-
{{- $_job_version := "v2" }} ← bump this to force new job -{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} -{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} -→ produces: install-wml-helm-502535097
-
-
- - -
-
- 🔬 -

Watson Studio (WSL)

- Helm Path Added -
-
-
-
Why WSL is Complex
-

WSL has 4 dependencies that must be installed in order before WSL itself can be installed. Each dependency needs its cluster-scoped chart (CRDs) before its namespace-scoped chart (operator+CR).

-
-

Install Order (CPD 5.3.1+)

-
-
1. opencontent-opensearch
- → -
2. ccs (+ explicit CCS CR)
- → -
3. datarefinery
- → -
4. ws-runtimes
- → -
5. ws (Watson Studio)
-
-
-
CCS CR created explicitly with non_olm_deploy: true
-
In Helm mode, the CCS namespace-scoped chart only deploys the operator, not the CR. The CR must be created manually with non_olm_deploy: true flag so the operator knows it's not running under OLM and proceeds to reconcile the CCS instance.
-
-
-
install_component() helper function
-
Reusable function that: (1) applies cluster-scoped chart via helm template | oc apply, (2) waits for CRDs, (3) runs helm upgrade --install for namespace-scoped chart. Makes the script DRY and readable.
-
-
-
- - -
-
- ⚡ -

Apache Spark (Analytics Engine)

- Helm Path Added -
-
-
-
Changes
-

Gated OLM Subscription, AnalyticsEngine CR, and the control-plane verification job behind < 5.3.1. Added Helm install job for 5.3.1+ using analyticsengine-cluster-scoped + analyticsengine charts at version 12.1.0. Also added cpd_product_version to values.yaml and the instance-root app template — without this, the version gate Helm template would fail (no value to compare against).

-
-
-
- - -
-
- 📊 -

Cognos Analytics

- New Chart - 3 Bugs Fixed -
-
-
-
Context
-

Cognos Analytics was previously bundled with the SPSS chart (they shared the same ArgoCD app template 120-ibm-spss-app.yaml). They were split into separate charts. In the split, the Chart.yaml was accidentally omitted from the Cognos chart.

-
-
-
-
Bug 1: Missing Chart.yaml
-
Helm requires Chart.yaml to treat a directory as a chart. Without it, helm dependency update fails with "Chart.yaml file is missing". Added Chart.yaml matching the pattern of all other charts in the repo.
-
-
-
Bug 2: Escaped quotes parse error in instance-root template
-
The 120-ibm-cognos-analytics-app.yaml used \"nfs-client\" inside a YAML literal block scalar (value: |). Inside a block scalar, backslash escapes are literal characters, not YAML escapes — causing Helm to fail with "unexpected \\ in operand". Fixed by using unescaped "nfs-client".
-
-
-
Bug 3: Wrong CRD poll name
-
The Helm install job polled for cognosanalytics.cognosanalytics.cpd.ibm.com but the cognos-analytics-cluster-scoped chart actually creates caservices.ca.cpd.ibm.com and caserviceinstances.ca.cpd.ibm.com. Fixed to poll caservices.ca.cpd.ibm.com.
-
-
-
-
- - -
-
- 📈 -

SPSS Modeler

- Re-added + CPD 5.3.1 Support -
-
-
-
Context
-

SPSS was previously available only for CPD < 5.3.1 via OLM. For CPD 5.3.1+, IBM provides spss-cluster-scoped + spss Helm charts, but SPSS requires Canvasbase as a dependency (the SPSS operator tries to create a Canvasbase CR on startup).

-
-

Install Order (CPD 5.3.1+)

-
-
canvasbase-cluster-scoped (CRDs) v12.1.0
- → -
Poll canvasbase.canvasbase.cpd.ibm.com
- → -
canvasbase (operator+CR) v12.1.0
- → -
Wait canvasbase Completed
- → -
spss-cluster-scoped (CRDs) v12.1.0
- → -
Poll spss.spssmodeler.cpd.ibm.com
- → -
spss (operator+CR) v12.1.0
-
-

Bugs Found and Fixed During Testing

-
- 🐛 -
-
Wrong chart names: spss-modeler-cluster-scoped / spss-modeler
-
Correct names in IBM Helm repo are spss-cluster-scoped and spss. Fixed by querying the IBM Helm index directly.
-
-
-
- 🐛 -
-
Wrong chart versions: 13.0.4 (CPD 5.4.0) instead of 12.1.0 (CPD 5.3.1)
-
Initially used the latest version (13.0.4) which is for CPD 5.4.0. The CPD 5.3.1 release_components_meta specifies case_version: 12.1.0 for both canvasbase and spss. Using wrong version caused "CR version 13.0.4 does not match operator version 12.1.0" errors.
-
-
-
- 🐛 -
-
Wrong CRD poll names
-
Polled for spssmodelerbases.spssmodeler.cpd.ibm.com (doesn't exist) → actual CRD is spss.spssmodeler.cpd.ibm.com. Polled for canvasbases.cpd.ibm.com → actual CRD is canvasbase.canvasbase.cpd.ibm.com. Both found by checking oc get crd | grep after the cluster-scoped chart ran.
-
-
-
- 🐛 -
-
canvasbase CR version mismatch (13.0.4 vs 12.1.0)
-
The canvasbase Helm chart created the CR with version 12.1.0 but the operator was 13.0.4 (from the wrong chart version). Fixed by correcting chart version. Required manually patching the stuck CR and deleting/recreating the SPSS CR once canvasbase reached Completed.
-
-
-
-
- - -
-
- 🔄 -

Post-Sync Job (121-ibm-post-sync-job-cp4d-services)

- Guard Added -
-
-
-
Why
-

The post-sync job patches CCS and OpenSearch CRs after they're deployed via OLM. In CPD 5.3.1 Helm mode, these CRs are managed by Helm — patching them via the post-sync job would break Helm's management of them. Added an early exit for CPD ≥ 5.3.1.

-
-
COMP_531=$(compare_versions ${CPD_PRODUCT_VERSION} 5.3.1) -if [[ ${COMP_531} -ge 0 ]]; then - echo "CPD >= 5.3.1 - skipping OLM post-sync patching" - exit 0 -fi
-
-
- - -
-
- 🐛 -

All Bugs Found & Fixed During Testing

-
-
- - - - - - - - - - - - - -
FileBugFix
120-ibm-cognos-analytics-app.yamlEscaped quotes \" in block scalarRemoved backslash escapes
120-ibm-cognos-analytics/Missing Chart.yamlAdded Chart.yaml
02-ibm-wml-cr.yamlCRD poll: redicps → rediscpsFixed typo
01-ibm-cognos-analytics-cr.yamlCRD poll: wrong CRD namecaservices.ca.cpd.ibm.com
01-ibm-spss-cr.yamlChart names wrongspss-cluster-scoped / spss
01-ibm-spss-cr.yamlChart version 13.0.4 (CPD 5.4)12.1.0 (CPD 5.3.1)
01-ibm-spss-cr.yamlCRD poll: spssmodelerbasesspss.spssmodeler.cpd.ibm.com
01-ibm-spss-cr.yamlCRD poll: canvasbases.cpd.ibm.comcanvasbase.canvasbase.cpd.ibm.com
01-ibm-spss-cr.yamlMissing canvasbase dependencyAdded canvasbase install step before spss
01-ibm-cognos-analytics-cr.yamlChart version 29.1.8 (too new)29.1.0 (CPD 5.3.1 metadata)
02-ibm-wml-cr.yamlFixed job name (immutable field error)Added hashed job name pattern
-
-
- - -
-
- ✅ -

