From bb3711eedc8afbe0c52e550a7c61c8fd812acf63 Mon Sep 17 00:00:00 2001
From: Hardik-Prajapati <hardik.prajapati@ibm.com>
Date: Thu, 10 Sep 2026 12:05:18 +0530
Subject: [PATCH] namespace corrected .

---
 .../600-ibm-post-sync-jobs/values.yaml        |  1 +
 .../templates/600-ibm-post-sync-jobs.yaml     |  1 +
 .../templates/ibm-entitlement-secret.yaml     | 20 +++++++++++++++++++
 .../templates/postsync-fvt-gitops-job.yaml    | 12 +++++------
 sub-charts/fvt-gitops-runner/values.yaml      |  5 +++++
 5 files changed, 33 insertions(+), 6 deletions(-)
 create mode 100644 sub-charts/fvt-gitops-runner/templates/ibm-entitlement-secret.yaml

diff --git a/instance-applications/600-ibm-post-sync-jobs/values.yaml b/instance-applications/600-ibm-post-sync-jobs/values.yaml
index 3e62d78ec..a40c471ac 100644
--- a/instance-applications/600-ibm-post-sync-jobs/values.yaml
+++ b/instance-applications/600-ibm-post-sync-jobs/values.yaml
@@ -2,6 +2,7 @@
 
 fvt-gitops-runner:
   enabled: true
+  ibm_entitlement_key: ""
   devops_mongo_uri: ""
   devops_build_number: ""
   instance_id: ""
diff --git a/root-applications/ibm-mas-instance-root/templates/600-ibm-post-sync-jobs.yaml b/root-applications/ibm-mas-instance-root/templates/600-ibm-post-sync-jobs.yaml
index 7968efbc0..f46fe7a89 100644
--- a/root-applications/ibm-mas-instance-root/templates/600-ibm-post-sync-jobs.yaml
+++ b/root-applications/ibm-mas-instance-root/templates/600-ibm-post-sync-jobs.yaml
@@ -110,6 +110,7 @@ spec:
               enabled_apps: "{{ join "," $enabled_apps }}"
               fvt_gitops_image_repo: "{{ .Values.fvt_gitops.image_repo | default "docker-na-public.artifactory.swg-devops.com/wiotp-docker-local/mas-devops/fvt-gitops" }}"
               fvt_gitops_image_tag: "{{ .Values.fvt_gitops.image_tag | default "latest" }}"
+              ibm_entitlement_key: "{{ (default (dict) .Values.ibm_mas_suite).ibm_entitlement_key }}"
               {{- if .Values.custom_labels }}
               custom_labels: {{ .Values.custom_labels | toYaml | nindent 16 }}
               {{- end }}
diff --git a/sub-charts/fvt-gitops-runner/templates/ibm-entitlement-secret.yaml b/sub-charts/fvt-gitops-runner/templates/ibm-entitlement-secret.yaml
new file mode 100644
index 000000000..34373d17d
--- /dev/null
+++ b/sub-charts/fvt-gitops-runner/templates/ibm-entitlement-secret.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.ibm_entitlement_key }}
+---
+# Secret — IBM Entitlement pull secret for the postsyncjobs namespace.
+# Required so the fvt-gitops Job can pull images from the Artifactory registry.
+kind: Secret
+apiVersion: v1
+metadata:
+  name: ibm-entitlement
+  annotations:
+    argocd.argoproj.io/sync-wave: "1001"
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation
+{{- if .Values.custom_labels }}
+  labels:
+{{ .Values.custom_labels | toYaml | indent 4 }}
+{{- end }}
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: {{ .Values.ibm_entitlement_key }}
+{{- end }}
diff --git a/sub-charts/fvt-gitops-runner/templates/postsync-fvt-gitops-job.yaml b/sub-charts/fvt-gitops-runner/templates/postsync-fvt-gitops-job.yaml
index b70a0cabe..bd387b937 100644
--- a/sub-charts/fvt-gitops-runner/templates/postsync-fvt-gitops-job.yaml
+++ b/sub-charts/fvt-gitops-runner/templates/postsync-fvt-gitops-job.yaml
@@ -124,7 +124,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: {{ $sa }}
-    namespace: {{ .Release.Namespace }}
+    namespace: "mas-{{ .Values.instance_id }}-postsyncjobs"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -174,7 +174,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: {{ $sa }}
-    namespace: {{ .Release.Namespace }}
+    namespace: "mas-{{ .Values.instance_id }}-postsyncjobs"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -218,7 +218,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: {{ $sa }}
-    namespace: {{ .Release.Namespace }}
+    namespace: "mas-{{ .Values.instance_id }}-postsyncjobs"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -262,7 +262,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: {{ $sa }}
-    namespace: {{ .Release.Namespace }}
+    namespace: "mas-{{ .Values.instance_id }}-postsyncjobs"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -306,7 +306,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: {{ $sa }}
-    namespace: {{ .Release.Namespace }}
+    namespace: "mas-{{ .Values.instance_id }}-postsyncjobs"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -357,7 +357,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: {{ $sa }}
-    namespace: {{ .Release.Namespace }}
+    namespace: "mas-{{ .Values.instance_id }}-postsyncjobs"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/sub-charts/fvt-gitops-runner/values.yaml b/sub-charts/fvt-gitops-runner/values.yaml
index 162bae855..3361dbfb8 100644
--- a/sub-charts/fvt-gitops-runner/values.yaml
+++ b/sub-charts/fvt-gitops-runner/values.yaml
@@ -42,3 +42,8 @@ argo_namespace: "openshift-gitops"
 
 # Optional custom labels applied to all resources
 custom_labels: {}
+
+# IBM Entitlement key (base64-encoded dockerconfigjson) — used to create the
+# ibm-entitlement pull secret in the postsyncjobs namespace so the Job can
+# pull images from the Artifactory registry.
+ibm_entitlement_key: ""