Test Results — noble8 cluster, CPD 5.3.1, inst02

-
-
-
wml.noble8.inst02✅ WmlBase/wml-cr — Completed 100%
-
wsl.noble8.inst02✅ Synced Healthy
-
spark.noble8.inst02✅ Synced Healthy
-
cognos.noble8.inst02✅ CAService/ca-addon-cr — Completed 100%
-
spss.noble8.inst02✅ canvasbase + spss — Completed 100%
-
-
- -
- - From d64803a57bfbfdc2afa29857340626478ac660d8 Mon Sep 17 00:00:00 2001 From: Vijeya Nidhi B Date: Mon, 24 Aug 2026 15:14:16 +0530 Subject: [PATCH 095/115] fix: mascore-12697 --- .../templates/05-postsync-add-label_Job.yaml | 60 +++++++++++++++++-- 1 file changed, 55 insertions(+), 5 deletions(-) diff --git a/instance-applications/130-ibm-mas-suite/templates/05-postsync-add-label_Job.yaml b/instance-applications/130-ibm-mas-suite/templates/05-postsync-add-label_Job.yaml index af693d235..38d5e11fe 100644 --- a/instance-applications/130-ibm-mas-suite/templates/05-postsync-add-label_Job.yaml +++ b/instance-applications/130-ibm-mas-suite/templates/05-postsync-add-label_Job.yaml @@ -25,7 +25,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v3" }} +{{- $_job_version := "v4" }} {{- /* 10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest @@ -186,6 +186,8 @@ spec: env: - name: SUITE_NAMESPACE value: mas-{{ .Values.instance_id }}-core + - name: INSTANCE_ID + value: {{ .Values.instance_id }} command: - /bin/sh - -c @@ -203,7 +205,7 @@ spec: while true; do wait_period=$(($wait_period+60)) if [ $wait_period -gt 3600 ]; then - echo "Suite Routes is not ready after 20 minutes of waiting. exiting..." + echo "Suite Routes is not ready after 60 minutes of waiting. exiting..." exit 1 else sleep 60 @@ -222,15 +224,63 @@ spec: fi done + # Get expected domain from Suite CR + echo + echo "Validating routes match expected domain from Suite CR..." + EXPECTED_DOMAIN=$(oc get Suite/${INSTANCE_ID} -n ${SUITE_NAMESPACE} -o jsonpath='{.spec.domain}') + echo "Expected domain: ${EXPECTED_DOMAIN}" + + # Wait for routes to match expected domain + # This ensures routes have been recreated after a domain change + wait_period=0 + while true; do + wait_period=$(($wait_period+30)) + if [ $wait_period -gt 1800 ]; then + echo "Routes do not match expected domain after 30 minutes. Exiting..." + echo "This may indicate the Suite operator has not finished recreating routes." + exit 1 + fi + + # Get all route hosts + ROUTE_HOSTS=$(oc get routes -n ${SUITE_NAMESPACE} -o jsonpath='{range .items[*]}{.spec.host}{"\n"}{end}') + + # Check if any routes exist + if [ -z "$ROUTE_HOSTS" ]; then + echo "No routes found yet, waiting..." + sleep 30 + continue + fi + + # Check if all routes contain expected domain + MISMATCHED=$(echo "$ROUTE_HOSTS" | grep -v "$EXPECTED_DOMAIN" || true) + if [ -z "$MISMATCHED" ]; then + echo "All routes match expected domain: ${EXPECTED_DOMAIN}" + break + else + echo "Some routes do not match expected domain yet:" + echo "$MISMATCHED" + echo "Waiting for routes to be recreated with correct domain..." + sleep 30 + fi + done + export routes=$(oc get routes -n ${SUITE_NAMESPACE} -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') - echo "Add label to routes updated ${routes}" + echo + echo "Adding type=external label to routes: ${routes}" for route in $routes; do echo "Adding label to route - ${route}" - oc patch route/${route} -p '{"metadata":{"labels":{"type":"external"}}}' + oc patch route/${route} -p '{"metadata":{"labels":{"type":"external"}}}' || { + echo "Warning: Failed to patch route ${route}, will retry..." + sleep 5 + oc patch route/${route} -p '{"metadata":{"labels":{"type":"external"}}}' + } done + + echo + echo "Successfully added type=external label to all routes" restartPolicy: Never serviceAccountName: "mas-route-sa" backoffLimit: 4 -{{- end }} +{{- end }} \ No newline at end of file From f64cbba0c00518e5379378a4bd8441e4d30effba Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Wed, 26 Aug 2026 11:47:56 +0530 Subject: [PATCH 096/115] fix: restore SPSS README, remove commented-out template lines from WSL files --- instance-applications/120-ibm-spss/README.md | 62 +++++++++++++++++++ .../templates/00-ibm-wsl_Subscription.yaml | 20 ------ .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 29 --------- 3 files changed, 62 insertions(+), 49 deletions(-) create mode 100644 instance-applications/120-ibm-spss/README.md diff --git a/instance-applications/120-ibm-spss/README.md b/instance-applications/120-ibm-spss/README.md new file mode 100644 index 000000000..094e3e453 --- /dev/null +++ b/instance-applications/120-ibm-spss/README.md @@ -0,0 +1,62 @@ +SPSS Modeler +=============================================================================== +Deploys and configures the CP4D Service, SPSS Modeler. + + + + +[SPSS Modeler](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.8.x?topic=modeler-installing) optional dependency for [Predict](https://www.ibm.com/docs/en/mas-cd/mhmpmh-and-p-u/continuous-delivery) + +## Resources Created + +| Resource Type | Resource Name | Namespace | Condition | Installed By | +|--------------|---------------|-----------|-----------|--------------| +| `Subscription` | SPSS operator subscriptions | CP4D instance namespace | Always | `application_admin_role` | +| `Spss` | SPSS service CR | CP4D instance namespace | Always | `application_admin_role` | + +## Configuration + +This chart accepts the following configuration values in the ArgoCD Application values: + +```yaml +ibm_spss: + ccs_version: string (secret reference) + cpd_service_block_storage_class: string + cpd_service_scale_config: string + cpd_service_storage_class: string + spss_channel: string (secret reference) + spss_version: string (secret reference) + spss_install_plan: string + canvasbase_channel: string (secret reference) + canvasbase_install_plan: string +``` + +**Note**: Values marked with "(secret reference)" should use the format `` to reference secrets stored in the Secrets Vault. + +## Base Instance Values + +This chart inherits common instance configuration values. The most frequently used base values are: + +```yaml +account: + id: string # Account identifier + name: string # Account name + +region: + id: string # Region identifier + name: string # Region name + +cluster: + id: string # Cluster identifier + name: string # Cluster name + +instance: + id: string # MAS instance identifier + +sm: # Secrets Manager configuration + aws_secret_region: string + aws_access_key_id: string (secret reference) + aws_secret_access_key: string (secret reference) +``` + +For complete documentation of all base instance values including optional fields like `custom_labels`, `argocluster_instance`, `application_admin_service_account`, `mas_wipe_mongo_data`, `allow_list`, `additional_vpn`, `application_configuration`, `use_postdelete_hooks`, `additional_resources`, `extensions`, `enhanced_dr`, and `cli_image_repo`, see the [Instance Base Values Reference](../../docs/reference/instance-base-values.md). diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index f207bbaae..485e9ab89 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -1,23 +1,3 @@ -# --- -# apiVersion: operators.coreos.com/v1alpha1 -# kind: Subscription -# metadata: -# name: ibm-cpd-ws-operator -# namespace: "{{ .Values.cpd_operators_namespace }}" -# annotations: -# argocd.argoproj.io/sync-wave: "090" -# {{- if .Values.custom_labels }} -# labels: -# {{ .Values.custom_labels | toYaml | indent 4 }} -# {{- end }} -# spec: -# name: ibm-cpd-wsl -# channel: "{{ .Values.wsl_channel }}" -# source: ibm-operator-catalog -# sourceNamespace: openshift-marketplace -# installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} - - {{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 48c093f93..1a83e5322 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -1,32 +1,3 @@ -# --- -# apiVersion: ws.cpd.ibm.com/v1beta1 -# kind: WS -# metadata: -# name: "ws-cr" -# namespace: "{{ .Values.cpd_instance_namespace }}" -# annotations: -# argocd.argoproj.io/sync-wave: "091" -# argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -# {{- if .Values.custom_labels }} -# labels: -# {{ .Values.custom_labels | toYaml | indent 4 }} -# {{- end }} -# spec: -# imagePullSecret: ibm-entitlement-key -# ignoreForMaintenance: false -# license: -# accept: true -# license: Standard -# scaleConfig: "{{ .Values.cpd_service_scale_config }}" -# fileStorageClass: "{{ .Values.cpd_service_storage_class }}" -# blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" -# version: "{{ .Values.wsl_version }}" -# ccs_operand_version: "{{ .Values.ccs_version }}" -# datarefinery_operand_version: "{{ .Values.datarefinery_version }}" -# wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" - - - {{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: ws.cpd.ibm.com/v1beta1 From 2b379713eb21f7e6ff0a69e5e571d7d00c52dbee Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Wed, 26 Aug 2026 12:45:20 +0530 Subject: [PATCH 097/115] fix: set CreateNamespace=false on all CPD service apps - namespaces created at waves 085/110 --- .../templates/120-ibm-cognos-analytics-app.yaml | 2 +- .../templates/120-ibm-spark-app.yaml | 2 +- .../templates/120-ibm-spss-app.yaml | 4 ++-- .../templates/120-ibm-wml-app.yaml | 2 +- .../templates/120-ibm-wsl-app.yaml | 10 +++++----- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index df8963b6b..881c8f5ce 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -119,6 +119,6 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false - RespectIgnoreDifferences=true {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml index 40204e5da..e854a27ab 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml @@ -197,6 +197,6 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false {{- end }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index 180128949..f3f2af81f 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -193,7 +193,7 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false --- # Wave 121: SPSS cluster-scoped (CRDs + ClusterRoles) apiVersion: argoproj.io/v1alpha1 @@ -290,6 +290,6 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false {{- end }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml index c7a18393e..baeccba21 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml @@ -281,7 +281,7 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false --- # Wave 123: WML post-verify (polls WmlBase CR to Completed, writes wml-cp4d secret to SM) apiVersion: argoproj.io/v1alpha1 diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index 8c5047ace..89979275e 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -283,7 +283,7 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false --- # Wave 119: datarefinery cluster-scoped (CRDs + ClusterRoles) apiVersion: argoproj.io/v1alpha1 @@ -372,7 +372,7 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false --- # Wave 121: ws-runtimes cluster-scoped (CRDs + ClusterRoles) apiVersion: argoproj.io/v1alpha1 @@ -461,7 +461,7 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false --- # Wave 123: ws cluster-scoped (CRDs + ClusterRoles) apiVersion: argoproj.io/v1alpha1 @@ -556,7 +556,7 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false --- # Wave 126: WSL post-verify (polls WS CR to Completed, writes wsl-cp4d secret to AWS SM) # Must run AFTER wsl (wave 124) and spss (wave 125). @@ -643,6 +643,6 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false {{- end }} {{- end }} From 25d48ee8cc51fcebfa233d1ff0f050c15a73fe9a Mon Sep 17 00:00:00 2001 From: Sagar-Talikoti Date: Wed, 26 Aug 2026 14:47:25 +0530 Subject: [PATCH 098/115] raise sync-wave priority for Manage over other apps --- ...505-ibm-mas-masapp-facilities-install.yaml | 2 +- .../510-550-ibm-mas-masapp-configs.yaml | 22 +++++++++---------- .../510-ibm-mas-masapp-assist-install.yaml | 2 +- .../510-ibm-mas-masapp-iot-install.yaml | 4 ++-- ...m-mas-masapp-visualinspection-install.yaml | 2 +- .../520-ibm-mas-masapp-health-install.yaml | 2 +- .../520-ibm-mas-masapp-monitor-install.yaml | 4 ++-- .../520-ibm-mas-masapp-optimizer-install.yaml | 2 +- .../540-ibm-mas-masapp-predict-install.yaml | 2 +- 9 files changed, 21 insertions(+), 21 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/505-ibm-mas-masapp-facilities-install.yaml b/root-applications/ibm-mas-instance-root/templates/505-ibm-mas-masapp-facilities-install.yaml index 0bcce1153..dbb1e9def 100644 --- a/root-applications/ibm-mas-instance-root/templates/505-ibm-mas-masapp-facilities-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/505-ibm-mas-masapp-facilities-install.yaml @@ -16,7 +16,7 @@ metadata: instance: '{{ .Values.instance.id }}' masapp: 'facilities' annotations: - argocd.argoproj.io/sync-wave: "505" + argocd.argoproj.io/sync-wave: "510" {{- if and .Values.notifications .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} diff --git a/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml b/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml index 0a997ba01..24e6f3f31 100644 --- a/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml +++ b/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml @@ -26,31 +26,31 @@ metadata: namespace: {{ $.Values.argo.namespace }} annotations: {{- if eq $value.mas_app_id "assist" }} - argocd.argoproj.io/sync-wave: "515" + argocd.argoproj.io/sync-wave: "520" {{- else if eq $value.mas_app_id "facilities" }} - argocd.argoproj.io/sync-wave: "510" + argocd.argoproj.io/sync-wave: "515" {{- else if eq $value.mas_app_id "iot" }} {{- if $iot_is_v92_or_higher }} - argocd.argoproj.io/sync-wave: "530" + argocd.argoproj.io/sync-wave: "535" {{- else }} - argocd.argoproj.io/sync-wave: "515" + argocd.argoproj.io/sync-wave: "525" {{- end }} {{- else if eq $value.mas_app_id "manage" }} - argocd.argoproj.io/sync-wave: "510" + argocd.argoproj.io/sync-wave: "505" {{- else if eq $value.mas_app_id "visualinspection" }} - argocd.argoproj.io/sync-wave: "515" + argocd.argoproj.io/sync-wave: "520" {{- else if eq $value.mas_app_id "health" }} - argocd.argoproj.io/sync-wave: "530" + argocd.argoproj.io/sync-wave: "535" {{- else if eq $value.mas_app_id "monitor" }} {{- if $monitor_is_v92_or_higher }} - argocd.argoproj.io/sync-wave: "515" + argocd.argoproj.io/sync-wave: "525" {{- else }} - argocd.argoproj.io/sync-wave: "530" + argocd.argoproj.io/sync-wave: "535" {{- end }} {{- else if eq $value.mas_app_id "optimizer" }} - argocd.argoproj.io/sync-wave: "530" + argocd.argoproj.io/sync-wave: "535" {{- else if eq $value.mas_app_id "predict" }} - argocd.argoproj.io/sync-wave: "550" + argocd.argoproj.io/sync-wave: "555" {{- end }} {{- if and $.Values.notifications $.Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ $.Values.notifications.slack_channel_id }} diff --git a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-assist-install.yaml b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-assist-install.yaml index 6f13fd6f5..f1171b653 100644 --- a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-assist-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-assist-install.yaml @@ -16,7 +16,7 @@ metadata: instance: '{{ .Values.instance.id }}' masapp: 'assist' annotations: - argocd.argoproj.io/sync-wave: "510" + argocd.argoproj.io/sync-wave: "515" {{- if and .Values.notifications .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} diff --git a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-iot-install.yaml b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-iot-install.yaml index 32b160caf..9c3a9ef28 100644 --- a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-iot-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-iot-install.yaml @@ -1,6 +1,6 @@ {{- if not (empty .Values.ibm_suite_app_iot_install) }} {{- /* Calculate sync wave based on mas_app_channel version */ -}} -{{- $syncwave := "510" -}} +{{- $syncwave := "520" -}} {{- if .Values.ibm_suite_app_iot_install.mas_app_channel -}} {{- $channel := .Values.ibm_suite_app_iot_install.mas_app_channel | toString -}} {{- $version := regexFind `^[0-9]+\.[0-9]+` $channel -}} @@ -10,7 +10,7 @@ {{- $minor := index $parts 1 | int -}} {{- /* Use sync wave 520 for version >= 9.2, otherwise 510 */ -}} {{- if or (gt $major 9) (and (eq $major 9) (ge $minor 2)) -}} - {{- $syncwave = "520" -}} + {{- $syncwave = "530" -}} {{- end -}} {{- end -}} {{- end -}} diff --git a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-visualinspection-install.yaml b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-visualinspection-install.yaml index 40c24c1d3..3c2fa0989 100644 --- a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-visualinspection-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-visualinspection-install.yaml @@ -16,7 +16,7 @@ metadata: instance: '{{ .Values.instance.id }}' masapp: 'visualinspection' annotations: - argocd.argoproj.io/sync-wave: "510" + argocd.argoproj.io/sync-wave: "515" {{- if and .Values.notifications .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} diff --git a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-health-install.yaml b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-health-install.yaml index f6c65862a..abd42dc9b 100644 --- a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-health-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-health-install.yaml @@ -16,7 +16,7 @@ metadata: instance: '{{ .Values.instance.id }}' masapp: 'health' annotations: - argocd.argoproj.io/sync-wave: "520" + argocd.argoproj.io/sync-wave: "530" {{- if and .Values.notifications .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} diff --git a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-monitor-install.yaml b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-monitor-install.yaml index ff75b7346..d5a182516 100644 --- a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-monitor-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-monitor-install.yaml @@ -1,6 +1,6 @@ {{- if not (empty .Values.ibm_suite_app_monitor_install) }} {{- /* Calculate sync wave based on mas_app_channel version */ -}} -{{- $syncwave := "520" -}} +{{- $syncwave := "530" -}} {{- if .Values.ibm_suite_app_monitor_install.mas_app_channel -}} {{- $channel := .Values.ibm_suite_app_monitor_install.mas_app_channel | toString -}} {{- $version := regexFind `^[0-9]+\.[0-9]+` $channel -}} @@ -10,7 +10,7 @@ {{- $minor := index $parts 1 | int -}} {{- /* Use sync wave 510 for version >= 9.2, otherwise 520 */ -}} {{- if or (gt $major 9) (and (eq $major 9) (ge $minor 2)) -}} - {{- $syncwave = "510" -}} + {{- $syncwave = "520" -}} {{- end -}} {{- end -}} {{- end -}} diff --git a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-optimizer-install.yaml b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-optimizer-install.yaml index ddfd2995c..bcdb3f8e3 100644 --- a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-optimizer-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-optimizer-install.yaml @@ -16,7 +16,7 @@ metadata: instance: '{{ .Values.instance.id }}' masapp: 'optimizer' annotations: - argocd.argoproj.io/sync-wave: "520" + argocd.argoproj.io/sync-wave: "530" {{- if and .Values.notifications .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} diff --git a/root-applications/ibm-mas-instance-root/templates/540-ibm-mas-masapp-predict-install.yaml b/root-applications/ibm-mas-instance-root/templates/540-ibm-mas-masapp-predict-install.yaml index 746a1e85c..1599d9af8 100644 --- a/root-applications/ibm-mas-instance-root/templates/540-ibm-mas-masapp-predict-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/540-ibm-mas-masapp-predict-install.yaml @@ -16,7 +16,7 @@ metadata: instance: '{{ .Values.instance.id }}' masapp: 'predict' annotations: - argocd.argoproj.io/sync-wave: "540" + argocd.argoproj.io/sync-wave: "545" {{- if and .Values.notifications .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} From dc834e550d5282c8cfc2ba7f0086702957ace61c Mon Sep 17 00:00:00 2001 From: Sagar-Talikoti Date: Wed, 26 Aug 2026 21:49:02 +0530 Subject: [PATCH 099/115] fix: set sync-wave order for SDB and Backup job --- .../120-ibm-db2u-database/templates/04-db2u-Backup_Cron.yaml | 2 ++ .../ibm-mas-instance-root/templates/120-db2-databases-app.yaml | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/04-db2u-Backup_Cron.yaml b/instance-applications/120-ibm-db2u-database/templates/04-db2u-Backup_Cron.yaml index 9fbc12cba..5cd5b486c 100644 --- a/instance-applications/120-ibm-db2u-database/templates/04-db2u-Backup_Cron.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/04-db2u-Backup_Cron.yaml @@ -12,6 +12,8 @@ apiVersion: batch/v1 metadata: name: "db2-backup-job-v1-{{ .Values.db2_instance_name }}" namespace: "{{ .Values.db2_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "515" labels: parent: cronjob cosBucket: "{{ .Values.db2_backup_bucket_name }}" diff --git a/root-applications/ibm-mas-instance-root/templates/120-db2-databases-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-db2-databases-app.yaml index af6b2ce05..291a1a43a 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-db2-databases-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-db2-databases-app.yaml @@ -22,7 +22,7 @@ metadata: {{ if not (contains "sdb" $value.db2_instance_name) }} argocd.argoproj.io/sync-wave: "120" {{ else }} - argocd.argoproj.io/sync-wave: "121" + argocd.argoproj.io/sync-wave: "520" {{ end }} {{- if and $.Values.notifications $.Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ $.Values.notifications.slack_channel_id }} From 21f23db252e27d132a191322c32e33c936bede61 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 27 Aug 2026 11:08:21 +0530 Subject: [PATCH 100/115] fix(spss): revert subscription name and sync-wave to match main --- .../120-ibm-spss/templates/00-ibm-spss_Subscription.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index 0e5fc2c69..183a60725 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -3,10 +3,10 @@ apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: - name: spss-modeler-subscription + name: "cpd-spss-operator" namespace: "{{ .Values.cpd_operators_namespace }}" annotations: - argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/sync-wave: "091" {{- if .Values.custom_labels }} labels: {{ .Values.custom_labels | toYaml | indent 4 }} From ac389a086074ccbdf78889daeadd3234dcd9e796 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 27 Aug 2026 11:43:08 +0530 Subject: [PATCH 101/115] fix: update README tables to match template resource kinds --- instance-applications/120-ibm-spark/README.md | 1 - instance-applications/120-ibm-wml/README.md | 5 ++++- instance-applications/120-ibm-wsl/README.md | 1 - 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-spark/README.md b/instance-applications/120-ibm-spark/README.md index 2a3fab040..68de7b646 100644 --- a/instance-applications/120-ibm-spark/README.md +++ b/instance-applications/120-ibm-spark/README.md @@ -15,7 +15,6 @@ Spark extends jupyter notebooks features inside Watson Studio notebooks which ca | `ServiceAccount` | Spark control-plane service account | CP4D instance namespace | When control-plane job is enabled | `application_admin_role` | | `ClusterRole` | Spark control-plane cluster roles | N/A (cluster-scoped) | When control-plane job is enabled | `application_admin_role` | | `ClusterRoleBinding` | Spark control-plane cluster role binding | N/A (cluster-scoped) | When control-plane job is enabled | `application_admin_role` | -| `ConfigMap` | Helm install state tracking | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | | `Job` | Spark Helm install job | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | ## Configuration diff --git a/instance-applications/120-ibm-wml/README.md b/instance-applications/120-ibm-wml/README.md index d309bc536..f87f7582f 100644 --- a/instance-applications/120-ibm-wml/README.md +++ b/instance-applications/120-ibm-wml/README.md @@ -12,8 +12,11 @@ Deploys and configures the CP4D Service, Watson Machine Learning (WML) needed fo |--------------|---------------|-----------|-----------|--------------| | `Subscription` | WML operator subscription | CP4D operators namespace | CPD < 5.3.1 | `application_admin_role` | | `WmlBase` | Watson Machine Learning service CR | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | -| `ConfigMap` | Helm install state tracking | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | | `Job` | Helm install job (ibm-redis-cp + wml) | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | +| `Role` | WML post-verify roles | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `RoleBinding` | WML post-verify role binding | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `Secret` | WML post-verify runtime secret | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `ServiceAccount` | WML post-verify service account | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | ## Configuration diff --git a/instance-applications/120-ibm-wsl/README.md b/instance-applications/120-ibm-wsl/README.md index b5a0e9eb7..0afcd2576 100644 --- a/instance-applications/120-ibm-wsl/README.md +++ b/instance-applications/120-ibm-wsl/README.md @@ -15,7 +15,6 @@ Deploys and configures the CP4D Service, Watson Studio Local (WSL) needed for `M | `Role` | WSL post-verify roles | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | | `RoleBinding` | WSL post-verify role binding | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | | `Secret` | WSL post-verify runtime secret | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | -| `ConfigMap` | Helm install state tracking | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | | `Job` | WSL Helm install job | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | ## Configuration From 2e2cd9b4cc89d97b81644778dbb702aaaea1a44e Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 27 Aug 2026 11:46:11 +0530 Subject: [PATCH 102/115] fix: update cli image digest in wml post-verify template --- .../120-ibm-wml/templates/03-ibm-wml-post-verify.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml b/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml index 42a627a25..fdfea7673 100644 --- a/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml +++ b/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml @@ -8,7 +8,7 @@ Meaningful prefix for the job resource name. Must be under 52 chars in length to Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. Included in $_job_hash (see below). */}} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_cli_image_digest := "sha256:db6dba0d58592a1bbed459bbe8285316c36d0d8c0bf8b39e1d0f910b3400f441" }} {{- /* A dict of values that influence the behaviour of the job in some way. From 60f2758e4f5266cd836727cf08a7f1d01ee264c5 Mon Sep 17 00:00:00 2001 From: Sagar-Talikoti Date: Fri, 28 Aug 2026 13:03:54 +0530 Subject: [PATCH 103/115] fix: update sync-wave for 04-db2u-Backup_Cron.yaml --- .../120-ibm-db2u-database/templates/04-db2u-Backup_Cron.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/04-db2u-Backup_Cron.yaml b/instance-applications/120-ibm-db2u-database/templates/04-db2u-Backup_Cron.yaml index 5cd5b486c..c7bf323de 100644 --- a/instance-applications/120-ibm-db2u-database/templates/04-db2u-Backup_Cron.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/04-db2u-Backup_Cron.yaml @@ -13,7 +13,7 @@ metadata: name: "db2-backup-job-v1-{{ .Values.db2_instance_name }}" namespace: "{{ .Values.db2_namespace }}" annotations: - argocd.argoproj.io/sync-wave: "515" + argocd.argoproj.io/sync-wave: "525" labels: parent: cronjob cosBucket: "{{ .Values.db2_backup_bucket_name }}" From 7e9eb42e1193d13e827560c82c5415982ac5d560 Mon Sep 17 00:00:00 2001 From: Abhirup Choudhury Date: Fri, 28 Aug 2026 18:00:52 +0530 Subject: [PATCH 104/115] update deprovisioning logic --- .../01-postdelete-crs-resources.yaml | 23 ++++ .../07-postdelete-delete-app-cr.yaml | 116 +++++++++++++++++ .../03-postdelete-delete-appws-cr.yaml | 117 ++++++++++++++++++ .../templates/000-ibm-sync-resources.yaml | 2 + .../templates/010-ibm-sync-jobs.yaml | 2 + .../510-550-ibm-mas-masapp-configs.yaml | 3 + ...m-mas-masapp-visualinspection-install.yaml | 3 + 7 files changed, 266 insertions(+) create mode 100644 instance-applications/500-540-ibm-mas-suite-app-install/templates/07-postdelete-delete-app-cr.yaml create mode 100644 instance-applications/510-550-ibm-mas-suite-app-config/templates/03-postdelete-delete-appws-cr.yaml diff --git a/instance-applications/130-ibm-mas-suite/templates/01-postdelete-crs-resources.yaml b/instance-applications/130-ibm-mas-suite/templates/01-postdelete-crs-resources.yaml index 217c83230..95e8acf66 100644 --- a/instance-applications/130-ibm-mas-suite/templates/01-postdelete-crs-resources.yaml +++ b/instance-applications/130-ibm-mas-suite/templates/01-postdelete-crs-resources.yaml @@ -82,6 +82,29 @@ rules: - addons.mas.ibm.com resources: - genericaddons + - verbs: + - delete + - get + - list + - patch + - watch + apiGroups: + - apps.mas.ibm.com + resources: + - assistapps + - assistworkspaces + - facilitiesapps + - facilitiesworkspaces + - manageapps + - manageworkspaces + - monitorapps + - monitorworkspaces + - optimizerapps + - optimizerworkspaces + - predictapps + - predictworkspaces + - visualinspectionapps + - visualinspectionappworkspaces --- kind: ServiceAccount diff --git a/instance-applications/500-540-ibm-mas-suite-app-install/templates/07-postdelete-delete-app-cr.yaml b/instance-applications/500-540-ibm-mas-suite-app-install/templates/07-postdelete-delete-app-cr.yaml new file mode 100644 index 000000000..b076132ab --- /dev/null +++ b/instance-applications/500-540-ibm-mas-suite-app-install/templates/07-postdelete-delete-app-cr.yaml @@ -0,0 +1,116 @@ +{{- if .Values.application_admin_role }} +{{- if .Values.use_postdelete_hooks }} + +{{- /* +PostDelete job: force-deletes the MAS App CR (e.g. VisualInspectionApp, ManageApp, etc.) +after the ArgoCD Application is removed. Patches out operator-owned finalizers first so +deletion succeeds even if the app operator namespace is already gone. + +Depends on SA/Role/NetworkPolicy created by ibm-mas-suite chart (01-postdelete-crs-resources.yaml). + +Use the build/bin/set-cli-image-digest.sh script to update the image digest below. +*/}} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} + +{{- $core_ns := printf "mas-%s-core" .Values.instance_id }} +{{- $app_ns := .Values.mas_app_namespace }} +{{- $cr_name := .Values.instance_id }} +{{- $cr_kind := .Values.mas_app_kind }} +{{- $cr_api_v := .Values.mas_app_api_version }} +{{- $name_hash := $cr_name | sha256sum | trunc 6 }} +{{- $job_name := printf "postdelete-cr-job-app-%s-%s" ($cr_name | trunc 32) $name_hash }} + +{{ $sa_name := "postdelete-delete-cr-sa" }} +{{ $job_label := "postdelete-delete-cr-job" }} + +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ $job_name }} + namespace: {{ $core_ns }} + annotations: + argocd.argoproj.io/hook: PostDelete + argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + template: + metadata: + labels: + app: {{ $job_label }} +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 8 }} +{{- end }} + spec: + serviceAccountName: {{ $sa_name }} + restartPolicy: Never + containers: + - name: run + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} + imagePullPolicy: IfNotPresent + resources: + limits: + cpu: 200m + memory: 512Mi + requests: + cpu: 10m + memory: 64Mi + env: + - name: CR_NAMESPACE + value: {{ $app_ns }} + - name: CR_NAME + value: {{ $cr_name }} + - name: CR_API_VERSION + value: {{ $cr_api_v }} + - name: CR_KIND + value: {{ $cr_kind }} + volumeMounts: [] + command: + - /bin/sh + - -c + - | + set -e + echo "------------------------------------------------------------------" + echo "PostDelete: ${CR_KIND}.${CR_API_VERSION}/${CR_NAME} in ${CR_NAMESPACE}" + + set +e + RESOURCE_NAME=$(oc get ${CR_KIND}.${CR_API_VERSION}/${CR_NAME} \ + -n ${CR_NAMESPACE} -o=jsonpath="{.metadata.name}" 2>/dev/null) + set -e + + if [[ -z "${RESOURCE_NAME}" ]]; then + echo "Resource not found - nothing to do" + exit 0 + fi + + # Force-clear finalizers so delete completes even if the operator is gone + echo "Patching out finalizers..." + set +e + oc patch ${CR_KIND}.${CR_API_VERSION}/${CR_NAME} -n ${CR_NAMESPACE} \ + --type=merge -p '{"metadata":{"finalizers":[]}}' 2>/dev/null + set -e + + echo "Deleting resource..." + set +e + oc delete ${CR_KIND}.${CR_API_VERSION}/${CR_NAME} \ + -n ${CR_NAMESPACE} --timeout=120s --wait=true 2>/dev/null + set -e + + # Verify gone + set +e + RESOURCE_NAME=$(oc get ${CR_KIND}.${CR_API_VERSION}/${CR_NAME} \ + -n ${CR_NAMESPACE} -o=jsonpath="{.metadata.name}" 2>/dev/null) + set -e + + if [[ -n "${RESOURCE_NAME}" ]]; then + echo "ERROR: resource still present after delete" + exit 1 + fi + echo "Done" + volumes: [] + backoffLimit: 4 +{{- end }} +{{- end }} diff --git a/instance-applications/510-550-ibm-mas-suite-app-config/templates/03-postdelete-delete-appws-cr.yaml b/instance-applications/510-550-ibm-mas-suite-app-config/templates/03-postdelete-delete-appws-cr.yaml new file mode 100644 index 000000000..b0abff076 --- /dev/null +++ b/instance-applications/510-550-ibm-mas-suite-app-config/templates/03-postdelete-delete-appws-cr.yaml @@ -0,0 +1,117 @@ +{{- if .Values.application_admin_role }} +{{- if .Values.use_postdelete_hooks }} + +{{- /* +PostDelete job: force-deletes the MAS App Workspace CR (e.g. VisualInspectionAppWorkspace, +ManageWorkspace, MonitorWorkspace, etc.) after the ArgoCD Application is removed. +Patches out operator-owned finalizers first so deletion succeeds even if the app operator +namespace is already gone. + +Depends on SA/Role/NetworkPolicy created by ibm-mas-suite chart (01-postdelete-crs-resources.yaml). + +Use the build/bin/set-cli-image-digest.sh script to update the image digest below. +*/}} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} + +{{- $core_ns := printf "mas-%s-core" .Values.instance_id }} +{{- $app_ns := .Values.mas_app_namespace }} +{{- $cr_name := printf "%s-%s" .Values.instance_id .Values.mas_workspace_id }} +{{- $cr_kind := .Values.mas_app_ws_kind }} +{{- $cr_api_v := .Values.mas_app_ws_apiversion }} +{{- $name_hash := $cr_name | sha256sum | trunc 6 }} +{{- $job_name := printf "postdelete-cr-job-ws-%s-%s" ($cr_name | trunc 32) $name_hash }} + +{{ $sa_name := "postdelete-delete-cr-sa" }} +{{ $job_label := "postdelete-delete-cr-job" }} + +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ $job_name }} + namespace: {{ $core_ns }} + annotations: + argocd.argoproj.io/hook: PostDelete + argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + template: + metadata: + labels: + app: {{ $job_label }} +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 8 }} +{{- end }} + spec: + serviceAccountName: {{ $sa_name }} + restartPolicy: Never + containers: + - name: run + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} + imagePullPolicy: IfNotPresent + resources: + limits: + cpu: 200m + memory: 512Mi + requests: + cpu: 10m + memory: 64Mi + env: + - name: CR_NAMESPACE + value: {{ $app_ns }} + - name: CR_NAME + value: {{ $cr_name }} + - name: CR_API_VERSION + value: {{ $cr_api_v }} + - name: CR_KIND + value: {{ $cr_kind }} + volumeMounts: [] + command: + - /bin/sh + - -c + - | + set -e + echo "------------------------------------------------------------------" + echo "PostDelete: ${CR_KIND}.${CR_API_VERSION}/${CR_NAME} in ${CR_NAMESPACE}" + + set +e + RESOURCE_NAME=$(oc get ${CR_KIND}.${CR_API_VERSION}/${CR_NAME} \ + -n ${CR_NAMESPACE} -o=jsonpath="{.metadata.name}" 2>/dev/null) + set -e + + if [[ -z "${RESOURCE_NAME}" ]]; then + echo "Resource not found - nothing to do" + exit 0 + fi + + # Force-clear finalizers so delete completes even if the operator is gone + echo "Patching out finalizers..." + set +e + oc patch ${CR_KIND}.${CR_API_VERSION}/${CR_NAME} -n ${CR_NAMESPACE} \ + --type=merge -p '{"metadata":{"finalizers":[]}}' 2>/dev/null + set -e + + echo "Deleting resource..." + set +e + oc delete ${CR_KIND}.${CR_API_VERSION}/${CR_NAME} \ + -n ${CR_NAMESPACE} --timeout=120s --wait=true 2>/dev/null + set -e + + # Verify gone + set +e + RESOURCE_NAME=$(oc get ${CR_KIND}.${CR_API_VERSION}/${CR_NAME} \ + -n ${CR_NAMESPACE} -o=jsonpath="{.metadata.name}" 2>/dev/null) + set -e + + if [[ -n "${RESOURCE_NAME}" ]]; then + echo "ERROR: resource still present after delete" + exit 1 + fi + echo "Done" + volumes: [] + backoffLimit: 4 +{{- end }} +{{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/000-ibm-sync-resources.yaml b/root-applications/ibm-mas-instance-root/templates/000-ibm-sync-resources.yaml index 62a2129ee..bdcf5febc 100644 --- a/root-applications/ibm-mas-instance-root/templates/000-ibm-sync-resources.yaml +++ b/root-applications/ibm-mas-instance-root/templates/000-ibm-sync-resources.yaml @@ -20,6 +20,8 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup spec: ignoreDifferences: - group: '*' diff --git a/root-applications/ibm-mas-instance-root/templates/010-ibm-sync-jobs.yaml b/root-applications/ibm-mas-instance-root/templates/010-ibm-sync-jobs.yaml index 5e32b96e2..9ff6f47e7 100644 --- a/root-applications/ibm-mas-instance-root/templates/010-ibm-sync-jobs.yaml +++ b/root-applications/ibm-mas-instance-root/templates/010-ibm-sync-jobs.yaml @@ -20,6 +20,8 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup spec: ignoreDifferences: - group: '*' diff --git a/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml b/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml index 0a997ba01..fa0204156 100644 --- a/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml +++ b/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml @@ -58,6 +58,8 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup labels: environment: '{{ $.Values.account.id }}' region: '{{ $.Values.region.id }}' @@ -88,6 +90,7 @@ spec: mas_app_ws_apiversion: "{{ $value.mas_app_ws_apiversion }}" mas_app_ws_kind: "{{ $value.mas_app_ws_kind }}" mas_appws_spec: {{ $value.mas_appws_spec | toYaml | nindent 14 }} + use_postdelete_hooks: {{ $.Values.use_postdelete_hooks | default true }} {{- if (eq $value.mas_app_id "manage") }} mas_app_channel: "{{ $.Values.ibm_suite_app_manage_install.mas_app_channel }}" {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-visualinspection-install.yaml b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-visualinspection-install.yaml index 40c24c1d3..790db2d5e 100644 --- a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-visualinspection-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-visualinspection-install.yaml @@ -23,6 +23,8 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -62,6 +64,7 @@ spec: tls_key: | {{ .Values.ibm_suite_app_visualinspection_install.tls_key }} {{- end }} + use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_app_spec: {{ .Values.ibm_suite_app_visualinspection_install.mas_app_spec | toYaml | nindent 14 }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} From aab83b653fe1f4aac1b762175bf069d7e10a00b2 Mon Sep 17 00:00:00 2001 From: Abhirup Choudhury Date: Fri, 28 Aug 2026 20:37:50 +0530 Subject: [PATCH 105/115] fix: add post-delete-finalizer and PostDelete hooks to Suite, SLS, and all MAS app install Applications for complete automated deprovisioning MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add post-delete-finalizer to 100-ibm-sls-app.yaml and 130-ibm-mas-suite-app.yaml - Add post-delete-finalizer to all app-install Applications (Manage, Facilities, Assist, IoT, Health, Monitor, Optimizer, Predict) - New: 08-postdelete-delete-suite-cr.yaml — PostDelete Job to force-remove Suite CR (core.mas.ibm.com/v1) - New: 08-postdelete-delete-licenseservice-cr.yaml — PostDelete Job to force-remove LicenseService CR (sls.ibm.com/v1) - Extend RBAC Role/ClusterRole in 01-postdelete-crs-resources.yaml to cover apps.mas.ibm.com, core.mas.ibm.com, and sls.ibm.com so PostDelete SA can patch/delete all required CRs across namespaces --- ...8-postdelete-delete-licenseservice-cr.yaml | 114 +++++++++++++++++ .../01-postdelete-crs-resources.yaml | 90 ++++++++++++- .../08-postdelete-delete-suite-cr.yaml | 119 ++++++++++++++++++ .../templates/100-ibm-sls-app.yaml | 3 + .../templates/130-ibm-mas-suite-app.yaml | 3 + .../500-ibm-mas-masapp-manage-install.yaml | 3 + ...505-ibm-mas-masapp-facilities-install.yaml | 3 + .../510-ibm-mas-masapp-assist-install.yaml | 3 + .../510-ibm-mas-masapp-iot-install.yaml | 3 + .../520-ibm-mas-masapp-health-install.yaml | 3 + .../520-ibm-mas-masapp-monitor-install.yaml | 3 + .../520-ibm-mas-masapp-optimizer-install.yaml | 3 + .../540-ibm-mas-masapp-predict-install.yaml | 3 + 13 files changed, 347 insertions(+), 6 deletions(-) create mode 100644 instance-applications/100-ibm-sls/templates/08-postdelete-delete-licenseservice-cr.yaml create mode 100644 instance-applications/130-ibm-mas-suite/templates/08-postdelete-delete-suite-cr.yaml diff --git a/instance-applications/100-ibm-sls/templates/08-postdelete-delete-licenseservice-cr.yaml b/instance-applications/100-ibm-sls/templates/08-postdelete-delete-licenseservice-cr.yaml new file mode 100644 index 000000000..9237353d4 --- /dev/null +++ b/instance-applications/100-ibm-sls/templates/08-postdelete-delete-licenseservice-cr.yaml @@ -0,0 +1,114 @@ +{{- if .Values.application_admin_role }} +{{- if .Values.use_postdelete_hooks }} + +{{- /* +PostDelete job: force-deletes the SLS LicenseService CR (sls.ibm.com/v1 LicenseService) +after the ArgoCD Application is removed. + +The SLS operator holds a finalizer on the LicenseService CR. If the operator is +Degraded or not running at deprovisioning time, the finalizer blocks deletion. +This job patches it out unconditionally so cleanup always completes. + +LicenseService CR name is always "sls" in namespace mas--sls. + +Use the build/bin/set-cli-image-digest.sh script to update the image digest below. +*/}} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} + +{{- $sls_ns := printf "mas-%s-sls" .Values.instance_id }} +{{- $core_ns := printf "mas-%s-core" .Values.instance_id }} +{{- $job_name := "postdelete-sls-licenseservice-cr" }} + +{{ $sa_name := "postdelete-delete-cr-sa" }} +{{ $job_label := "postdelete-delete-cr-job" }} + +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ $job_name }} + namespace: {{ $core_ns }} + annotations: + argocd.argoproj.io/hook: PostDelete + argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + template: + metadata: + labels: + app: {{ $job_label }} +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 8 }} +{{- end }} + spec: + serviceAccountName: {{ $sa_name }} + restartPolicy: Never + containers: + - name: run + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} + imagePullPolicy: IfNotPresent + resources: + limits: + cpu: 200m + memory: 512Mi + requests: + cpu: 10m + memory: 64Mi + env: + - name: SLS_NAMESPACE + value: {{ $sls_ns }} + volumeMounts: [] + command: + - /bin/sh + - -c + - | + set -e + echo "------------------------------------------------------------------" + echo "PostDelete: LicenseService.sls.ibm.com/sls in ${SLS_NAMESPACE}" + + set +e + RESOURCE_NAME=$(oc get licenseservice.sls.ibm.com/sls \ + -n ${SLS_NAMESPACE} -o=jsonpath="{.metadata.name}" 2>/dev/null) + set -e + + if [[ -z "${RESOURCE_NAME}" ]]; then + echo "LicenseService CR not found — nothing to do" + exit 0 + fi + + echo "Current finalizers:" + oc get licenseservice.sls.ibm.com/sls -n ${SLS_NAMESPACE} \ + -o=jsonpath="{.metadata.finalizers}" 2>/dev/null || true + echo "" + + # Patch out operator finalizers — works even if SLS operator is not running + echo "Patching out finalizers..." + set +e + oc patch licenseservice.sls.ibm.com/sls -n ${SLS_NAMESPACE} \ + --type=merge -p '{"metadata":{"finalizers":[]}}' 2>/dev/null + set -e + + echo "Deleting LicenseService CR..." + set +e + oc delete licenseservice.sls.ibm.com/sls \ + -n ${SLS_NAMESPACE} --timeout=120s --wait=true 2>/dev/null + set -e + + # Verify gone + set +e + RESOURCE_NAME=$(oc get licenseservice.sls.ibm.com/sls \ + -n ${SLS_NAMESPACE} -o=jsonpath="{.metadata.name}" 2>/dev/null) + set -e + + if [[ -n "${RESOURCE_NAME}" ]]; then + echo "ERROR: LicenseService CR still present after delete attempt" + exit 1 + fi + echo "LicenseService CR deleted successfully" + volumes: [] + backoffLimit: 4 +{{- end }} +{{- end }} diff --git a/instance-applications/130-ibm-mas-suite/templates/01-postdelete-crs-resources.yaml b/instance-applications/130-ibm-mas-suite/templates/01-postdelete-crs-resources.yaml index 95e8acf66..983c5df6a 100644 --- a/instance-applications/130-ibm-mas-suite/templates/01-postdelete-crs-resources.yaml +++ b/instance-applications/130-ibm-mas-suite/templates/01-postdelete-crs-resources.yaml @@ -4,7 +4,7 @@ They are created in this chart (instead of the config application charts) to: 1. ensure the resources are not deleted by ArgoCD before ArgoCD runs the PostDelete hook jobs that depend on them 2. reduce code and resource duplication - ( NOTE: this is a workaround for the fact it is not currently possible to annotate these types of resource with + ( NOTE: this is a workaround for the fact it is not currently possible to annotate these types of resource with PostDelete due to a bug in ArgoCD: https://github.com/argoproj/argo-cd/issues/17191) and the fact that ArgoCD does not yet support PreDelete hooks: https://github.com/argoproj/argo-cd/issues/13975, either of which would offer a preferable solution to this workaround ) @@ -12,12 +12,15 @@ -{{ $role_name := "postdelete-delete-cr-r" }} -{{ $sa_name := "postdelete-delete-cr-sa" }} -{{ $rb_name := "postdelete-delete-cr-rb" }} -{{ $np_name := "postdelete-delete-cr-np" }} -{{ $job_label := "postdelete-delete-cr-job" }} +{{ $role_name := "postdelete-delete-cr-r" }} +{{ $crole_name := "postdelete-delete-cr-cr" }} +{{ $sa_name := "postdelete-delete-cr-sa" }} +{{ $rb_name := "postdelete-delete-cr-rb" }} +{{ $crb_name := "postdelete-delete-cr-crb" }} +{{ $np_name := "postdelete-delete-cr-np" }} +{{ $job_label := "postdelete-delete-cr-job" }} {{ $ns := printf "mas-%s-core" .Values.instance_id }} +{{ $sls_ns := printf "mas-%s-sls" .Values.instance_id }} --- # Permit outbound communication by the Job pods @@ -82,6 +85,26 @@ rules: - addons.mas.ibm.com resources: - genericaddons + - verbs: + - delete + - get + - list + - patch + - watch + apiGroups: + - core.mas.ibm.com + resources: + - suites + - verbs: + - delete + - get + - list + - patch + - watch + apiGroups: + - sls.ibm.com + resources: + - licenseservices - verbs: - delete - get @@ -140,4 +163,59 @@ roleRef: kind: Role name: {{ $role_name }} +--- +# ClusterRole so the PostDelete SA can delete the LicenseService CR in mas--sls +# (the SA lives in the core namespace; SLS lives in a different namespace) +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ $crole_name }}-{{ .Values.instance_id }} + annotations: + argocd.argoproj.io/sync-wave: "131" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +rules: + - verbs: + - delete + - get + - list + - patch + - watch + apiGroups: + - sls.ibm.com + resources: + - licenseservices + - verbs: + - delete + - get + - list + - patch + - watch + apiGroups: + - core.mas.ibm.com + resources: + - suites + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ $crb_name }}-{{ .Values.instance_id }} + annotations: + argocd.argoproj.io/sync-wave: "132" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +subjects: + - kind: ServiceAccount + name: {{ $sa_name }} + namespace: {{ $ns }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ $crole_name }}-{{ .Values.instance_id }} + {{- end }} diff --git a/instance-applications/130-ibm-mas-suite/templates/08-postdelete-delete-suite-cr.yaml b/instance-applications/130-ibm-mas-suite/templates/08-postdelete-delete-suite-cr.yaml new file mode 100644 index 000000000..5eea7cab4 --- /dev/null +++ b/instance-applications/130-ibm-mas-suite/templates/08-postdelete-delete-suite-cr.yaml @@ -0,0 +1,119 @@ +{{- if .Values.application_admin_role }} +{{- if .Values.use_postdelete_hooks }} + +{{- /* +PostDelete job: force-deletes the Suite CR (core.mas.ibm.com/v1 Suite) after the ArgoCD +Application is removed. + +The MAS core operator holds a finalizer on the Suite CR that orchestrates teardown of +core components. If the operator is Degraded/Progressing at deprovisioning time, the +finalizer will never be released automatically — this job patches it out so Kubernetes +can complete deletion regardless of operator health state. + +Depends on SA/Role/NetworkPolicy created in this same chart (01-postdelete-crs-resources.yaml). +The Suite CR lives in the same core namespace as those resources. + +Use the build/bin/set-cli-image-digest.sh script to update the image digest below. +*/}} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} + +{{- $core_ns := printf "mas-%s-core" .Values.instance_id }} +{{- $cr_name := .Values.instance_id }} +{{- $job_name := printf "postdelete-suite-cr-%s" ($cr_name | trunc 48) }} + +{{ $sa_name := "postdelete-delete-cr-sa" }} +{{ $job_label := "postdelete-delete-cr-job" }} + +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ $job_name }} + namespace: {{ $core_ns }} + annotations: + argocd.argoproj.io/hook: PostDelete + argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + template: + metadata: + labels: + app: {{ $job_label }} +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 8 }} +{{- end }} + spec: + serviceAccountName: {{ $sa_name }} + restartPolicy: Never + containers: + - name: run + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} + imagePullPolicy: IfNotPresent + resources: + limits: + cpu: 200m + memory: 512Mi + requests: + cpu: 10m + memory: 64Mi + env: + - name: CR_NAMESPACE + value: {{ $core_ns }} + - name: CR_NAME + value: {{ $cr_name }} + volumeMounts: [] + command: + - /bin/sh + - -c + - | + set -e + echo "------------------------------------------------------------------" + echo "PostDelete: Suite.core.mas.ibm.com/${CR_NAME} in ${CR_NAMESPACE}" + + set +e + RESOURCE_NAME=$(oc get suite.core.mas.ibm.com/${CR_NAME} \ + -n ${CR_NAMESPACE} -o=jsonpath="{.metadata.name}" 2>/dev/null) + set -e + + if [[ -z "${RESOURCE_NAME}" ]]; then + echo "Suite CR not found — nothing to do" + exit 0 + fi + + echo "Current finalizers:" + oc get suite.core.mas.ibm.com/${CR_NAME} -n ${CR_NAMESPACE} \ + -o=jsonpath="{.metadata.finalizers}" 2>/dev/null || true + echo "" + + # Force-clear operator finalizers so deletion completes + # even if the MAS core operator is Degraded or Progressing + echo "Patching out finalizers..." + set +e + oc patch suite.core.mas.ibm.com/${CR_NAME} -n ${CR_NAMESPACE} \ + --type=merge -p '{"metadata":{"finalizers":[]}}' 2>/dev/null + set -e + + echo "Deleting Suite CR..." + set +e + oc delete suite.core.mas.ibm.com/${CR_NAME} \ + -n ${CR_NAMESPACE} --timeout=120s --wait=true 2>/dev/null + set -e + + # Verify gone + set +e + RESOURCE_NAME=$(oc get suite.core.mas.ibm.com/${CR_NAME} \ + -n ${CR_NAMESPACE} -o=jsonpath="{.metadata.name}" 2>/dev/null) + set -e + + if [[ -n "${RESOURCE_NAME}" ]]; then + echo "ERROR: Suite CR still present after delete attempt" + exit 1 + fi + echo "Suite CR deleted successfully" + volumes: [] + backoffLimit: 4 +{{- end }} +{{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml b/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml index e1d364f59..16c09e56d 100644 --- a/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml @@ -30,6 +30,8 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup spec: ignoreDifferences: - group: '*' @@ -57,6 +59,7 @@ spec: argo_namespace: "{{ .Values.argo.namespace }}" cluster_admin_role: {{ .Values.cluster_admin_role }} application_admin_role: {{ .Values.application_admin_role }} + use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" run_sync_hooks: {{.Values.ibm_sls.run_sync_hooks }} diff --git a/root-applications/ibm-mas-instance-root/templates/130-ibm-mas-suite-app.yaml b/root-applications/ibm-mas-instance-root/templates/130-ibm-mas-suite-app.yaml index b5df6690b..5aa16316b 100644 --- a/root-applications/ibm-mas-instance-root/templates/130-ibm-mas-suite-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/130-ibm-mas-suite-app.yaml @@ -27,6 +27,8 @@ metadata: argocd.argoproj.io/sync-options: PruneLast=true finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -50,6 +52,7 @@ spec: sm_aws_region: "{{ .Values.region.id }}" cluster_admin_role: {{ .Values.cluster_admin_role }} application_admin_role: {{ .Values.application_admin_role }} + use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_workspace_id: "{{ .Values.ibm_mas_suite.mas_workspace_id }}" mas_domain: "{{ .Values.ibm_mas_suite.mas_domain }}" mas_config_dir: "{{ .Values.ibm_mas_suite.mas_config_dir }}" diff --git a/root-applications/ibm-mas-instance-root/templates/500-ibm-mas-masapp-manage-install.yaml b/root-applications/ibm-mas-instance-root/templates/500-ibm-mas-masapp-manage-install.yaml index 9326ae3a5..1ec0b1a8f 100644 --- a/root-applications/ibm-mas-instance-root/templates/500-ibm-mas-masapp-manage-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/500-ibm-mas-masapp-manage-install.yaml @@ -23,6 +23,8 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -62,6 +64,7 @@ spec: tls_key: | {{ .Values.ibm_suite_app_manage_install.tls_key }} {{- end }} + use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_app_spec: {{ .Values.ibm_suite_app_manage_install.mas_app_spec | toYaml | nindent 14 }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} diff --git a/root-applications/ibm-mas-instance-root/templates/505-ibm-mas-masapp-facilities-install.yaml b/root-applications/ibm-mas-instance-root/templates/505-ibm-mas-masapp-facilities-install.yaml index 0bcce1153..9b9683cb8 100644 --- a/root-applications/ibm-mas-instance-root/templates/505-ibm-mas-masapp-facilities-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/505-ibm-mas-masapp-facilities-install.yaml @@ -23,6 +23,8 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -62,6 +64,7 @@ spec: tls_key: | {{ .Values.ibm_suite_app_facilities_install.tls_key }} {{- end }} + use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-assist-install.yaml b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-assist-install.yaml index 6f13fd6f5..af22154d0 100644 --- a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-assist-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-assist-install.yaml @@ -23,6 +23,8 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -62,6 +64,7 @@ spec: tls_key: | {{ .Values.ibm_suite_app_assist_install.tls_key }} {{- end }} + use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-iot-install.yaml b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-iot-install.yaml index 32b160caf..5d36439dc 100644 --- a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-iot-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-iot-install.yaml @@ -38,6 +38,8 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -77,6 +79,7 @@ spec: tls_key: | {{ .Values.ibm_suite_app_iot_install.tls_key }} {{- end }} + use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_app_spec: {{ .Values.ibm_suite_app_iot_install.mas_app_spec | toYaml | nindent 14 }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} diff --git a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-health-install.yaml b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-health-install.yaml index f6c65862a..409d1592b 100644 --- a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-health-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-health-install.yaml @@ -23,6 +23,8 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -62,6 +64,7 @@ spec: tls_key: | {{ .Values.ibm_suite_app_health_install.tls_key }} {{- end }} + use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_app_spec: {{ .Values.ibm_suite_app_health_install.mas_app_spec | toYaml | nindent 14 }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} diff --git a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-monitor-install.yaml b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-monitor-install.yaml index ff75b7346..21bdb834f 100644 --- a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-monitor-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-monitor-install.yaml @@ -38,6 +38,8 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -77,6 +79,7 @@ spec: tls_key: | {{ .Values.ibm_suite_app_monitor_install.tls_key }} {{- end }} + use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_app_spec: {{ .Values.ibm_suite_app_monitor_install.mas_app_spec | toYaml | nindent 14 }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} diff --git a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-optimizer-install.yaml b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-optimizer-install.yaml index ddfd2995c..d49bb7a7a 100644 --- a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-optimizer-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-optimizer-install.yaml @@ -23,6 +23,8 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -62,6 +64,7 @@ spec: tls_key: | {{ .Values.ibm_suite_app_optimizer_install.tls_key }} {{- end }} + use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_app_spec: {{ .Values.ibm_suite_app_optimizer_install.mas_app_spec | toYaml | nindent 14 }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} diff --git a/root-applications/ibm-mas-instance-root/templates/540-ibm-mas-masapp-predict-install.yaml b/root-applications/ibm-mas-instance-root/templates/540-ibm-mas-masapp-predict-install.yaml index 746a1e85c..930f3f7b2 100644 --- a/root-applications/ibm-mas-instance-root/templates/540-ibm-mas-masapp-predict-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/540-ibm-mas-masapp-predict-install.yaml @@ -23,6 +23,8 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -62,6 +64,7 @@ spec: tls_key: | {{ .Values.ibm_suite_app_predict_install.tls_key }} {{- end }} + use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_app_spec: {{ .Values.ibm_suite_app_predict_install.mas_app_spec | toYaml | nindent 14 }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} From 815eab682bce070fed1a066cab2236bb806e2aef Mon Sep 17 00:00:00 2001 From: Abhirup Choudhury Date: Wed, 2 Sep 2026 12:28:52 +0530 Subject: [PATCH 106/115] update --- ...8-postdelete-delete-licenseservice-cr.yaml | 114 ------------------ .../01-postdelete-crs-resources.yaml | 78 +----------- .../08-postdelete-delete-suite-cr.yaml | 7 +- .../templates/100-ibm-sls-app.yaml | 3 - .../500-ibm-mas-masapp-manage-install.yaml | 3 - ...505-ibm-mas-masapp-facilities-install.yaml | 3 - .../510-ibm-mas-masapp-assist-install.yaml | 3 - .../510-ibm-mas-masapp-iot-install.yaml | 3 - .../520-ibm-mas-masapp-health-install.yaml | 3 - .../520-ibm-mas-masapp-monitor-install.yaml | 3 - .../520-ibm-mas-masapp-optimizer-install.yaml | 3 - .../540-ibm-mas-masapp-predict-install.yaml | 3 - 12 files changed, 7 insertions(+), 219 deletions(-) delete mode 100644 instance-applications/100-ibm-sls/templates/08-postdelete-delete-licenseservice-cr.yaml diff --git a/instance-applications/100-ibm-sls/templates/08-postdelete-delete-licenseservice-cr.yaml b/instance-applications/100-ibm-sls/templates/08-postdelete-delete-licenseservice-cr.yaml deleted file mode 100644 index 9237353d4..000000000 --- a/instance-applications/100-ibm-sls/templates/08-postdelete-delete-licenseservice-cr.yaml +++ /dev/null @@ -1,114 +0,0 @@ -{{- if .Values.application_admin_role }} -{{- if .Values.use_postdelete_hooks }} - -{{- /* -PostDelete job: force-deletes the SLS LicenseService CR (sls.ibm.com/v1 LicenseService) -after the ArgoCD Application is removed. - -The SLS operator holds a finalizer on the LicenseService CR. If the operator is -Degraded or not running at deprovisioning time, the finalizer blocks deletion. -This job patches it out unconditionally so cleanup always completes. - -LicenseService CR name is always "sls" in namespace mas--sls. - -Use the build/bin/set-cli-image-digest.sh script to update the image digest below. -*/}} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} - -{{- $sls_ns := printf "mas-%s-sls" .Values.instance_id }} -{{- $core_ns := printf "mas-%s-core" .Values.instance_id }} -{{- $job_name := "postdelete-sls-licenseservice-cr" }} - -{{ $sa_name := "postdelete-delete-cr-sa" }} -{{ $job_label := "postdelete-delete-cr-job" }} - ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $job_name }} - namespace: {{ $core_ns }} - annotations: - argocd.argoproj.io/hook: PostDelete - argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - template: - metadata: - labels: - app: {{ $job_label }} -{{- if .Values.custom_labels }} -{{ .Values.custom_labels | toYaml | indent 8 }} -{{- end }} - spec: - serviceAccountName: {{ $sa_name }} - restartPolicy: Never - containers: - - name: run - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} - imagePullPolicy: IfNotPresent - resources: - limits: - cpu: 200m - memory: 512Mi - requests: - cpu: 10m - memory: 64Mi - env: - - name: SLS_NAMESPACE - value: {{ $sls_ns }} - volumeMounts: [] - command: - - /bin/sh - - -c - - | - set -e - echo "------------------------------------------------------------------" - echo "PostDelete: LicenseService.sls.ibm.com/sls in ${SLS_NAMESPACE}" - - set +e - RESOURCE_NAME=$(oc get licenseservice.sls.ibm.com/sls \ - -n ${SLS_NAMESPACE} -o=jsonpath="{.metadata.name}" 2>/dev/null) - set -e - - if [[ -z "${RESOURCE_NAME}" ]]; then - echo "LicenseService CR not found — nothing to do" - exit 0 - fi - - echo "Current finalizers:" - oc get licenseservice.sls.ibm.com/sls -n ${SLS_NAMESPACE} \ - -o=jsonpath="{.metadata.finalizers}" 2>/dev/null || true - echo "" - - # Patch out operator finalizers — works even if SLS operator is not running - echo "Patching out finalizers..." - set +e - oc patch licenseservice.sls.ibm.com/sls -n ${SLS_NAMESPACE} \ - --type=merge -p '{"metadata":{"finalizers":[]}}' 2>/dev/null - set -e - - echo "Deleting LicenseService CR..." - set +e - oc delete licenseservice.sls.ibm.com/sls \ - -n ${SLS_NAMESPACE} --timeout=120s --wait=true 2>/dev/null - set -e - - # Verify gone - set +e - RESOURCE_NAME=$(oc get licenseservice.sls.ibm.com/sls \ - -n ${SLS_NAMESPACE} -o=jsonpath="{.metadata.name}" 2>/dev/null) - set -e - - if [[ -n "${RESOURCE_NAME}" ]]; then - echo "ERROR: LicenseService CR still present after delete attempt" - exit 1 - fi - echo "LicenseService CR deleted successfully" - volumes: [] - backoffLimit: 4 -{{- end }} -{{- end }} diff --git a/instance-applications/130-ibm-mas-suite/templates/01-postdelete-crs-resources.yaml b/instance-applications/130-ibm-mas-suite/templates/01-postdelete-crs-resources.yaml index 983c5df6a..07fe71531 100644 --- a/instance-applications/130-ibm-mas-suite/templates/01-postdelete-crs-resources.yaml +++ b/instance-applications/130-ibm-mas-suite/templates/01-postdelete-crs-resources.yaml @@ -12,15 +12,12 @@ -{{ $role_name := "postdelete-delete-cr-r" }} -{{ $crole_name := "postdelete-delete-cr-cr" }} -{{ $sa_name := "postdelete-delete-cr-sa" }} -{{ $rb_name := "postdelete-delete-cr-rb" }} -{{ $crb_name := "postdelete-delete-cr-crb" }} -{{ $np_name := "postdelete-delete-cr-np" }} -{{ $job_label := "postdelete-delete-cr-job" }} +{{ $role_name := "postdelete-delete-cr-r" }} +{{ $sa_name := "postdelete-delete-cr-sa" }} +{{ $rb_name := "postdelete-delete-cr-rb" }} +{{ $np_name := "postdelete-delete-cr-np" }} +{{ $job_label := "postdelete-delete-cr-job" }} {{ $ns := printf "mas-%s-core" .Values.instance_id }} -{{ $sls_ns := printf "mas-%s-sls" .Values.instance_id }} --- # Permit outbound communication by the Job pods @@ -95,16 +92,6 @@ rules: - core.mas.ibm.com resources: - suites - - verbs: - - delete - - get - - list - - patch - - watch - apiGroups: - - sls.ibm.com - resources: - - licenseservices - verbs: - delete - get @@ -163,59 +150,4 @@ roleRef: kind: Role name: {{ $role_name }} ---- -# ClusterRole so the PostDelete SA can delete the LicenseService CR in mas--sls -# (the SA lives in the core namespace; SLS lives in a different namespace) -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ $crole_name }}-{{ .Values.instance_id }} - annotations: - argocd.argoproj.io/sync-wave: "131" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -rules: - - verbs: - - delete - - get - - list - - patch - - watch - apiGroups: - - sls.ibm.com - resources: - - licenseservices - - verbs: - - delete - - get - - list - - patch - - watch - apiGroups: - - core.mas.ibm.com - resources: - - suites - ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ $crb_name }}-{{ .Values.instance_id }} - annotations: - argocd.argoproj.io/sync-wave: "132" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -subjects: - - kind: ServiceAccount - name: {{ $sa_name }} - namespace: {{ $ns }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ $crole_name }}-{{ .Values.instance_id }} - {{- end }} diff --git a/instance-applications/130-ibm-mas-suite/templates/08-postdelete-delete-suite-cr.yaml b/instance-applications/130-ibm-mas-suite/templates/08-postdelete-delete-suite-cr.yaml index 5eea7cab4..75bab345b 100644 --- a/instance-applications/130-ibm-mas-suite/templates/08-postdelete-delete-suite-cr.yaml +++ b/instance-applications/130-ibm-mas-suite/templates/08-postdelete-delete-suite-cr.yaml @@ -10,8 +10,8 @@ core components. If the operator is Degraded/Progressing at deprovisioning time, finalizer will never be released automatically — this job patches it out so Kubernetes can complete deletion regardless of operator health state. -Depends on SA/Role/NetworkPolicy created in this same chart (01-postdelete-crs-resources.yaml). -The Suite CR lives in the same core namespace as those resources. +The Suite CR lives in mas--core — the same namespace as the SA and Role +created in 01-postdelete-crs-resources.yaml. No ClusterRole is required. Use the build/bin/set-cli-image-digest.sh script to update the image digest below. */}} @@ -88,8 +88,6 @@ spec: -o=jsonpath="{.metadata.finalizers}" 2>/dev/null || true echo "" - # Force-clear operator finalizers so deletion completes - # even if the MAS core operator is Degraded or Progressing echo "Patching out finalizers..." set +e oc patch suite.core.mas.ibm.com/${CR_NAME} -n ${CR_NAMESPACE} \ @@ -102,7 +100,6 @@ spec: -n ${CR_NAMESPACE} --timeout=120s --wait=true 2>/dev/null set -e - # Verify gone set +e RESOURCE_NAME=$(oc get suite.core.mas.ibm.com/${CR_NAME} \ -n ${CR_NAMESPACE} -o=jsonpath="{.metadata.name}" 2>/dev/null) diff --git a/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml b/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml index 16c09e56d..e1d364f59 100644 --- a/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml @@ -30,8 +30,6 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io/cleanup spec: ignoreDifferences: - group: '*' @@ -59,7 +57,6 @@ spec: argo_namespace: "{{ .Values.argo.namespace }}" cluster_admin_role: {{ .Values.cluster_admin_role }} application_admin_role: {{ .Values.application_admin_role }} - use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" run_sync_hooks: {{.Values.ibm_sls.run_sync_hooks }} diff --git a/root-applications/ibm-mas-instance-root/templates/500-ibm-mas-masapp-manage-install.yaml b/root-applications/ibm-mas-instance-root/templates/500-ibm-mas-masapp-manage-install.yaml index 1ec0b1a8f..9326ae3a5 100644 --- a/root-applications/ibm-mas-instance-root/templates/500-ibm-mas-masapp-manage-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/500-ibm-mas-masapp-manage-install.yaml @@ -23,8 +23,6 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -64,7 +62,6 @@ spec: tls_key: | {{ .Values.ibm_suite_app_manage_install.tls_key }} {{- end }} - use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_app_spec: {{ .Values.ibm_suite_app_manage_install.mas_app_spec | toYaml | nindent 14 }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} diff --git a/root-applications/ibm-mas-instance-root/templates/505-ibm-mas-masapp-facilities-install.yaml b/root-applications/ibm-mas-instance-root/templates/505-ibm-mas-masapp-facilities-install.yaml index 9b9683cb8..0bcce1153 100644 --- a/root-applications/ibm-mas-instance-root/templates/505-ibm-mas-masapp-facilities-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/505-ibm-mas-masapp-facilities-install.yaml @@ -23,8 +23,6 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -64,7 +62,6 @@ spec: tls_key: | {{ .Values.ibm_suite_app_facilities_install.tls_key }} {{- end }} - use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-assist-install.yaml b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-assist-install.yaml index af22154d0..6f13fd6f5 100644 --- a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-assist-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-assist-install.yaml @@ -23,8 +23,6 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -64,7 +62,6 @@ spec: tls_key: | {{ .Values.ibm_suite_app_assist_install.tls_key }} {{- end }} - use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-iot-install.yaml b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-iot-install.yaml index 5d36439dc..32b160caf 100644 --- a/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-iot-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/510-ibm-mas-masapp-iot-install.yaml @@ -38,8 +38,6 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -79,7 +77,6 @@ spec: tls_key: | {{ .Values.ibm_suite_app_iot_install.tls_key }} {{- end }} - use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_app_spec: {{ .Values.ibm_suite_app_iot_install.mas_app_spec | toYaml | nindent 14 }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} diff --git a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-health-install.yaml b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-health-install.yaml index 409d1592b..f6c65862a 100644 --- a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-health-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-health-install.yaml @@ -23,8 +23,6 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -64,7 +62,6 @@ spec: tls_key: | {{ .Values.ibm_suite_app_health_install.tls_key }} {{- end }} - use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_app_spec: {{ .Values.ibm_suite_app_health_install.mas_app_spec | toYaml | nindent 14 }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} diff --git a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-monitor-install.yaml b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-monitor-install.yaml index 21bdb834f..ff75b7346 100644 --- a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-monitor-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-monitor-install.yaml @@ -38,8 +38,6 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -79,7 +77,6 @@ spec: tls_key: | {{ .Values.ibm_suite_app_monitor_install.tls_key }} {{- end }} - use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_app_spec: {{ .Values.ibm_suite_app_monitor_install.mas_app_spec | toYaml | nindent 14 }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} diff --git a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-optimizer-install.yaml b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-optimizer-install.yaml index d49bb7a7a..ddfd2995c 100644 --- a/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-optimizer-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/520-ibm-mas-masapp-optimizer-install.yaml @@ -23,8 +23,6 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -64,7 +62,6 @@ spec: tls_key: | {{ .Values.ibm_suite_app_optimizer_install.tls_key }} {{- end }} - use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_app_spec: {{ .Values.ibm_suite_app_optimizer_install.mas_app_spec | toYaml | nindent 14 }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} diff --git a/root-applications/ibm-mas-instance-root/templates/540-ibm-mas-masapp-predict-install.yaml b/root-applications/ibm-mas-instance-root/templates/540-ibm-mas-masapp-predict-install.yaml index 930f3f7b2..746a1e85c 100644 --- a/root-applications/ibm-mas-instance-root/templates/540-ibm-mas-masapp-predict-install.yaml +++ b/root-applications/ibm-mas-instance-root/templates/540-ibm-mas-masapp-predict-install.yaml @@ -23,8 +23,6 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io/cleanup spec: project: "{{ .Values.argo.projects.apps }}" destination: @@ -64,7 +62,6 @@ spec: tls_key: | {{ .Values.ibm_suite_app_predict_install.tls_key }} {{- end }} - use_postdelete_hooks: {{ .Values.use_postdelete_hooks | default true }} mas_app_spec: {{ .Values.ibm_suite_app_predict_install.mas_app_spec | toYaml | nindent 14 }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} From 283763fe8bc1c98d4cd5dc0e619b7c2faa35e236 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Wed, 2 Sep 2026 23:46:18 +0530 Subject: [PATCH 107/115] dummy commit for MASCORE-10022 --- ...ped-implementation-exact-code-changes.html | 347 ++++++++++++++++++ ...7-changes-after-rob-s-review-comments.html | 184 ++++++++++ .../templates/07-postsync-setup-db2_Job.yaml | 28 +- .../120-ibm-db2u-database/values.yaml | 1 + .../templates/00-configmap.yaml | 5 +- .../templates/01-dbs-rds-postsync-setup.yaml | 4 +- .../120-ibm-dbs-rds-database/values.yaml | 5 + .../templates/703-postsync-rds-app-roles.yaml | 36 +- .../values.yaml | 3 + mascore-15507-full-change-summary.html | 295 +++++++++++++++ watch_20260826-114330 | 71 ++++ watch_20260826-152105 | 71 ++++ 12 files changed, 1014 insertions(+), 36 deletions(-) create mode 100644 .bob/artifacts/cluster-scoped-implementation-exact-code-changes.html create mode 100644 .bob/artifacts/mascore-15507-changes-after-rob-s-review-comments.html create mode 100644 mascore-15507-full-change-summary.html create mode 100644 watch_20260826-114330 create mode 100644 watch_20260826-152105 diff --git a/.bob/artifacts/cluster-scoped-implementation-exact-code-changes.html b/.bob/artifacts/cluster-scoped-implementation-exact-code-changes.html new file mode 100644 index 000000000..ff2cdb3ae --- /dev/null +++ b/.bob/artifacts/cluster-scoped-implementation-exact-code-changes.html @@ -0,0 +1,347 @@ + + + + + +Cluster-Scoped Implementation — Exact Code Changes + + + +
+ +

Cluster-Scoped Implementation — Exact Code Changes

+
Rob's Comment #1: "We should not be using cluster-scoped deploys for this. The resources created will then become managed by multiple deploys."  ·  Branch: MASCORE-15507
+ + +

The Problem (Before)

+

The old approach ran helm template ... | oc apply -f - inside a K8s Job pod. This applied CRDs and ClusterRoles with no owner reference. Any instance deploying the same chart would overwrite those resources, and ArgoCD had no record of who owned them.

+ +
+
+
Old approach (inside K8s Job)
+ 1. Job pod starts
+ 2. helm repo add ibm-charts ...
+ 3. helm template wml-cluster-scoped | oc apply -f -
+ 4. CRDs/ClusterRoles applied — no owner, no SSA manager
+ 5. helm upgrade --install wml ...
+ 6. Job completes and is deleted +
+
→
+
+
New approach (native ArgoCD App)
+ 1. ArgoCD renders wml-cluster.noble10.inst02 Application
+ 2. ArgoCD runs helm template wml-cluster-scoped internally
+ 3. Resources applied via SSA with field manager = ArgoCD app name
+ 4. Ownership tracked forever — ArgoCD diffs on every sync
+ 5. Second instance gets its own app: wml-cluster.noble10.inst02b
+ 6. SSA manager prevents conflicts +
+
+ +
+ + +

File 1 — Removed: cpd-sa ClusterRole & ClusterRoleBinding

+
instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml
+ +
+
Why this was removed
+ The cpd-sa-helm-cluster-role was a massive ClusterRole created specifically to give the K8s Job's service account (cpd-sa) permission to apply CRDs and ClusterRoles via helm template | oc apply. Once the K8s Job is gone, this ClusterRole has no purpose. ArgoCD uses its own service account with cluster-admin permissions — no extra RBAC needed. +
+ +
+
02-ibm-cp4d_rbac.yaml — lines 1527–1669 (removed)
+
{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version ...).Compare) 0) }}
+
kind: ClusterRole
+
apiVersion: rbac.authorization.k8s.io/v1
+
metadata:
+
name: "cpd-sa-helm-cluster-role-{{ .Values.instance_id }}"
+
rules:
+
# CRD management (create, update, patch, delete)
+
- verbs: [get, list, create, update, patch, delete]
+
apiGroups: [apiextensions.k8s.io]
+
resources: [customresourcedefinitions]
+
# ClusterRole/Binding with escalate
+
- verbs: [get, list, create, update, patch, delete, bind, escalate]
+
apiGroups: [rbac.authorization.k8s.io]
+
resources: [clusterroles, clusterrolebindings]
+
# ... 60 more lines of rules ...
+
---
+
kind: ClusterRoleBinding
+
metadata:
+
name: "cpd-sa-helm-cluster-rb-{{ .Values.instance_id }}"
+
subjects:
+
- kind: ServiceAccount
+
name: cpd-sa
+
namespace: "{{ .Values.cpd_operators_namespace }}"
+
{{- end }}
+
+ +
Result: 140 lines deleted. No more privileged cpd-sa ClusterRole. Security posture improved — least privilege.
+ +
+ + +

File 2 — WML: Job removed, 4 ArgoCD Apps added

+
instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml  (Job removed)
+
root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml  (Apps added)
+ +

What was removed from 02-ibm-wml-cr.yaml

+
+
Removed — lines 26–136 (the entire ≥5.3.1 else block)
+ A K8s Job (kind: batch/v1) that ran a shell script inside a quay.io/ibmmas/cli pod. The script did: +
    +
  1. helm repo add ibm-charts ...
    2. +
  2. helm template ibm-redis-cp-cluster-scoped | oc apply -f - (cluster-scoped, no owner)
    3. +
  3. While loop polling CRD establishment (manual, fragile)
    4. +
  4. helm upgrade --install ibm-redis-cp ...
    5. +
  5. helm template wml-cluster-scoped | oc apply -f - (cluster-scoped, no owner)
    6. +
  6. While loop polling CRD again
    7. +
  7. helm upgrade --install wml ... --wait --timeout 60m
    8. +
+
+ +
+
02-ibm-wml-cr.yaml — the else block that was removed
+
{{- if lt (semver "5.3.1" ...) }} ← OLM path kept
+
... WmlBase CR for < 5.3.1 ...
+
{{- else }}
+
apiVersion: batch/v1
+
kind: Job
+
metadata:
+
name: install-wml-helm-<hash>
+
annotations:
+
argocd.argoproj.io/hook: Sync
+
argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed
+
spec:
+
template:
+
spec:
+
serviceAccountName: cpd-sa ← needed the ClusterRole above
+
containers:
+
- name: helm-install
+
command: [/bin/sh, -c, |
+
helm repo add ibm-charts ...
+
helm template ibm-redis-cp-cluster-scoped | oc apply -f -
+
while true; do ← manual CRD poll loop
+
STATUS=$(oc get crd rediscps.redis.ibm.com ...)
+
done
+
helm upgrade --install ibm-redis-cp ...
+
helm template wml-cluster-scoped | oc apply -f -
+
while true; do ← another manual poll loop
+
done
+
helm upgrade --install wml ... --wait --timeout 60m]
+
{{- end }}
+
+ +

What was added to 120-ibm-wml-app.yaml

+ +
+
Added — version gate + 4 native ArgoCD Helm Applications
+ Instead of one Job doing everything sequentially, 4 separate ArgoCD Application objects are added — each deploying exactly one Helm chart with ArgoCD as the Helm engine. Wave ordering replaces the manual shell polling loops. +
+ +
+
120-ibm-wml-app.yaml — version gate added at top of $is531 block
+
{{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }}
+
{{- $meta := dict }}
+
{{- if $olmUtils }}
+
{{- $meta = $olmUtils.data.release_components_meta | fromYaml }}
+
{{- end }}
+
{{- $redisVersion := .Values.ibm_wml.redis_chart_version | default ((index $meta "ibm_redis_cp" | default dict).case_version | default "1.3.1") }}
+
{{- $wmlVersion := .Values.ibm_wml.wml_chart_version | default ((index $meta "wml" | default dict).case_version | default "12.1.0") }}
+
+ +
Why the lookup? CPD stores the correct chart version for each service in the olm-utils-cm ConfigMap (key: release_components_meta). Reading it at render time means the version auto-updates when CPD is upgraded — no hardcoded versions in git.
+ +
+
App 1 of 4 — wml-redis-cluster (wave 119, cluster-scoped)
+
---
+
# Wave 119: ibm-redis-cp cluster-scoped (CRDs + ClusterRoles)
+
apiVersion: argoproj.io/v1alpha1
+
kind: Application
+
metadata:
+
name: wml-redis-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }}
+
annotations:
+
argocd.argoproj.io/sync-wave: "119" ← fires BEFORE namespace-scoped
+
spec:
+
destination:
+
namespace: {{ $cpd_operators_ns }} ← operators namespace
+
source:
+
chart: ibm-redis-cp-cluster-scoped ← CLUSTER-SCOPED chart only
+
repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm
+
targetRevision: "{{ $redisVersion }}" ← from olm-utils-cm
+
helm:
+
valuesObject:
+
global:
+
licenseAccept: true
+
operatorNamespace: {{ $cpd_operators_ns }}
+
instanceNamespace: {{ $cpd_instance_ns }}
+
imagePullSecret: ibm-entitlement-key
+
syncPolicy:
+
syncOptions:
+
- SkipDryRunOnMissingResource=true ← handles CRDs not yet existing
+
+ +
+
App 2 of 4 — wml-redis (wave 120, namespace-scoped operator)
+
---
+
# Wave 120: ibm-redis-cp namespace-scoped (operator)
+
apiVersion: argoproj.io/v1alpha1
+
kind: Application
+
metadata:
+
name: wml-redis.{{ .Values.cluster.id }}.{{ .Values.instance.id }}
+
annotations:
+
argocd.argoproj.io/sync-wave: "120" ← fires AFTER cluster-scoped at 119
+
spec:
+
source:
+
chart: ibm-redis-cp ← NAMESPACE-SCOPED chart
+
repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm
+
targetRevision: "{{ $redisVersion }}"
+
+ +
+
App 3 of 4 — wml-cluster (wave 121, cluster-scoped WML CRDs)
+
---
+
# Wave 121: WML cluster-scoped (CRDs + ClusterRoles)
+
apiVersion: argoproj.io/v1alpha1
+
kind: Application
+
metadata:
+
name: wml-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }}
+
annotations:
+
argocd.argoproj.io/sync-wave: "121"
+
source:
+
chart: wml-cluster-scoped
+
repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm
+
targetRevision: "{{ $wmlVersion }}"
+
+ +
+
App 4 of 4 — wml (wave 122, namespace-scoped operator + WmlBase CR)
+
---
+
# Wave 122: WML namespace-scoped (operator + WmlBase CR)
+
apiVersion: argoproj.io/v1alpha1
+
kind: Application
+
metadata:
+
name: wml.{{ .Values.cluster.id }}.{{ .Values.instance.id }}
+
annotations:
+
argocd.argoproj.io/sync-wave: "122" ← fires AFTER wml-cluster at 121
+
spec:
+
destination:
+
namespace: {{ $cpd_instance_ns }} ← INSTANCE namespace (not operators)
+
source:
+
chart: wml ← full operator + WmlBase CR
+
helm:
+
valuesObject:
+
wml:
+
scaleConfig: {{ .Values.ibm_wml.cpd_service_scale_config }}
+
+ +
+ + +

Same Pattern Applied to All 4 Other Services

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ServiceJob removed fromApps added to root templateCluster-scoped chartsNamespace-scoped charts
Spark120-ibm-spark/templates/01-ibm-spark-cr.yaml
−78 lines		120-ibm-spark-app.yamlanalyticsengine-cluster-scoped (wave 119)analyticsengine (wave 120)
SPSS120-ibm-spss/templates/01-ibm-spss-cr.yaml
−120 lines		120-ibm-spss-app.yamlcanvasbase-cluster-scoped (wave 119)
spss-cluster-scoped (wave 121)		canvasbase (wave 120)
spss (wave 125 — after WSL)
WSL120-ibm-wsl/templates/01-ibm-wsl-cr.yaml
−222 lines		120-ibm-wsl-app.yamlopencontent-opensearch-cluster-scoped (115)
ccs-cluster-scoped (117)
datarefinery-cluster-scoped (118)
ws-runtimes-cluster-scoped (119 via wsl-ws-runtimes-cluster)
ws-cluster-scoped (119 via wsl-cluster)		opencontent-opensearch (116)
ccs (120)
datarefinery (120)
ws-runtimes (122)
ws (124)
Cognos01-ibm-cognos-analytics-cr.yaml
−80 lines (Job block)		120-ibm-cognos-analytics-app.yamlca-cluster-scoped (wave 119)ca (wave 120)
+ +
+ + +

Why Server-Side Apply Solves the Ownership Conflict

+ +
+
The key difference
+

When ArgoCD applies a cluster-scoped resource (e.g. CustomResourceDefinition/wml.cpd.ibm.com) via SSA, it sets a field manager on every field it owns. The field manager name is the ArgoCD Application name — e.g. wml-cluster.noble10.inst02.

+

If a second instance (inst02b) deploys wml-cluster.noble10.inst02b, it gets its own field manager on the same CRD object. The fields they both set are identical (it's the same chart), so SSA merges them cleanly — no conflict, no overwrite, no data loss.

+

With the old helm template | oc apply -f - approach, the kubectl apply used the last-applied-configuration annotation — the second instance would simply overwrite whatever the first had set, potentially stripping fields the first instance had added.

+
+ + + + + + + + +
Old: helm template | oc applyNew: ArgoCD SSA
CRD ownerNone — annotation-basedSSA field manager per ArgoCD app
Multi-instance conflictSecond install overwrites firstManaged separately, no conflict
Drift detectionNone after Job completesEvery ArgoCD sync cycle
Version upgradeManual re-run of JobAuto-sync when targetRevision changes
Permissions neededcpd-sa ClusterRole (broad)ArgoCD SA (already cluster-admin)
+ +
Made with IBM Bob
+
+ + diff --git a/.bob/artifacts/mascore-15507-changes-after-rob-s-review-comments.html b/.bob/artifacts/mascore-15507-changes-after-rob-s-review-comments.html new file mode 100644 index 000000000..d875b943b --- /dev/null +++ b/.bob/artifacts/mascore-15507-changes-after-rob-s-review-comments.html @@ -0,0 +1,184 @@ + + + + + +MASCORE-15507 — Changes After Rob's Review + + + +
+ +

MASCORE-15507: CPD 5.3.1 GitOps Support

+
Changes implemented after Rob's review comments  ·  Branch: MASCORE-15507  ·  16 commits after merge from main (a33e3a35)
+ +
+
+2,064
lines added
+
−811
lines removed
+
22
files changed
+
16
commits
+
+ +
+ +

Rob Comment #1 — Cluster-scoped ownership conflict

+
+
Rob's comment
+ "We should not be using cluster-scoped deploys for this. The resources created will then become managed by multiple deploys of this." +
+
+
What was done ✅
+ Each cluster-scoped chart (CRDs + ClusterRoles) is now its own dedicated ArgoCD Application with a unique name per cluster/instance. ArgoCD's Server-Side Apply (SSA) field manager ensures only one app owns each cluster-scoped resource — no conflicts between instances. +
+

Each service now has a cluster-scoped app (CRDs) and a namespace-scoped app (operator + CR). Example for WML:

+ + + + + + +
ArgoCD AppHelm ChartScope
wml-redis-cluster.noble10.inst02ibm-redis-cp-cluster-scopedCluster (CRDs)
wml-redis.noble10.inst02ibm-redis-cpNamespace (operator)
wml-cluster.noble10.inst02wml-cluster-scopedCluster (CRDs)
wml.noble10.inst02wmlNamespace (operator + CR)
+ +
+ +

Rob Comment #2 — No helm CLI in K8s Jobs; use ArgoCD Helm Applications

+
+
Rob's comment
+ "I don't believe that using the helm command in a kubernetes job is the pattern we want to use for deployment of helm charts. We should be creating argo apps below the instance set that deploy the helm charts. These apps should be conditioned on 5.3.1. Versions should be handled as well within this so that we deploy the correct charts at the correct version." +
+
+
What was done ✅
+ All K8s Jobs running helm upgrade --install were removed. Replaced with native ArgoCD Application objects using spec.source.chart + spec.source.targetRevision pointing at https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm. Chart versions are read dynamically from the olm-utils-cm ConfigMap — no hardcoded versions. +
+ +

K8s Jobs removed (instance chart templates)

+ + + + + + + +
FileWhat was removedLines
120-ibm-wml/templates/02-ibm-wml-cr.yamlinstall-wml-helm Job (helm install redis + wml in shell script)−110
120-ibm-spark/templates/01-ibm-spark-cr.yamlinstall-spark-helm Job−78
120-ibm-spss/templates/01-ibm-spss-cr.yamlinstall-spss-helm Job−120
120-ibm-wsl/templates/01-ibm-wsl-cr.yamlinstall-wsl-helm Job (opensearch + ccs + datarefinery + ws-runtimes + ws in one giant script)−222
110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yamlcpd-sa-helm ClusterRole + ClusterRoleBinding (only needed for Jobs)−140
+ +

Native ArgoCD Helm Applications added (root app templates)

+ + + + + + + +
FileApps added for CPD ≥ 5.3.1Lines
120-ibm-wml-app.yamlwml-redis-cluster, wml-redis, wml-cluster, wml (waves 119–122) + wml-post-verify AVP (wave 123)+293
120-ibm-wsl-app.yamlopensearch-cluster, opensearch, ccs-cluster, ccs, datarefinery-cluster, datarefinery, ws-runtimes-cluster, ws-runtimes (waves 115–122) + wsl-cluster (119) + wsl (124) + wsl-post-verify AVP (126)+560
120-ibm-spark-app.yamlspark-cluster, spark (waves 119–120)+119
120-ibm-spss-app.yamlspss-canvasbase-cluster, spss-canvasbase, spss-cluster, spss (waves 119–125)+210
120-ibm-cognos-analytics-app.yamlcognos-cluster, cognos (waves 119–120) + ignoreDifferences for operator-mutated fields+137
+ +

Version handling — read from olm-utils-cm, not hardcoded

+ + + + + + + +
VariableSourceFallback
$wmlVersionolm-utils-cm → release_components_meta["wml"].case_version"12.1.0"
$wsVersionolm-utils-cm → release_components_meta["ws"].case_version"12.1.0"
$sparkVersionolm-utils-cm → release_components_meta["analyticsengine"].case_version"12.1.0"
$spssVersionolm-utils-cm → release_components_meta["spss-modeler"].case_version"12.1.0"
$cognosVersionolm-utils-cm → release_components_meta["cognos-analytics"].case_version"29.1.0"
+ +
+ +

Rob Comment #3 — Gate entire directory at root app level

+
+
Rob's comment
+ "The others CPD deployment should be excluded when version < 5.3.1 (i.e. the whole directory so these conditions need to move to root applications)." +
+
+
What was done ✅
+ The {{- $is531 }} version gate sits at the top of every root app template. For CPD < 5.3.1, the entire block of native Helm Applications is skipped — only the old OLM CR templates render. Instance chart CR templates still contain the OLM path for backward compatibility but render nothing for ≥ 5.3.1. +
+ + + + +
Template sectionRendered when
{{- if not $is531 }} ... OLM AVP app ...CPD < 5.3.1 only — original OLM Subscription path
{{- if $is531 }} ... native Helm Apps ...CPD ≥ 5.3.1 only — new native ArgoCD Helm path
+ +
+ +

Wave Ordering Bugs Found & Fixed During Testing

+
+
FINAL WAVE ORDER (CPD ≥ 5.3.1)
+
115–118
WSL deps cluster-scoped (opensearch, ccs, datarefinery, ws-runtimes)
+
119
wsl-cluster (ws CRDs) · wml-redis-cluster · spark-cluster · spss-canvasbase-cluster
+
120
WSL deps namespace-scoped · wml-redis · spark · cognos-cluster
+
121
spss-canvasbase · wml-cluster · cognos
+
122
spss-cluster · wml (WmlBase CR) · wsl-ws-runtimes
+
123
wml-post-verify → writes wml-cp4d to AWS SM
+
124
wsl (WS operator + WS CR)
+
125
spss (Spss CR — MUST be after WSL operator at 124)
+
126
wsl-post-verify → writes wsl-cp4d to AWS SM
+
+ + + + + +
BugSymptomFixCommit
ws-cluster-scoped at wave 123SPSS at wave 122 failed: ws.cpd.ibm.com CRD not foundMoved to wave 1194ece441a
SPSS at wave 122SPSS operator tries to create WS CR but WSL operator only starts at wave 124Moved SPSS to wave 125d3b138d3
No WSL post-verify for ≥ 5.3.1inst02-watsonstudio-system AVP failed: wsl-cp4d secret missing in AWS SMAdded wsl-post-verify AVP app at wave 12663f87548
+ +
+ +

New: Post-Verify Jobs for CPD ≥ 5.3.1

+ + + + +
AppJob prefixWrites to AWS SM
wml-post-verify.<cluster>.<inst>cpd-wml-post-verify<account>/<cluster>/<inst>/wml-cp4d → username, password, url
wsl-post-verify.<cluster>.<inst>cpd-wsl-post-verify<account>/<cluster>/<inst>/wsl-cp4d → username, password, url
+ +
+ +

Validation

+ + + + + + + +
CheckResult
helm-lint.sh -p root-applications/ibm-mas-instance-root1 chart linted, 0 failed
verify-job-definitions.sh .Passed
noble8 inst02 (dirty cluster)All CPD apps Synced/Healthy
noble10 inst02 (clean cluster)WML ✅ WSL ✅ Spark ✅ SPSS ✅ Cognos ✅
ArgoCD controller memory (was OOMKilling at 2Gi)Patched to 6Gi — stable
+ +
Made with IBM Bob
+
+ + diff --git a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml index d08c340dc..a0c339d40 100644 --- a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml @@ -443,13 +443,6 @@ spec: oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "/tmp/db2-scripts/CopyDBScripts.sh | tee /tmp/copydbscripts.log" db2inst1 || exit $? fi - # Set DB2_SCHEMA based on the application - used for CreateRoles.sh - if [[ "$MAS_APP_ID" == "manage" ]]; then - export DB2_SCHEMA="MAXIMO" - elif [[ "$MAS_APP_ID" == "facilities" ]]; then - export DB2_SCHEMA="TRIDATA" - fi - if [[ "$MAS_APP_ID" == "manage" ]]; then echo "" echo "================================================================================" @@ -578,15 +571,16 @@ spec: echo "--------------------------------------------------------------------------------" oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "${SETUPDB_SH_PATH} | tee /tmp/setupdb.log" db2inst1 || exit $? - fi # [[ "$MAS_APP_ID" == "manage" ]] + if [[ -n $BUCKET_NAME ]]; then + CREATE_ROLES_SH_PATH="${DB2_INSTANCE_HOME_PATH}/bin/CreateRoles.sh" + echo "" + echo "Executing ${CREATE_ROLES_SH_PATH} file on ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0" + echo "--------------------------------------------------------------------------------" + oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "cd ${DB2_INSTANCE_HOME_PATH}/bin; ${CREATE_ROLES_SH_PATH} | tee /tmp/createroles.log" db2inst1 || exit $? + fi - if [[ -n $BUCKET_NAME ]] && [[ -n $DB2_SCHEMA ]]; then - CREATE_ROLES_SH_PATH="${DB2_INSTANCE_HOME_PATH}/bin/CreateRoles.sh" - echo "" - echo "Executing ${CREATE_ROLES_SH_PATH} ${DB2_SCHEMA} on ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0" - echo "--------------------------------------------------------------------------------" - oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "cd ${DB2_INSTANCE_HOME_PATH}/bin; ${CREATE_ROLES_SH_PATH} ${DB2_SCHEMA} | tee /tmp/createroles.log" db2inst1 || exit $? - fi + + fi # [[ "$MAS_APP_ID" == "manage" ]] if [[ "$MAS_APP_ID" == "facilities" ]]; then echo "" @@ -595,6 +589,8 @@ spec: echo "================================================================================" # Copy and run a script on the db2u pod to perform Facilities-specific setup tasks + export DB2_SCHEMA="{{ .Values.facilities_db2_schema | default "TRIDATA" }}" + echo "" echo "Templating out facilities db2 scripts" echo "--------------------------------------------------------------------------------" @@ -632,7 +628,7 @@ spec: echo "--------------------------------------------------------------------------------" oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "/tmp/db2-scripts-facilities-updated/create-tablespaces.sh" db2inst1 || exit $? - # Execute create-schema.sh + # Execute create-schema.sh echo "" echo "Executing create-schema.sh file on ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0" echo "--------------------------------------------------------------------------------" diff --git a/instance-applications/120-ibm-db2u-database/values.yaml b/instance-applications/120-ibm-db2u-database/values.yaml index e8767691a..fddb167cb 100644 --- a/instance-applications/120-ibm-db2u-database/values.yaml +++ b/instance-applications/120-ibm-db2u-database/values.yaml @@ -3,6 +3,7 @@ instance_id: xxx db2_instance_name: xxx db2_namespace: xxxx db2_instance_home_path: /mnt/blumeta0/home/db2inst1 +facilities_db2_schema: "TRIDATA" sm_aws_access_key_id: xxx sm_aws_secret_access_key: xxxx diff --git a/instance-applications/120-ibm-dbs-rds-database/templates/00-configmap.yaml b/instance-applications/120-ibm-dbs-rds-database/templates/00-configmap.yaml index 599f36286..e52eaafc4 100644 --- a/instance-applications/120-ibm-dbs-rds-database/templates/00-configmap.yaml +++ b/instance-applications/120-ibm-dbs-rds-database/templates/00-configmap.yaml @@ -20,6 +20,7 @@ data: # Initialization of mas_application_id = os.getenv("MAS_APP_ID") + tririga_schema = os.getenv("TRIRIGA_SCHEMA", "TRIDATA") database_name = os.getenv("DB_NAME") created_any = False has_errors = False @@ -283,8 +284,8 @@ data: ("MAXTEMP", "MAXTEMPBP"), ] facilities_tablespaces = [ - ("TRIDATA_DATA", "TRIBUFPOOL"), - ("TRIDATA_INDX", "TRIBUFPOOLINDEX"), + (f"{tririga_schema}_DATA", "TRIBUFPOOL"), + (f"{tririga_schema}_INDX", "TRIBUFPOOLINDEX"), ("TRITEMP", "TRITEMPBP"), ("DEDICATED_DATA", "DEDICATEDBPDATA"), ("DEDICATED_INDEX", "DEDICATEDBPINDX"), diff --git a/instance-applications/120-ibm-dbs-rds-database/templates/01-dbs-rds-postsync-setup.yaml b/instance-applications/120-ibm-dbs-rds-database/templates/01-dbs-rds-postsync-setup.yaml index 4db779867..c2f1a672b 100644 --- a/instance-applications/120-ibm-dbs-rds-database/templates/01-dbs-rds-postsync-setup.yaml +++ b/instance-applications/120-ibm-dbs-rds-database/templates/01-dbs-rds-postsync-setup.yaml @@ -25,7 +25,7 @@ E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v2" }} +{{- $_job_version := "v3" }} {{- /* 10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest @@ -165,6 +165,8 @@ spec: - name: DB2_DATABASE_CONFIG value: {{ .Values.db2_database_db_config | toJson | quote }} {{- end }} + - name: TRIRIGA_SCHEMA + value: {{ .Values.facilities_db2_schema | default "TRIDATA" | quote }} volumeMounts: - name: dbs-rds-secret-store mountPath: /etc/mas/dbs-rds-creds/ diff --git a/instance-applications/120-ibm-dbs-rds-database/values.yaml b/instance-applications/120-ibm-dbs-rds-database/values.yaml index 20014ed82..236491802 100644 --- a/instance-applications/120-ibm-dbs-rds-database/values.yaml +++ b/instance-applications/120-ibm-dbs-rds-database/values.yaml @@ -22,6 +22,11 @@ mas_application_id: "" jdbc_connection_url: "" replica_db: false +# TRIRIGA schema name for the Facilities application. +# Only change this if the source system uses a non-standard schema name. +# Defaults to TRIDATA — existing deployments are unaffected. +facilities_db2_schema: "TRIDATA" + # DB2 Database Configuration db2_database_db_config: {} diff --git a/instance-applications/510-550-ibm-mas-suite-app-config/templates/703-postsync-rds-app-roles.yaml b/instance-applications/510-550-ibm-mas-suite-app-config/templates/703-postsync-rds-app-roles.yaml index b9ea2525c..3d63d1b49 100644 --- a/instance-applications/510-550-ibm-mas-suite-app-config/templates/703-postsync-rds-app-roles.yaml +++ b/instance-applications/510-550-ibm-mas-suite-app-config/templates/703-postsync-rds-app-roles.yaml @@ -79,7 +79,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v1" }} +{{- $_job_version := "v2" }} {{- /* 10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest @@ -183,6 +183,8 @@ spec: value: "{{ $jdbc_connection_url }}" - name: MAS_APP_ID value: "{{ $.Values.mas_app_id }}" + - name: TRIRIGA_SCHEMA + value: "{{ $.Values.tririga_db_schema | default "TRIDATA" }}" - name: OPERATIONAL_MODE value: "{{ $.Values.operational_mode }}" @@ -478,6 +480,7 @@ spec: # Process MANAGE application mas_app_id = os.getenv('MAS_APP_ID', '') + tririga_schema = os.getenv('TRIRIGA_SCHEMA', 'TRIDATA') if mas_app_id == 'manage': print("\n" + "=" * 80) print("Processing MANAGE application (MAXIMO schema)") @@ -523,28 +526,27 @@ spec: # Process FACILITIES application if mas_app_id == 'facilities': print("\n" + "=" * 80) - print("Processing FACILITIES application (TRIDATA schema)") + print(f"Processing FACILITIES application ({tririga_schema} schema)") print("=" * 80) - if check_table_exists(conn_target, "TRIDATA", "TRIDATA_DATA"): - print("✅ SCHEMA TRIDATA exists. Proceeding with role creation...") - + if check_table_exists(conn_target, tririga_schema, f"{tririga_schema}_DATA"): + print(f"✅ SCHEMA {tririga_schema} exists. Proceeding with role creation...") # Create roles using RDS admin procedure (connected to admin database) # Check role existence on target database to avoid SQL0601 errors - create_role_rds(conn_master_admin, "TRIDATA_READ", rds_dbname, conn_target) - create_role_rds(conn_master_admin, "TRIDATA_WRITE", rds_dbname, conn_target) - - # Grant permissions to TRIDATA_READ (connected to target database) - print("\nGranting permissions to TRIDATA_READ role...") - execute_db2_sql(conn_target, "GRANT SELECTIN ON SCHEMA TRIDATA TO ROLE TRIDATA_READ", "Grant SELECTIN on TRIDATA schema") - grant_on_all_tables(conn_target, "TRIDATA", "TRIDATA_READ", "SELECT") + create_role_rds(conn_master_admin, f"{tririga_schema}_READ", rds_dbname, conn_target) + create_role_rds(conn_master_admin, f"{tririga_schema}_WRITE", rds_dbname, conn_target) + + # Grant permissions to {tririga_schema}_READ (connected to target database) + print(f"\nGranting permissions to {tririga_schema}_READ role...") + execute_db2_sql(conn_target, f"GRANT SELECTIN ON SCHEMA {tririga_schema} TO ROLE {tririga_schema}_READ", f"Grant SELECTIN on {tririga_schema} schema") + grant_on_all_tables(conn_target, tririga_schema, f"{tririga_schema}_READ", "SELECT") - # Grant permissions to TRIDATA_WRITE - print("\nGranting permissions to TRIDATA_WRITE role...") - execute_db2_sql(conn_target, "GRANT SELECTIN, INSERTIN, UPDATEIN, DELETEIN ON SCHEMA TRIDATA TO ROLE TRIDATA_WRITE", "Grant DML on TRIDATA schema") - grant_on_all_tables(conn_target, "TRIDATA", "TRIDATA_WRITE", "SELECT, INSERT, UPDATE, DELETE") + # Grant permissions to {tririga_schema}_WRITE + print(f"\nGranting permissions to {tririga_schema}_WRITE role...") + execute_db2_sql(conn_target, f"GRANT SELECTIN, INSERTIN, UPDATEIN, DELETEIN ON SCHEMA {tririga_schema} TO ROLE {tririga_schema}_WRITE", f"Grant DML on {tririga_schema} schema") + grant_on_all_tables(conn_target, tririga_schema, f"{tririga_schema}_WRITE", "SELECT, INSERT, UPDATE, DELETE") else: - print("⚠️ Table TRIDATA.TRIDATA_DATA does not exist yet. Skipping facilities role creation.") + print(f"⚠️ Table {tririga_schema}.{tririga_schema}_DATA does not exist yet. Skipping facilities role creation.") else: print(f"ℹ️ Skipping FACILITIES application processing (MAS_APP_ID={mas_app_id})") diff --git a/instance-applications/510-550-ibm-mas-suite-app-config/values.yaml b/instance-applications/510-550-ibm-mas-suite-app-config/values.yaml index 36d85685c..866664770 100644 --- a/instance-applications/510-550-ibm-mas-suite-app-config/values.yaml +++ b/instance-applications/510-550-ibm-mas-suite-app-config/values.yaml @@ -7,6 +7,9 @@ run_sanity_test: false # # Values shown here are for illustration purposes only # #################################################### +# Facilities (TRIRIGA) schema name. Defaults to TRIDATA. +# tririga_db_schema: "TRIDATA" + # instance_id: "instance1" # mas_app_id: "manage" # mas_workspace_id: "masdev" diff --git a/mascore-15507-full-change-summary.html b/mascore-15507-full-change-summary.html new file mode 100644 index 000000000..93048a6f1 --- /dev/null +++ b/mascore-15507-full-change-summary.html @@ -0,0 +1,295 @@ + + + + +MASCORE-15507 — Full Change Summary + + + +
+ +

MASCORE-15507 — Full Change Summary

+
Branch: MASCORE-15507  ·  4 commits in this session  ·  44 files changed total on branch
+ + +

1. The Problem We Were Solving

+ +
+ CPD 5.3.1 changed how services (WML, WSL, Spark, SPSS, Cognos Analytics) are installed. + Previously every service was installed via OLM (Operator Lifecycle Manager) Subscriptions. + From 5.3.1 onward IBM ships native Helm charts and the OLM path is gone. + The original implementation used K8s batch/v1 Job objects inside the instance-applications + Helm charts to run helm install shell scripts — one per service. + The PR review asked us to replace those Jobs with native ArgoCD Applications + pointing directly at the IBM Helm chart registry, which is cleaner, observable, and retryable. +
+ + +

2. Architecture: Before vs After

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ConcernBefore (K8s Job approach)After (native ArgoCD Apps)
Where install logic livesinstance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml — a batch/v1 Job running shell scripts inside a CLI podroot-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml — ArgoCD Application objects pointing at IBM Helm chart registry
ObservabilityMust tail pod logs; ArgoCD just shows "Succeeded" once Job exitsEach sub-chart is a first-class ArgoCD Application — full sync status, health, resource tree in UI
Retry behaviourbackoffLimit: 4 on the Job; failures are opaqueretry: limit: 20 on each Application; ArgoCD auto-resyncs each wave independently
Version controlVersions hardcoded in Job shell script helm install ... --version 12.1.03-level priority: gitops config → olm-utils-cm lookup → hardcoded default
CRD establishmentJob script polled oc get crd in a shell loop with manual timeoutsCluster-scoped chart (wave N) establishes CRDs; namespace-scoped chart (wave N+1) runs after. SkipDryRunOnMissingResource=true on cluster-scoped only
CPD < 5.3.1Same file, different code pathOLM path entirely in instance-application templates, gated {{- if lt ... 5.3.1 }}. Unchanged
+ + +

3. Root Application Templates — What Was Added

+ +
+ Five files in root-applications/ibm-mas-instance-root/templates/ were updated. + Each now has two branches: CPD < 5.3.1 (OLM, unchanged) and CPD ≥ 5.3.1 (native ArgoCD Helm Apps, new). +
+ +

WML — 120-ibm-wml-app.yaml

+

4 Applications in sequence (Redis dependency first, then WML):

+ + + + + + +
WaveApp NameChartPurposeSkipDryRun?
119wml-redis-clusteribm-redis-cp-cluster-scopedRedis CRDs + ClusterRoles✅ yes
120wml-redisibm-redis-cpRedis operator in operators NS❌ no
121wml-clusterwml-cluster-scopedWML CRDs + ClusterRoles✅ yes
122wmlwmlWML operator + WmlBase CR❌ no
+ +

Spark — 120-ibm-spark-app.yaml

+ + + + +
WaveApp NameChartPurposeSkipDryRun?
119spark-clusteranalyticsengine-cluster-scopedCRDs + ClusterRoles✅ yes
120sparkanalyticsengineSpark operator + CR❌ no
+ +

SPSS — 120-ibm-spss-app.yaml

+

Also restored missing OLM params (spss_install_plan, canvasbase_channel, canvasbase_install_plan) to the < 5.3.1 branch.

+ + + + + + +
WaveApp NameChartPurposeSkipDryRun?
119spss-canvasbase-clustercanvasbase-cluster-scopedCanvas Base CRDs✅ yes
120spss-canvasbasecanvasbaseCanvas Base operator + CR❌ no
121spss-clusterspss-cluster-scopedSPSS CRDs✅ yes
122spssspssSPSS operator + CR❌ no
+ +

WSL — 120-ibm-wsl-app.yaml

+

Most complex — 5 sub-charts, 10 Applications total:

+ + + + + + + + + + + + +
WaveApp NameChartPurposeSkipDryRun?
115wsl-opensearch-clusteropencontent-opensearch-cluster-scopedOpenSearch CRDs✅ yes
116wsl-opensearchopencontent-opensearchOpenSearch operator❌ no
117wsl-ccs-clusterccs-cluster-scopedCCS CRDs✅ yes
118wsl-ccsccsCCS operator + CR❌ no
119wsl-datarefinery-clusterdatarefinery-cluster-scopedDataRefinery CRDs✅ yes
120wsl-datarefinerydatarefineryDataRefinery operator + CR❌ no
121wsl-ws-runtimes-clusterws-runtimes-cluster-scopedWS Runtimes CRDs✅ yes
122wsl-ws-runtimesws-runtimesWS Runtimes operator + CR❌ no
123wsl-clusterws-cluster-scopedWatson Studio CRDs✅ yes
124wslwsWatson Studio operator + CR❌ no
+ +

Cognos Analytics — 120-ibm-cognos-analytics-app.yaml

+

Cognos has no OLM path at all — 5.3.1+ only. The entire AVP plugin path was removed and replaced with 2 native Applications:

+ + + + +
WaveApp NameChartPurposeSkipDryRun?
119cognos-clustercognos-analytics-cluster-scopedCognos CRDs✅ yes
120cognoscognos-analyticsCognos operator + CR❌ no
+ + +

4. SkipDryRunOnMissingResource — Why Cluster-Scoped Only

+ +

+ SkipDryRunOnMissingResource=true tells ArgoCD to skip the dry-run validation for resources whose API type is not yet registered in the cluster. This is only needed on cluster-scoped charts because they install CRDs — on first deploy those CRDs don't exist yet, so ArgoCD's dry-run would fail. +

+

+ By the time the namespace-scoped chart runs (next wave), the CRDs from the preceding wave are already established and dry-run works normally — no skip needed or wanted there. +

+ 
Wave N   →  cluster-scoped chart  (SkipDryRunOnMissingResource=true)  installs CRDs
+Wave N+1 →  namespace-scoped chart (no skip)                            CRDs exist, dry-run OK
+ + +

5. Chart Version Resolution — 3-Level Priority

+ +

Each targetRevision is resolved at ArgoCD render time using this chain:

+
+
    +
  1. Gitops config value (e.g. ibm_wml.wml_chart_version: "13.0.0") — operator explicitly pins a version in their config repo
    2. +
  2. olm-utils-cm ConfigMap lookup — deployed by wave 110, contains the canonical case_version for every CPD component for the installed CPD release
    3. +
  3. Hardcoded default (e.g. "12.1.0") — only used during helm template dry-runs where no cluster is reachable
    4. +
+
+

In Helm template syntax (WML example):

+ 
{{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }}
+{{- $meta := dict }}
+{{- if $olmUtils }}
+{{- $meta = $olmUtils.data.release_components_meta | fromYaml }}
+{{- end }}
+{{- $wmlVersion := .Values.ibm_wml.wml_chart_version
+    | default ((index $meta "wml" | default dict).case_version | default "12.1.0") }}
+ +

New optional values added to each service values.yaml:

+ + + + + + + +
ServiceNew values.yaml keys
WMLwml_chart_version, redis_chart_version
Sparkspark_chart_version
SPSSspss_chart_version, canvasbase_chart_version
WSLws_chart_version, ccs_chart_version, datarefinery_chart_version, ws_runtimes_chart_version, opensearch_chart_version
Cognoscognos_chart_version (under ibm_cp4d)
+

All default to "" — existing deployments are unaffected.

+ + +

6. Instance Application Template Changes

+ +

These charts now only render for CPD < 5.3.1. For ≥ 5.3.1 the root-app Helm Applications handle everything. The Helm Job blocks were removed.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + +
FileWhat changed
120-ibm-wml/templates/02-ibm-wml-cr.yamlAdded < 5.3.1 gate. For ≥ 5.3.1: stub ConfigMap only (so ArgoCD has a persistent non-hook resource and doesn't loop OutOfSync after the old Job deleted itself)
120-ibm-spark/templates/01-ibm-spark-cr.yamlSame — < 5.3.1 gate, ≥ 5.3.1 stub ConfigMap
120-ibm-spss/templates/01-ibm-spss-cr.yaml< 5.3.1 gate; fixed CR name spss-sample → spssmodeler-cr; removed incorrect datarefinery_operand_version/wsrt_operand_version fields (SPSS doesn't use them); stub ConfigMap for ≥ 5.3.1
120-ibm-spss/templates/00-ibm-spss_Subscription.yamlAdded < 5.3.1 gate. Restored full dual Subscription (canvasbase + SPSS) with installPlanApproval
120-ibm-wsl/templates/01-ibm-wsl-cr.yamlAdded < 5.3.1 gate. Stub ConfigMap for ≥ 5.3.1
120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yamlEntire file replaced with a single comment — Cognos has no OLM path at all; all logic moved to root app
+ + +

7. CP4D Platform Changes

+ + + + + + + + + + + + + + + + + + + +
FileWhat changed
110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yamlnew The olm-utils-cm ConfigMap for CPD 5.3.1 containing release_components_meta with case_version for every component. This is the single source of truth for chart versions on the cluster
110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yamlnew cpd-sa ServiceAccount + ClusterRole with CRD/Helm/escalate permissions needed by the ≥ 5.3.1 Helm apps
110-ibm-cp4d/templates/07-ibm-cp4d_Ibmcpd.yamlfix imagePullSecret: ibm_entitlement_key → ibm-entitlement-key (underscore→dash bug was causing the CP4D operator to fail pulling Common Services images)
110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yamlfix Added < 5.3.1 version gate — OLM Subscriptions for CCS/DataRefinery/WS-Runtimes are not needed for ≥ 5.3.1
+ + +

8. RBAC Regeneration

+ +

After adding ConfigMap resources to the ≥ 5.3.1 branches, generate_application_admin_rbac.py was re-run to add ConfigMap to the auto-generated RBAC rules:

+
    +
  • instance-applications/600-application-admin-rbac/templates/per-namespace-rbac.yaml
    • +
  • rbac/kustomize/base/application-admin-role.yaml
    • +
+ + +

9. Commits in This Session

+ + + + + + + + + + + +
CommitSummary
768133a1 + Added WSL (10 apps), Cognos (2 apps) native ArgoCD Helm Applications.
+ Replaced all hardcoded targetRevision with olm-utils-cm lookup + fallback defaults.
+ Moved SkipDryRunOnMissingResource=true from namespace-scoped apps to cluster-scoped apps only. +
34ea07b9 + Exposed chart versions as explicit gitops config values (wml_chart_version, spark_chart_version, etc.).
+ 3-level priority chain: gitops config → olm-utils-cm → hardcoded default.
+ Added new optional keys to all 5 service values.yaml files. +
+ + +

10. Validation

+ +

After every change set:

+
    +
  • ./build/bin/helm-lint.sh -p root-applications/ibm-mas-instance-root — 1 chart linted, 0 failed
    • +
  • ./build/bin/verify-job-definitions.sh . — 77 files scanned, 77 valid, 0 invalid
    • +
+ +
Made with IBM Bob
+
+ + diff --git a/watch_20260826-114330 b/watch_20260826-114330 new file mode 100644 index 000000000..74957ebd2 --- /dev/null +++ b/watch_20260826-114330 @@ -0,0 +1,71 @@ +NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE +export-zen-minio-0 Pending nfs-client 33s +export-zen-minio-1 Pending nfs-client 33s +export-zen-minio-2 Pending nfs-client 33s + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/watch_20260826-152105 b/watch_20260826-152105 new file mode 100644 index 000000000..fa78c082e --- /dev/null +++ b/watch_20260826-152105 @@ -0,0 +1,71 @@ +NAME CSV APPROVAL APPROVED +install-98bkc ibm-cpd-canvasbase.v8.5.0 Automatic true +install-bs99q ibm-cpd-datarefinery.v11.0.0 Automatic true +install-gnzzk ibm-cpd-spss.v8.5.0 Automatic true +install-gqhgk ibm-zen-operator.v6.2.0 Automatic true +install-j9gp9 cloud-native-postgresql.v1.25.2 Automatic true + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From a30e401ea18816d8bac7be9f08bf92659f26ae6a Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 28 Jul 2026 12:15:53 +0530 Subject: [PATCH 108/115] For CPD 5.3.1 services are installed via Helm --- .../templates/00-ibm-spark_Subscription.yaml | 3 +- .../templates/01-ibm-spark-cr.yaml | 7 ++ .../120-ibm-spark/values.yaml | 1 + .../templates/00-ibm-spss_Subscription.yaml | 2 + .../templates/01-ibm-spss-cr.yaml | 10 ++- .../120-ibm-spss/values.yaml | 1 + .../templates/01-ibm-wml_Subscription.yaml | 2 + .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 7 ++ instance-applications/120-ibm-wml/values.yaml | 1 + .../templates/00-ibm-wsl_Subscription.yaml | 22 ++++++ .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 71 +++++++++++++++++++ 11 files changed, 124 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml index 598d60619..99918936a 100644 --- a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml +++ b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,4 +17,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.spark_install_plan | default "Automatic" | quote }} - +{{- end }} diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 87a8a32c9..45a3588ed 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: ae.cpd.ibm.com/v1 kind: AnalyticsEngine @@ -22,3 +23,9 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.spark_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +# Spark (Analytics Engine) is installed via ansible-devops cp4d_service role using Helm +# No OLM Subscription or CR is created here for CPD >= 5.3.1 +{{- end }} diff --git a/instance-applications/120-ibm-spark/values.yaml b/instance-applications/120-ibm-spark/values.yaml index d6a766919..25e5c803b 100644 --- a/instance-applications/120-ibm-spark/values.yaml +++ b/instance-applications/120-ibm-spark/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" spark_channel: "" spark_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index dcb608e85..c37c39d91 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -35,3 +36,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.canvasbase_install_plan | default "Automatic" | quote }} +{{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 2869c08f6..f182ecf68 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,4 +1,4 @@ - +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: spssmodeler.cpd.ibm.com/v1 kind: Spss @@ -24,4 +24,10 @@ spec: version: "{{ .Values.spss_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" - wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" \ No newline at end of file + wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +# SPSS Modeler is installed via ansible-devops cp4d_service role using Helm +# No OLM Subscription or CR is created here for CPD >= 5.3.1 +{{- end }} diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml index 51ca216c9..b7c0618d7 100644 --- a/instance-applications/120-ibm-spss/values.yaml +++ b/instance-applications/120-ibm-spss/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" spss_channel: "" spss_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml index 327653732..8b80ea231 100644 --- a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml +++ b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,3 +17,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.wml_install_plan | default "Automatic" | quote }} +{{- end }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index e1e789973..f6e485cb5 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: wml.cpd.ibm.com/v1beta1 kind: WmlBase @@ -22,3 +23,9 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.wml_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +# WML is installed via ansible-devops cp4d_service role using Helm +# No OLM Subscription or CR is created here for CPD >= 5.3.1 +{{- end }} diff --git a/instance-applications/120-ibm-wml/values.yaml b/instance-applications/120-ibm-wml/values.yaml index b5ec6e992..56dedaab2 100644 --- a/instance-applications/120-ibm-wml/values.yaml +++ b/instance-applications/120-ibm-wml/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" wml_channel: "" wml_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index b2556409c..d205eb28b 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -1,3 +1,24 @@ +# --- +# apiVersion: operators.coreos.com/v1alpha1 +# kind: Subscription +# metadata: +# name: ibm-cpd-ws-operator +# namespace: "{{ .Values.cpd_operators_namespace }}" +# annotations: +# argocd.argoproj.io/sync-wave: "090" +# {{- if .Values.custom_labels }} +# labels: +# {{ .Values.custom_labels | toYaml | indent 4 }} +# {{- end }} +# spec: +# name: ibm-cpd-wsl +# channel: "{{ .Values.wsl_channel }}" +# source: ibm-operator-catalog +# sourceNamespace: openshift-marketplace +# installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} + + +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,3 +37,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} +{{- end }} \ No newline at end of file diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 11c9d89a3..a37ce5f29 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -1,3 +1,33 @@ +# --- +# apiVersion: ws.cpd.ibm.com/v1beta1 +# kind: WS +# metadata: +# name: "ws-cr" +# namespace: "{{ .Values.cpd_instance_namespace }}" +# annotations: +# argocd.argoproj.io/sync-wave: "091" +# argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +# {{- if .Values.custom_labels }} +# labels: +# {{ .Values.custom_labels | toYaml | indent 4 }} +# {{- end }} +# spec: +# imagePullSecret: ibm-entitlement-key +# ignoreForMaintenance: false +# license: +# accept: true +# license: Standard +# scaleConfig: "{{ .Values.cpd_service_scale_config }}" +# fileStorageClass: "{{ .Values.cpd_service_storage_class }}" +# blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" +# version: "{{ .Values.wsl_version }}" +# ccs_operand_version: "{{ .Values.ccs_version }}" +# datarefinery_operand_version: "{{ .Values.datarefinery_version }}" +# wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" + + + +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: ws.cpd.ibm.com/v1beta1 kind: WS @@ -24,3 +54,44 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +apiVersion: batch/v1 +kind: Job +metadata: + name: install-wsl-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: quay.io/ibmmas/cli:latest + command: + - /bin/sh + - -c + - | + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + helm upgrade --install wsl ibm-charts/wsl \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set ws.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 30m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 +{{- end }} \ No newline at end of file From e4bec4dec753004e5ba5912ad7b1d4abe3db6c95 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 28 Jul 2026 12:51:11 +0530 Subject: [PATCH 109/115] Revert "For CPD 5.3.1 services are installed via Helm" This reverts commit 5c919c36244a9384a40f0b03880ec2017acc6901. --- .../templates/00-ibm-spark_Subscription.yaml | 3 +- .../templates/01-ibm-spark-cr.yaml | 7 -- .../120-ibm-spark/values.yaml | 1 - .../templates/00-ibm-spss_Subscription.yaml | 2 - .../templates/01-ibm-spss-cr.yaml | 10 +-- .../120-ibm-spss/values.yaml | 1 - .../templates/01-ibm-wml_Subscription.yaml | 2 - .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 7 -- instance-applications/120-ibm-wml/values.yaml | 1 - .../templates/00-ibm-wsl_Subscription.yaml | 22 ------ .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 71 ------------------- 11 files changed, 3 insertions(+), 124 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml index 99918936a..598d60619 100644 --- a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml +++ b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml @@ -1,4 +1,3 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -17,4 +16,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.spark_install_plan | default "Automatic" | quote }} -{{- end }} + diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 45a3588ed..87a8a32c9 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -1,4 +1,3 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: ae.cpd.ibm.com/v1 kind: AnalyticsEngine @@ -23,9 +22,3 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.spark_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" -{{- else }} ---- -# Helm-based installation for CPD 5.3.1+ -# Spark (Analytics Engine) is installed via ansible-devops cp4d_service role using Helm -# No OLM Subscription or CR is created here for CPD >= 5.3.1 -{{- end }} diff --git a/instance-applications/120-ibm-spark/values.yaml b/instance-applications/120-ibm-spark/values.yaml index 25e5c803b..d6a766919 100644 --- a/instance-applications/120-ibm-spark/values.yaml +++ b/instance-applications/120-ibm-spark/values.yaml @@ -5,4 +5,3 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" spark_channel: "" spark_version: "" -cpd_product_version: "" diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index c37c39d91..dcb608e85 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -1,4 +1,3 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -36,4 +35,3 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.canvasbase_install_plan | default "Automatic" | quote }} -{{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index f182ecf68..2869c08f6 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} + --- apiVersion: spssmodeler.cpd.ibm.com/v1 kind: Spss @@ -24,10 +24,4 @@ spec: version: "{{ .Values.spss_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" - wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" -{{- else }} ---- -# Helm-based installation for CPD 5.3.1+ -# SPSS Modeler is installed via ansible-devops cp4d_service role using Helm -# No OLM Subscription or CR is created here for CPD >= 5.3.1 -{{- end }} + wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" \ No newline at end of file diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml index b7c0618d7..51ca216c9 100644 --- a/instance-applications/120-ibm-spss/values.yaml +++ b/instance-applications/120-ibm-spss/values.yaml @@ -5,4 +5,3 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" spss_channel: "" spss_version: "" -cpd_product_version: "" diff --git a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml index 8b80ea231..327653732 100644 --- a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml +++ b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml @@ -1,4 +1,3 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -17,4 +16,3 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.wml_install_plan | default "Automatic" | quote }} -{{- end }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index f6e485cb5..e1e789973 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -1,4 +1,3 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: wml.cpd.ibm.com/v1beta1 kind: WmlBase @@ -23,9 +22,3 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.wml_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" -{{- else }} ---- -# Helm-based installation for CPD 5.3.1+ -# WML is installed via ansible-devops cp4d_service role using Helm -# No OLM Subscription or CR is created here for CPD >= 5.3.1 -{{- end }} diff --git a/instance-applications/120-ibm-wml/values.yaml b/instance-applications/120-ibm-wml/values.yaml index 56dedaab2..b5ec6e992 100644 --- a/instance-applications/120-ibm-wml/values.yaml +++ b/instance-applications/120-ibm-wml/values.yaml @@ -5,4 +5,3 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" wml_channel: "" wml_version: "" -cpd_product_version: "" diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index d205eb28b..b2556409c 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -1,24 +1,3 @@ -# --- -# apiVersion: operators.coreos.com/v1alpha1 -# kind: Subscription -# metadata: -# name: ibm-cpd-ws-operator -# namespace: "{{ .Values.cpd_operators_namespace }}" -# annotations: -# argocd.argoproj.io/sync-wave: "090" -# {{- if .Values.custom_labels }} -# labels: -# {{ .Values.custom_labels | toYaml | indent 4 }} -# {{- end }} -# spec: -# name: ibm-cpd-wsl -# channel: "{{ .Values.wsl_channel }}" -# source: ibm-operator-catalog -# sourceNamespace: openshift-marketplace -# installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} - - -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -37,4 +16,3 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} -{{- end }} \ No newline at end of file diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index a37ce5f29..11c9d89a3 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -1,33 +1,3 @@ -# --- -# apiVersion: ws.cpd.ibm.com/v1beta1 -# kind: WS -# metadata: -# name: "ws-cr" -# namespace: "{{ .Values.cpd_instance_namespace }}" -# annotations: -# argocd.argoproj.io/sync-wave: "091" -# argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -# {{- if .Values.custom_labels }} -# labels: -# {{ .Values.custom_labels | toYaml | indent 4 }} -# {{- end }} -# spec: -# imagePullSecret: ibm-entitlement-key -# ignoreForMaintenance: false -# license: -# accept: true -# license: Standard -# scaleConfig: "{{ .Values.cpd_service_scale_config }}" -# fileStorageClass: "{{ .Values.cpd_service_storage_class }}" -# blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" -# version: "{{ .Values.wsl_version }}" -# ccs_operand_version: "{{ .Values.ccs_version }}" -# datarefinery_operand_version: "{{ .Values.datarefinery_version }}" -# wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" - - - -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: ws.cpd.ibm.com/v1beta1 kind: WS @@ -54,44 +24,3 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" -{{- else }} ---- -# Helm-based installation for CPD 5.3.1+ -apiVersion: batch/v1 -kind: Job -metadata: - name: install-wsl-helm - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" - argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded -spec: - template: - spec: - containers: - - name: helm-install - image: quay.io/ibmmas/cli:latest - command: - - /bin/sh - - -c - - | - helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm - helm repo update - helm upgrade --install wsl ibm-charts/wsl \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --set ws.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 30m - restartPolicy: Never - serviceAccountName: cpd-sa - backoffLimit: 2 -{{- end }} \ No newline at end of file From 39f7f54a88339c3fe2b673883957ac00be99e6e2 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Wed, 12 Aug 2026 12:40:51 +0530 Subject: [PATCH 110/115] MASCORE-10022: make facilities TRIRIGA schema fully configurable in db2u scripts - Parameterise SCHEMA in files/facilities/runstats_volatile.sh via { db2_schema } placeholder so the periodic runstats cron job targets the correct schema on the pod - Parameterise TRIDATA_DATA/TRIDATA_INDX tablespace names in files/facilities/create-tablespaces.sh.j2 with { db2_schema }_DATA/_INDX placeholders so tablespaces are created with names matching the configured schema - Update the sed command for create-tablespaces.sh.j2 in 07-postsync-setup-db2_Job.yaml to substitute { db2_schema } at template-time (was only substituting db2_dbname) - Replace plain cp of runstats_volatile.sh in 07-postsync-setup-db2_Job.yaml with a sed call so the { db2_schema } placeholder is resolved before the script reaches the pod - Add DB2_SCHEMA env-driven variable in files/grant_check.sh (defaults to TRIDATA) and replace hardcoded 'TRIDATA' in the syscat.SCHEMATA IN-list so the recurring grant cron job discovers and maintains roles for non-standard schema names --- .../files/facilities/create-tablespaces.sh.j2 | 30 +++++++++---------- .../files/facilities/runstats_volatile.sh | 2 +- .../files/grant_check.sh | 3 +- .../templates/07-postsync-setup-db2_Job.yaml | 4 +-- 4 files changed, 20 insertions(+), 19 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/files/facilities/create-tablespaces.sh.j2 b/instance-applications/120-ibm-db2u-database/files/facilities/create-tablespaces.sh.j2 index 20ec291f7..edf29e5fc 100644 --- a/instance-applications/120-ibm-db2u-database/files/facilities/create-tablespaces.sh.j2 +++ b/instance-applications/120-ibm-db2u-database/files/facilities/create-tablespaces.sh.j2 @@ -163,9 +163,9 @@ fi echo "${TABLESPACES}" -if [[ ${TABLESPACES} != *"TRIDATA_DATA "* ]]; then - echo "Creating TABLESPACE TRIDATA_DATA" - db2 "CREATE LARGE TABLESPACE TRIDATA_DATA IN DATABASE PARTITION GROUP IBMDEFAULTGROUP +if [[ ${TABLESPACES} != *"{ db2_schema }_DATA "* ]]; then + echo "Creating TABLESPACE { db2_schema }_DATA" + db2 "CREATE LARGE TABLESPACE { db2_schema }_DATA IN DATABASE PARTITION GROUP IBMDEFAULTGROUP PAGESIZE 32768 MANAGED BY AUTOMATIC STORAGE AUTORESIZE YES INITIALSIZE 5000 M @@ -180,18 +180,18 @@ if [[ ${TABLESPACES} != *"TRIDATA_DATA "* ]]; then DROPPED TABLE RECOVERY ON;" rc=$? if [ $rc -ne "0" ]; then - echo "Unable to create TABLESPACE TRIDATA_DATA for some reason = $rc" + echo "Unable to create TABLESPACE { db2_schema }_DATA for some reason = $rc" exit $rc fi -else - echo "TABLESPACE TRIDATA_DATA already exists" +else + echo "TABLESPACE { db2_schema }_DATA already exists" fi -db2 "SELECT * FROM SYSCAT.TABLESPACES WHERE TBSPACE = 'TRIDATA_DATA'" +db2 "SELECT * FROM SYSCAT.TABLESPACES WHERE TBSPACE = '{ db2_schema }_DATA'" -if [[ ${TABLESPACES} != *"TRIDATA_INDX "* ]]; then - echo "Creating TABLESPACE TRIDATA_INDX" - db2 "CREATE LARGE TABLESPACE TRIDATA_INDX IN DATABASE PARTITION GROUP IBMDEFAULTGROUP +if [[ ${TABLESPACES} != *"{ db2_schema }_INDX "* ]]; then + echo "Creating TABLESPACE { db2_schema }_INDX" + db2 "CREATE LARGE TABLESPACE { db2_schema }_INDX IN DATABASE PARTITION GROUP IBMDEFAULTGROUP PAGESIZE 32768 MANAGED BY AUTOMATIC STORAGE AUTORESIZE YES INITIALSIZE 5000 M @@ -205,14 +205,14 @@ if [[ ${TABLESPACES} != *"TRIDATA_INDX "* ]]; then DROPPED TABLE RECOVERY ON;" rc=$? if [ $rc -ne "0" ]; then - echo "Unable to create TABLESPACE TRIDATA_INDX for some reason = $rc" + echo "Unable to create TABLESPACE { db2_schema }_INDX for some reason = $rc" exit $rc fi -else - echo "TABLESPACE TRIDATA_INDX already exists" -fi +else + echo "TABLESPACE { db2_schema }_INDX already exists" +fi -db2 "SELECT * FROM SYSCAT.TABLESPACES WHERE TBSPACE = 'TRIDATA_INDX'" +db2 "SELECT * FROM SYSCAT.TABLESPACES WHERE TBSPACE = '{ db2_schema }_INDX'" if [[ ${TABLESPACES} != *"TRITEMP "* ]]; then echo "Creating TABLESPACE TRITEMP" diff --git a/instance-applications/120-ibm-db2u-database/files/facilities/runstats_volatile.sh b/instance-applications/120-ibm-db2u-database/files/facilities/runstats_volatile.sh index 47280bd72..736de1e85 100644 --- a/instance-applications/120-ibm-db2u-database/files/facilities/runstats_volatile.sh +++ b/instance-applications/120-ibm-db2u-database/files/facilities/runstats_volatile.sh @@ -38,7 +38,7 @@ DATESTAMP=`date "+%Y-%m-%d-%H.%M.%S"` # Database and schema configuration DATABASE="BLUDB" -SCHEMA="TRIDATA" +SCHEMA={ db2_schema } # Loop through all databases (in case there are multiple) for db in `db2 list db directory | grep -B 5 Indirect | grep "Database name" | cut -d= -f2` diff --git a/instance-applications/120-ibm-db2u-database/files/grant_check.sh b/instance-applications/120-ibm-db2u-database/files/grant_check.sh index bf8ac3950..88f1c9aeb 100755 --- a/instance-applications/120-ibm-db2u-database/files/grant_check.sh +++ b/instance-applications/120-ibm-db2u-database/files/grant_check.sh @@ -86,11 +86,12 @@ then exit fi +DB2_SCHEMA="${DB2_SCHEMA:-TRIDATA}" role=`db2 get db cfg for $1 | grep "HADR database role" | cut -d= -f2 |sed 's/ //g'` if [ "$role" != "STANDBY" ]; then db2 connect to $1 if [ $? -eq 0 ]; then - schemalist=(`db2 connect to $1 >/dev/null;db2 -x "select SCHEMANAME from syscat.SCHEMATA where SCHEMANAME in ('MAXIMO','TRIDATA','TRIRIGADC')"`) + schemalist=(`db2 connect to $1 >/dev/null;db2 -x "select SCHEMANAME from syscat.SCHEMATA where SCHEMANAME in ('MAXIMO','${DB2_SCHEMA}','TRIRIGADC')"`) i=0 while [[ $i -lt ${#schemalist[*]} ]] do diff --git a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml index a0c339d40..86281317a 100644 --- a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml @@ -599,7 +599,7 @@ spec: FACILITIES_TABLESPACES_PATH=/tmp/db2-scripts-facilities-updated/create-tablespaces.sh FACILITIES_SCHEMA_PATH=/tmp/db2-scripts-facilities-updated/create-schema.sh sed "s/{ db2_dbname }/$DB2_DBNAME/g; s/{ db2_user }/$DB2_USER/g;" /tmp/db2-scripts-facilities/db2config.sh.j2 > ${FACILITIES_DB2_SETUP_PATH} - sed "s/{ db2_dbname }/$DB2_DBNAME/g;" /tmp/db2-scripts-facilities/create-tablespaces.sh.j2 > ${FACILITIES_TABLESPACES_PATH} + sed "s/{ db2_dbname }/$DB2_DBNAME/g; s/{ db2_schema }/$DB2_SCHEMA/g;" /tmp/db2-scripts-facilities/create-tablespaces.sh.j2 > ${FACILITIES_TABLESPACES_PATH} sed "s/{ db2_dbname }/$DB2_DBNAME/g; s/{ db2_user }/$DB2_USER/g; s/{ db2_schema }/$DB2_SCHEMA/g;" /tmp/db2-scripts-facilities/create-schema.sh.j2 > ${FACILITIES_SCHEMA_PATH} echo "" @@ -613,7 +613,7 @@ spec: echo "" echo "Copying runstats_volatile.sh to /mnt/backup/bin in c-${DB2_INSTANCE_NAME}-db2u-0" echo "--------------------------------------------------------------------------------" - cp /tmp/db2-scripts-facilities/runstats_volatile.sh /tmp/runstats_volatile.sh + sed "s/{ db2_schema }/$DB2_SCHEMA/g;" /tmp/db2-scripts-facilities/runstats_volatile.sh > /tmp/runstats_volatile.sh oc cp /tmp/runstats_volatile.sh ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0:/tmp/runstats_volatile.sh -c db2u || exit $? oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "sudo rm -f ${INSTHOME}/bin/runstats_volatile.sh && sudo mv /tmp/runstats_volatile.sh ${INSTHOME}/bin/runstats_volatile.sh && sudo chmod +x ${INSTHOME}/bin/runstats_volatile.sh && sudo chown db2inst1:db2iadm1 ${INSTHOME}/bin/runstats_volatile.sh" db2inst1 || exit $? # Execute db2configdb.sh From 4b0635d586ac3684046cc2597cd015c86114fc16 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 3 Sep 2026 00:02:30 +0530 Subject: [PATCH 111/115] MASCORE-10022 remove unwanted files --- mascore-15507-full-change-summary.html | 295 ------------------ .../510-550-ibm-mas-masapp-configs.yaml | 6 + watch_20260826-114330 | 71 ----- watch_20260826-152105 | 71 ----- 4 files changed, 6 insertions(+), 437 deletions(-) delete mode 100644 mascore-15507-full-change-summary.html delete mode 100644 watch_20260826-114330 delete mode 100644 watch_20260826-152105 diff --git a/mascore-15507-full-change-summary.html b/mascore-15507-full-change-summary.html deleted file mode 100644 index 93048a6f1..000000000 --- a/mascore-15507-full-change-summary.html +++ /dev/null @@ -1,295 +0,0 @@ - - - - -MASCORE-15507 — Full Change Summary - - - -
- -

MASCORE-15507 — Full Change Summary

-
Branch: MASCORE-15507  ·  4 commits in this session  ·  44 files changed total on branch
- - -

1. The Problem We Were Solving

- -
- CPD 5.3.1 changed how services (WML, WSL, Spark, SPSS, Cognos Analytics) are installed. - Previously every service was installed via OLM (Operator Lifecycle Manager) Subscriptions. - From 5.3.1 onward IBM ships native Helm charts and the OLM path is gone. - The original implementation used K8s batch/v1 Job objects inside the instance-applications - Helm charts to run helm install shell scripts — one per service. - The PR review asked us to replace those Jobs with native ArgoCD Applications - pointing directly at the IBM Helm chart registry, which is cleaner, observable, and retryable. -
- - -

2. Architecture: Before vs After

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ConcernBefore (K8s Job approach)After (native ArgoCD Apps)
Where install logic livesinstance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml — a batch/v1 Job running shell scripts inside a CLI podroot-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml — ArgoCD Application objects pointing at IBM Helm chart registry
ObservabilityMust tail pod logs; ArgoCD just shows "Succeeded" once Job exitsEach sub-chart is a first-class ArgoCD Application — full sync status, health, resource tree in UI
Retry behaviourbackoffLimit: 4 on the Job; failures are opaqueretry: limit: 20 on each Application; ArgoCD auto-resyncs each wave independently
Version controlVersions hardcoded in Job shell script helm install ... --version 12.1.03-level priority: gitops config → olm-utils-cm lookup → hardcoded default
CRD establishmentJob script polled oc get crd in a shell loop with manual timeoutsCluster-scoped chart (wave N) establishes CRDs; namespace-scoped chart (wave N+1) runs after. SkipDryRunOnMissingResource=true on cluster-scoped only
CPD < 5.3.1Same file, different code pathOLM path entirely in instance-application templates, gated {{- if lt ... 5.3.1 }}. Unchanged
- - -

3. Root Application Templates — What Was Added

- -
- Five files in root-applications/ibm-mas-instance-root/templates/ were updated. - Each now has two branches: CPD < 5.3.1 (OLM, unchanged) and CPD ≥ 5.3.1 (native ArgoCD Helm Apps, new). -
- -

WML — 120-ibm-wml-app.yaml

-

4 Applications in sequence (Redis dependency first, then WML):

- - - - - - -
WaveApp NameChartPurposeSkipDryRun?
119wml-redis-clusteribm-redis-cp-cluster-scopedRedis CRDs + ClusterRoles✅ yes
120wml-redisibm-redis-cpRedis operator in operators NS❌ no
121wml-clusterwml-cluster-scopedWML CRDs + ClusterRoles✅ yes
122wmlwmlWML operator + WmlBase CR❌ no
- -

Spark — 120-ibm-spark-app.yaml

- - - - -
WaveApp NameChartPurposeSkipDryRun?
119spark-clusteranalyticsengine-cluster-scopedCRDs + ClusterRoles✅ yes
120sparkanalyticsengineSpark operator + CR❌ no
- -

SPSS — 120-ibm-spss-app.yaml

-

Also restored missing OLM params (spss_install_plan, canvasbase_channel, canvasbase_install_plan) to the < 5.3.1 branch.

- - - - - - -
WaveApp NameChartPurposeSkipDryRun?
119spss-canvasbase-clustercanvasbase-cluster-scopedCanvas Base CRDs✅ yes
120spss-canvasbasecanvasbaseCanvas Base operator + CR❌ no
121spss-clusterspss-cluster-scopedSPSS CRDs✅ yes
122spssspssSPSS operator + CR❌ no
- -

WSL — 120-ibm-wsl-app.yaml

-

Most complex — 5 sub-charts, 10 Applications total:

- - - - - - - - - - - - -
WaveApp NameChartPurposeSkipDryRun?
115wsl-opensearch-clusteropencontent-opensearch-cluster-scopedOpenSearch CRDs✅ yes
116wsl-opensearchopencontent-opensearchOpenSearch operator❌ no
117wsl-ccs-clusterccs-cluster-scopedCCS CRDs✅ yes
118wsl-ccsccsCCS operator + CR❌ no
119wsl-datarefinery-clusterdatarefinery-cluster-scopedDataRefinery CRDs✅ yes
120wsl-datarefinerydatarefineryDataRefinery operator + CR❌ no
121wsl-ws-runtimes-clusterws-runtimes-cluster-scopedWS Runtimes CRDs✅ yes
122wsl-ws-runtimesws-runtimesWS Runtimes operator + CR❌ no
123wsl-clusterws-cluster-scopedWatson Studio CRDs✅ yes
124wslwsWatson Studio operator + CR❌ no
- -

Cognos Analytics — 120-ibm-cognos-analytics-app.yaml

-

Cognos has no OLM path at all — 5.3.1+ only. The entire AVP plugin path was removed and replaced with 2 native Applications:

- - - - -
WaveApp NameChartPurposeSkipDryRun?
119cognos-clustercognos-analytics-cluster-scopedCognos CRDs✅ yes
120cognoscognos-analyticsCognos operator + CR❌ no
- - -

4. SkipDryRunOnMissingResource — Why Cluster-Scoped Only

- -

- SkipDryRunOnMissingResource=true tells ArgoCD to skip the dry-run validation for resources whose API type is not yet registered in the cluster. This is only needed on cluster-scoped charts because they install CRDs — on first deploy those CRDs don't exist yet, so ArgoCD's dry-run would fail. -

-

- By the time the namespace-scoped chart runs (next wave), the CRDs from the preceding wave are already established and dry-run works normally — no skip needed or wanted there. -

- 
Wave N   →  cluster-scoped chart  (SkipDryRunOnMissingResource=true)  installs CRDs
-Wave N+1 →  namespace-scoped chart (no skip)                            CRDs exist, dry-run OK
- - -

5. Chart Version Resolution — 3-Level Priority

- -

Each targetRevision is resolved at ArgoCD render time using this chain:

-
-
    -
  1. Gitops config value (e.g. ibm_wml.wml_chart_version: "13.0.0") — operator explicitly pins a version in their config repo
    2. -
  2. olm-utils-cm ConfigMap lookup — deployed by wave 110, contains the canonical case_version for every CPD component for the installed CPD release
    3. -
  3. Hardcoded default (e.g. "12.1.0") — only used during helm template dry-runs where no cluster is reachable
    4. -
-
-

In Helm template syntax (WML example):

- 
{{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }}
-{{- $meta := dict }}
-{{- if $olmUtils }}
-{{- $meta = $olmUtils.data.release_components_meta | fromYaml }}
-{{- end }}
-{{- $wmlVersion := .Values.ibm_wml.wml_chart_version
-    | default ((index $meta "wml" | default dict).case_version | default "12.1.0") }}
- -

New optional values added to each service values.yaml:

- - - - - - - -
ServiceNew values.yaml keys
WMLwml_chart_version, redis_chart_version
Sparkspark_chart_version
SPSSspss_chart_version, canvasbase_chart_version
WSLws_chart_version, ccs_chart_version, datarefinery_chart_version, ws_runtimes_chart_version, opensearch_chart_version
Cognoscognos_chart_version (under ibm_cp4d)
-

All default to "" — existing deployments are unaffected.

- - -

6. Instance Application Template Changes

- -

These charts now only render for CPD < 5.3.1. For ≥ 5.3.1 the root-app Helm Applications handle everything. The Helm Job blocks were removed.

- - - - - - - - - - - - - - - - - - - - - - - - - - - -
FileWhat changed
120-ibm-wml/templates/02-ibm-wml-cr.yamlAdded < 5.3.1 gate. For ≥ 5.3.1: stub ConfigMap only (so ArgoCD has a persistent non-hook resource and doesn't loop OutOfSync after the old Job deleted itself)
120-ibm-spark/templates/01-ibm-spark-cr.yamlSame — < 5.3.1 gate, ≥ 5.3.1 stub ConfigMap
120-ibm-spss/templates/01-ibm-spss-cr.yaml< 5.3.1 gate; fixed CR name spss-sample → spssmodeler-cr; removed incorrect datarefinery_operand_version/wsrt_operand_version fields (SPSS doesn't use them); stub ConfigMap for ≥ 5.3.1
120-ibm-spss/templates/00-ibm-spss_Subscription.yamlAdded < 5.3.1 gate. Restored full dual Subscription (canvasbase + SPSS) with installPlanApproval
120-ibm-wsl/templates/01-ibm-wsl-cr.yamlAdded < 5.3.1 gate. Stub ConfigMap for ≥ 5.3.1
120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yamlEntire file replaced with a single comment — Cognos has no OLM path at all; all logic moved to root app
- - -

7. CP4D Platform Changes

- - - - - - - - - - - - - - - - - - - -
FileWhat changed
110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yamlnew The olm-utils-cm ConfigMap for CPD 5.3.1 containing release_components_meta with case_version for every component. This is the single source of truth for chart versions on the cluster
110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yamlnew cpd-sa ServiceAccount + ClusterRole with CRD/Helm/escalate permissions needed by the ≥ 5.3.1 Helm apps
110-ibm-cp4d/templates/07-ibm-cp4d_Ibmcpd.yamlfix imagePullSecret: ibm_entitlement_key → ibm-entitlement-key (underscore→dash bug was causing the CP4D operator to fail pulling Common Services images)
110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yamlfix Added < 5.3.1 version gate — OLM Subscriptions for CCS/DataRefinery/WS-Runtimes are not needed for ≥ 5.3.1
- - -

8. RBAC Regeneration

- -

After adding ConfigMap resources to the ≥ 5.3.1 branches, generate_application_admin_rbac.py was re-run to add ConfigMap to the auto-generated RBAC rules:

-
    -
  • instance-applications/600-application-admin-rbac/templates/per-namespace-rbac.yaml
    • -
  • rbac/kustomize/base/application-admin-role.yaml
    • -
- - -

9. Commits in This Session

- - - - - - - - - - - -
CommitSummary
768133a1 - Added WSL (10 apps), Cognos (2 apps) native ArgoCD Helm Applications.
- Replaced all hardcoded targetRevision with olm-utils-cm lookup + fallback defaults.
- Moved SkipDryRunOnMissingResource=true from namespace-scoped apps to cluster-scoped apps only. -
34ea07b9 - Exposed chart versions as explicit gitops config values (wml_chart_version, spark_chart_version, etc.).
- 3-level priority chain: gitops config → olm-utils-cm → hardcoded default.
- Added new optional keys to all 5 service values.yaml files. -
- - -

10. Validation

- -

After every change set:

-
    -
  • ./build/bin/helm-lint.sh -p root-applications/ibm-mas-instance-root — 1 chart linted, 0 failed
    • -
  • ./build/bin/verify-job-definitions.sh . — 77 files scanned, 77 valid, 0 invalid
    • -
- -
Made with IBM Bob
-
- - diff --git a/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml b/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml index 0a997ba01..3c7dbfddc 100644 --- a/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml +++ b/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml @@ -176,6 +176,12 @@ spec: {{- end }} {{- end }} {{- else }} + {{- if $value.tririga_db_schema }} + tririga_db_schema: {{ $value.tririga_db_schema }} + {{- end }} + {{- end }} + + debug_mas_rds_databases: "EMPTY - No RDS databases configured for manage" {{- end }} {{- end }} diff --git a/watch_20260826-114330 b/watch_20260826-114330 deleted file mode 100644 index 74957ebd2..000000000 --- a/watch_20260826-114330 +++ /dev/null @@ -1,71 +0,0 @@ -NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE -export-zen-minio-0 Pending nfs-client 33s -export-zen-minio-1 Pending nfs-client 33s -export-zen-minio-2 Pending nfs-client 33s - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/watch_20260826-152105 b/watch_20260826-152105 deleted file mode 100644 index fa78c082e..000000000 --- a/watch_20260826-152105 +++ /dev/null @@ -1,71 +0,0 @@ -NAME CSV APPROVAL APPROVED -install-98bkc ibm-cpd-canvasbase.v8.5.0 Automatic true -install-bs99q ibm-cpd-datarefinery.v11.0.0 Automatic true -install-gnzzk ibm-cpd-spss.v8.5.0 Automatic true -install-gqhgk ibm-zen-operator.v6.2.0 Automatic true -install-j9gp9 cloud-native-postgresql.v1.25.2 Automatic true - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - From b9640746142ca9d60f3a590440660ca1094b05ad Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Wed, 12 Aug 2026 12:40:51 +0530 Subject: [PATCH 112/115] MASCORE-10022: make facilities TRIRIGA schema fully configurable in db2u scripts - Parameterise SCHEMA in files/facilities/runstats_volatile.sh via { db2_schema } placeholder so the periodic runstats cron job targets the correct schema on the pod - Parameterise TRIDATA_DATA/TRIDATA_INDX tablespace names in files/facilities/create-tablespaces.sh.j2 with { db2_schema }_DATA/_INDX placeholders so tablespaces are created with names matching the configured schema - Update the sed command for create-tablespaces.sh.j2 in 07-postsync-setup-db2_Job.yaml to substitute { db2_schema } at template-time (was only substituting db2_dbname) - Replace plain cp of runstats_volatile.sh in 07-postsync-setup-db2_Job.yaml with a sed call so the { db2_schema } placeholder is resolved before the script reaches the pod - Add DB2_SCHEMA env-driven variable in files/grant_check.sh (defaults to TRIDATA) and replace hardcoded 'TRIDATA' in the syscat.SCHEMATA IN-list so the recurring grant cron job discovers and maintains roles for non-standard schema names --- .../files/facilities/create-tablespaces.sh.j2 | 30 +++++++++---------- .../files/facilities/runstats_volatile.sh | 2 +- .../files/grant_check.sh | 3 +- .../templates/07-postsync-setup-db2_Job.yaml | 4 +-- 4 files changed, 20 insertions(+), 19 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/files/facilities/create-tablespaces.sh.j2 b/instance-applications/120-ibm-db2u-database/files/facilities/create-tablespaces.sh.j2 index 20ec291f7..edf29e5fc 100644 --- a/instance-applications/120-ibm-db2u-database/files/facilities/create-tablespaces.sh.j2 +++ b/instance-applications/120-ibm-db2u-database/files/facilities/create-tablespaces.sh.j2 @@ -163,9 +163,9 @@ fi echo "${TABLESPACES}" -if [[ ${TABLESPACES} != *"TRIDATA_DATA "* ]]; then - echo "Creating TABLESPACE TRIDATA_DATA" - db2 "CREATE LARGE TABLESPACE TRIDATA_DATA IN DATABASE PARTITION GROUP IBMDEFAULTGROUP +if [[ ${TABLESPACES} != *"{ db2_schema }_DATA "* ]]; then + echo "Creating TABLESPACE { db2_schema }_DATA" + db2 "CREATE LARGE TABLESPACE { db2_schema }_DATA IN DATABASE PARTITION GROUP IBMDEFAULTGROUP PAGESIZE 32768 MANAGED BY AUTOMATIC STORAGE AUTORESIZE YES INITIALSIZE 5000 M @@ -180,18 +180,18 @@ if [[ ${TABLESPACES} != *"TRIDATA_DATA "* ]]; then DROPPED TABLE RECOVERY ON;" rc=$? if [ $rc -ne "0" ]; then - echo "Unable to create TABLESPACE TRIDATA_DATA for some reason = $rc" + echo "Unable to create TABLESPACE { db2_schema }_DATA for some reason = $rc" exit $rc fi -else - echo "TABLESPACE TRIDATA_DATA already exists" +else + echo "TABLESPACE { db2_schema }_DATA already exists" fi -db2 "SELECT * FROM SYSCAT.TABLESPACES WHERE TBSPACE = 'TRIDATA_DATA'" +db2 "SELECT * FROM SYSCAT.TABLESPACES WHERE TBSPACE = '{ db2_schema }_DATA'" -if [[ ${TABLESPACES} != *"TRIDATA_INDX "* ]]; then - echo "Creating TABLESPACE TRIDATA_INDX" - db2 "CREATE LARGE TABLESPACE TRIDATA_INDX IN DATABASE PARTITION GROUP IBMDEFAULTGROUP +if [[ ${TABLESPACES} != *"{ db2_schema }_INDX "* ]]; then + echo "Creating TABLESPACE { db2_schema }_INDX" + db2 "CREATE LARGE TABLESPACE { db2_schema }_INDX IN DATABASE PARTITION GROUP IBMDEFAULTGROUP PAGESIZE 32768 MANAGED BY AUTOMATIC STORAGE AUTORESIZE YES INITIALSIZE 5000 M @@ -205,14 +205,14 @@ if [[ ${TABLESPACES} != *"TRIDATA_INDX "* ]]; then DROPPED TABLE RECOVERY ON;" rc=$? if [ $rc -ne "0" ]; then - echo "Unable to create TABLESPACE TRIDATA_INDX for some reason = $rc" + echo "Unable to create TABLESPACE { db2_schema }_INDX for some reason = $rc" exit $rc fi -else - echo "TABLESPACE TRIDATA_INDX already exists" -fi +else + echo "TABLESPACE { db2_schema }_INDX already exists" +fi -db2 "SELECT * FROM SYSCAT.TABLESPACES WHERE TBSPACE = 'TRIDATA_INDX'" +db2 "SELECT * FROM SYSCAT.TABLESPACES WHERE TBSPACE = '{ db2_schema }_INDX'" if [[ ${TABLESPACES} != *"TRITEMP "* ]]; then echo "Creating TABLESPACE TRITEMP" diff --git a/instance-applications/120-ibm-db2u-database/files/facilities/runstats_volatile.sh b/instance-applications/120-ibm-db2u-database/files/facilities/runstats_volatile.sh index 47280bd72..736de1e85 100644 --- a/instance-applications/120-ibm-db2u-database/files/facilities/runstats_volatile.sh +++ b/instance-applications/120-ibm-db2u-database/files/facilities/runstats_volatile.sh @@ -38,7 +38,7 @@ DATESTAMP=`date "+%Y-%m-%d-%H.%M.%S"` # Database and schema configuration DATABASE="BLUDB" -SCHEMA="TRIDATA" +SCHEMA={ db2_schema } # Loop through all databases (in case there are multiple) for db in `db2 list db directory | grep -B 5 Indirect | grep "Database name" | cut -d= -f2` diff --git a/instance-applications/120-ibm-db2u-database/files/grant_check.sh b/instance-applications/120-ibm-db2u-database/files/grant_check.sh index bf8ac3950..88f1c9aeb 100755 --- a/instance-applications/120-ibm-db2u-database/files/grant_check.sh +++ b/instance-applications/120-ibm-db2u-database/files/grant_check.sh @@ -86,11 +86,12 @@ then exit fi +DB2_SCHEMA="${DB2_SCHEMA:-TRIDATA}" role=`db2 get db cfg for $1 | grep "HADR database role" | cut -d= -f2 |sed 's/ //g'` if [ "$role" != "STANDBY" ]; then db2 connect to $1 if [ $? -eq 0 ]; then - schemalist=(`db2 connect to $1 >/dev/null;db2 -x "select SCHEMANAME from syscat.SCHEMATA where SCHEMANAME in ('MAXIMO','TRIDATA','TRIRIGADC')"`) + schemalist=(`db2 connect to $1 >/dev/null;db2 -x "select SCHEMANAME from syscat.SCHEMATA where SCHEMANAME in ('MAXIMO','${DB2_SCHEMA}','TRIRIGADC')"`) i=0 while [[ $i -lt ${#schemalist[*]} ]] do diff --git a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml index d08c340dc..883e1afc9 100644 --- a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml @@ -603,7 +603,7 @@ spec: FACILITIES_TABLESPACES_PATH=/tmp/db2-scripts-facilities-updated/create-tablespaces.sh FACILITIES_SCHEMA_PATH=/tmp/db2-scripts-facilities-updated/create-schema.sh sed "s/{ db2_dbname }/$DB2_DBNAME/g; s/{ db2_user }/$DB2_USER/g;" /tmp/db2-scripts-facilities/db2config.sh.j2 > ${FACILITIES_DB2_SETUP_PATH} - sed "s/{ db2_dbname }/$DB2_DBNAME/g;" /tmp/db2-scripts-facilities/create-tablespaces.sh.j2 > ${FACILITIES_TABLESPACES_PATH} + sed "s/{ db2_dbname }/$DB2_DBNAME/g; s/{ db2_schema }/$DB2_SCHEMA/g;" /tmp/db2-scripts-facilities/create-tablespaces.sh.j2 > ${FACILITIES_TABLESPACES_PATH} sed "s/{ db2_dbname }/$DB2_DBNAME/g; s/{ db2_user }/$DB2_USER/g; s/{ db2_schema }/$DB2_SCHEMA/g;" /tmp/db2-scripts-facilities/create-schema.sh.j2 > ${FACILITIES_SCHEMA_PATH} echo "" @@ -617,7 +617,7 @@ spec: echo "" echo "Copying runstats_volatile.sh to /mnt/backup/bin in c-${DB2_INSTANCE_NAME}-db2u-0" echo "--------------------------------------------------------------------------------" - cp /tmp/db2-scripts-facilities/runstats_volatile.sh /tmp/runstats_volatile.sh + sed "s/{ db2_schema }/$DB2_SCHEMA/g;" /tmp/db2-scripts-facilities/runstats_volatile.sh > /tmp/runstats_volatile.sh oc cp /tmp/runstats_volatile.sh ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0:/tmp/runstats_volatile.sh -c db2u || exit $? oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "sudo rm -f ${INSTHOME}/bin/runstats_volatile.sh && sudo mv /tmp/runstats_volatile.sh ${INSTHOME}/bin/runstats_volatile.sh && sudo chmod +x ${INSTHOME}/bin/runstats_volatile.sh && sudo chown db2inst1:db2iadm1 ${INSTHOME}/bin/runstats_volatile.sh" db2inst1 || exit $? # Execute db2configdb.sh From 7298df9cb3c520794b303f649b9d890f7e517563 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 3 Sep 2026 00:02:30 +0530 Subject: [PATCH 113/115] MASCORE-10022 remove unwanted files --- .../templates/510-550-ibm-mas-masapp-configs.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml b/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml index 0a997ba01..3c7dbfddc 100644 --- a/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml +++ b/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml @@ -176,6 +176,12 @@ spec: {{- end }} {{- end }} {{- else }} + {{- if $value.tririga_db_schema }} + tririga_db_schema: {{ $value.tririga_db_schema }} + {{- end }} + {{- end }} + + debug_mas_rds_databases: "EMPTY - No RDS databases configured for manage" {{- end }} {{- end }} From e50144c7a665dddd4fc254fd90261fea6cff74ef Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 3 Sep 2026 13:44:28 +0530 Subject: [PATCH 114/115] MASCORE-10022 fix tririga_db_schema inside facilities block --- .../templates/510-550-ibm-mas-masapp-configs.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml b/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml index 3c7dbfddc..d40adf55a 100644 --- a/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml +++ b/root-applications/ibm-mas-instance-root/templates/510-550-ibm-mas-masapp-configs.yaml @@ -176,15 +176,12 @@ spec: {{- end }} {{- end }} {{- else }} - {{- if $value.tririga_db_schema }} - tririga_db_schema: {{ $value.tririga_db_schema }} - {{- end }} - {{- end }} debug_mas_rds_databases: "EMPTY - No RDS databases configured for manage" {{- end }} {{- end }} + {{- if (eq $value.mas_app_id "facilities") }} {{- if not (empty $.Values.ibm_dbs_rds_databases) }} @@ -202,6 +199,9 @@ spec: {{- end }} {{- end }} {{- end }} + {{- if $value.tririga_db_schema }} + tririga_db_schema: {{ $value.tririga_db_schema }} + {{- end }} {{- end }} {{- if (eq $value.mas_app_id "iot") }} From edbb398a0b28847b69bccab0cdca5ee0dd43fe71 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 4 Sep 2026 11:11:37 +0530 Subject: [PATCH 115/115] MASCORE-10022: add facilities_db2_schema to values, make RDS path fully configurable --- .../templates/07-postsync-setup-db2_Job.yaml | 2 +- instance-applications/120-ibm-db2u-database/values.yaml | 1 + .../120-ibm-dbs-rds-database/templates/00-configmap.yaml | 6 ++++-- .../templates/01-dbs-rds-postsync-setup.yaml | 4 +++- instance-applications/120-ibm-dbs-rds-database/values.yaml | 7 ++++++- .../510-550-ibm-mas-suite-app-config/values.yaml | 6 +++++- 6 files changed, 20 insertions(+), 6 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml index 883e1afc9..bb026d4d5 100644 --- a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml @@ -447,7 +447,7 @@ spec: if [[ "$MAS_APP_ID" == "manage" ]]; then export DB2_SCHEMA="MAXIMO" elif [[ "$MAS_APP_ID" == "facilities" ]]; then - export DB2_SCHEMA="TRIDATA" + export DB2_SCHEMA="{{ .Values.facilities_db2_schema | default "TRIDATA" }}" fi if [[ "$MAS_APP_ID" == "manage" ]]; then diff --git a/instance-applications/120-ibm-db2u-database/values.yaml b/instance-applications/120-ibm-db2u-database/values.yaml index e8767691a..fddb167cb 100644 --- a/instance-applications/120-ibm-db2u-database/values.yaml +++ b/instance-applications/120-ibm-db2u-database/values.yaml @@ -3,6 +3,7 @@ instance_id: xxx db2_instance_name: xxx db2_namespace: xxxx db2_instance_home_path: /mnt/blumeta0/home/db2inst1 +facilities_db2_schema: "TRIDATA" sm_aws_access_key_id: xxx sm_aws_secret_access_key: xxxx diff --git a/instance-applications/120-ibm-dbs-rds-database/templates/00-configmap.yaml b/instance-applications/120-ibm-dbs-rds-database/templates/00-configmap.yaml index 599f36286..3b457e29d 100644 --- a/instance-applications/120-ibm-dbs-rds-database/templates/00-configmap.yaml +++ b/instance-applications/120-ibm-dbs-rds-database/templates/00-configmap.yaml @@ -17,6 +17,8 @@ data: import sys import re import time + tririga_schema = os.getenv("TRIRIGA_SCHEMA", "TRIDATA") + # Initialization of mas_application_id = os.getenv("MAS_APP_ID") @@ -283,8 +285,8 @@ data: ("MAXTEMP", "MAXTEMPBP"), ] facilities_tablespaces = [ - ("TRIDATA_DATA", "TRIBUFPOOL"), - ("TRIDATA_INDX", "TRIBUFPOOLINDEX"), + (f"{tririga_schema}_DATA", "TRIBUFPOOL"), + (f"{tririga_schema}_INDX", "TRIBUFPOOLINDEX"), ("TRITEMP", "TRITEMPBP"), ("DEDICATED_DATA", "DEDICATEDBPDATA"), ("DEDICATED_INDEX", "DEDICATEDBPINDX"), diff --git a/instance-applications/120-ibm-dbs-rds-database/templates/01-dbs-rds-postsync-setup.yaml b/instance-applications/120-ibm-dbs-rds-database/templates/01-dbs-rds-postsync-setup.yaml index 4db779867..d8064b0f9 100644 --- a/instance-applications/120-ibm-dbs-rds-database/templates/01-dbs-rds-postsync-setup.yaml +++ b/instance-applications/120-ibm-dbs-rds-database/templates/01-dbs-rds-postsync-setup.yaml @@ -25,7 +25,7 @@ E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v2" }} +{{- $_job_version := "v3" }} {{- /* 10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest @@ -165,6 +165,8 @@ spec: - name: DB2_DATABASE_CONFIG value: {{ .Values.db2_database_db_config | toJson | quote }} {{- end }} + - name: TRIRIGA_SCHEMA + value: {{ .Values.facilities_db2_schema | default "TRIDATA" | quote }} volumeMounts: - name: dbs-rds-secret-store mountPath: /etc/mas/dbs-rds-creds/ diff --git a/instance-applications/120-ibm-dbs-rds-database/values.yaml b/instance-applications/120-ibm-dbs-rds-database/values.yaml index 20014ed82..5a98c2b89 100644 --- a/instance-applications/120-ibm-dbs-rds-database/values.yaml +++ b/instance-applications/120-ibm-dbs-rds-database/values.yaml @@ -45,4 +45,9 @@ backup: # Full backup configuration (Sundays at 2 AM) full: enabled: true - schedule: "0 2 * * 0" # Cron: Every Sunday at 2 AM \ No newline at end of file + schedule: "0 2 * * 0" # Cron: Every Sunday at 2 AM + +# TRIRIGA schema name for the Facilities application. +# Only change this if the source system uses a non-standard schema name. +# Defaults to TRIDATA — existing deployments are unaffected. +facilities_db2_schema: "TRIDATA" diff --git a/instance-applications/510-550-ibm-mas-suite-app-config/values.yaml b/instance-applications/510-550-ibm-mas-suite-app-config/values.yaml index 36d85685c..218b38957 100644 --- a/instance-applications/510-550-ibm-mas-suite-app-config/values.yaml +++ b/instance-applications/510-550-ibm-mas-suite-app-config/values.yaml @@ -49,4 +49,8 @@ run_sanity_test: false # customization_archive_secret_names: # - secret_name: "" # username: "" -# password: "" \ No newline at end of file +# password: "" + + +# Facilities (TRIRIGA) schema name. Defaults to TRIDATA. +# tririga_db_schema: "TRIDATA" \ No newline at end of file