From 19f60af874fc746c3d2c0d5fb543246e070cc6e8 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 21 Jul 2026 11:22:29 +0530 Subject: [PATCH 001/103] Added CPD 5.3.1 gitops support --- .../templates/00-ibm-cp4d-olm-531.yaml | 678 ++++++++++++++++++ .../templates/01-ibm-cp4d-CatalogSources.yaml | 72 ++ .../templates/00-ibm-cp4d-olm-531.yaml | 677 +++++++++++++++++ .../04-db2u-Volatile-Runstats_Cron.yaml | 1 + 4 files changed, 1428 insertions(+) create mode 100644 instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml create mode 100644 instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml diff --git a/instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml b/instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml new file mode 100644 index 000000000..fb9b366fd --- /dev/null +++ b/instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml @@ -0,0 +1,678 @@ +{{- if eq .Values.cpd_product_version "5.3.1" }} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: olm-utils-cm + namespace: mas-{{ .Values.instance_id }}-syncres + annotations: + argocd.argoproj.io/sync-wave: "00" + labels: + app.kubernetes.io/name: olm-utils +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +data: + licenses_urls: |- + SWHP: + url: "https://ibm.biz/BdbGRu" + description: "IBM Software Hub Premium Cartridge" + SWHAI: + url: "https://ibm.biz/BdbGRL" + description: "IBM Softare Hub AI Assistant Cartridge" + EE: + url: https://ibm.biz/Bdbq3x + description: "IBM Cloud Pak for Data Enterprise Edition" + SE: + url: https://ibm.biz/Bdbq3H + description: "IBM Cloud Pak for Data Standard Edition" + WXAI: + url: https://ibm.biz/BdbKbw + description: "IBM watsonx.ai" + DB2CE: + url: https://ibm.biz/BdnPB7 + description: "IBM Db2 Community Edition" + DB2SE: + url: https://ibm.biz/BdnPdB + description: "IBM Db2 Standard Edition Cartridge for IBM Cloud Pak for Data" + DB2AE: + url: https://ibm.biz/BdnPBW + description: "IBM Db2 Advanced Edition Cartridge for IBM Cloud Pak for Data" + DG: + url: "https://ibm.biz/dg4zos_v320" + description: "IBM Data Gate for z/OS with Cloud Pak for Data" + DGWXD: + url: "https://ibm.biz/dgx_v13" + description: "IBM Data Gate for watsonx" + DGWXDB: + url: "https://ibm.biz/wxd-dgx" + description: "IBM watsonx.data with Data Gate for IBM Z" + DGWXDPB: + url: "https://ibm.biz/wxdprem-dgx111" + description: "IBM watsonx.data Premium with Data Gate for IBM Z" + DGFS: + url: "https://ibm.biz/dg4fs_v13" + description: "IBM Data Gate for Financial Services" + IKCS: + url: https://ibm.biz/Bdmm4V + description: "IBM Knowledge Catalog Standard" + IKCP: + url: https://ibm.biz/Bdmm4J + description: "IBM Knowledge Catalog Premium" + IDRC: + url: https://ibm.biz/BdpHpg + description: "IBM Data Replication Cartridge" + IIDRC: + url: https://ibm.biz/BdpHph + description: "IBM InfoSphere Data Replication Cartridge" + IDRM: + url: https://ibm.biz/BdpHpJ + description: "IBM Data Replication Modernization" + IIDRM: + url: https://ibm.biz/BdpHpA + description: "IBM InfoSphere Data Replication Modernization" + IDRZOS: + url: https://ibm.biz/BdpHp9 + description: "IBM Data Replication for Db2 z/OS Cartridge" + IIDRWXTO: + url: https://ibm.biz/BdpHpu + description: "IBM InfoSphere Data Replication for watsonx.data Cartridge" + IIDRWXAO: + url: https://ibm.biz/BdpHpL + description: "IBM InfoSphere Data Replication Cartridge Add-on for IBM watsonx.data" + WXD: + url: https://ibm.biz/BdpdBF + description: "IBM watsonx.data" + WXDP: + url: https://ibm.biz/BdpzEx + description: "IBM watsonx.data Premium Edition" + WCA: + url: https://ibm.biz/Bdbv9x + description: "IBM watsonx Code Assistant" + WCAA: + url: https://ibm.biz/Bdbv9D + description: "IBM watsonx Code Assistant for Red Hat Ansible Lightspeed" + DPH: + url: https://ibm.biz/BdbQMv + description: "IBM Data Product Hub" + + release_components_meta: |- + scheduler: + case_version: 1.61.0 + sub_channel: "v1.61" + csv_version: 1.61.0 + cr_version: 1.61.0 + + cpfs: + csv_version: 4.17.0 + case_version: 4.17.0 + sub_channel: "v4.17" + + ibm-common-service-operator: + cr_version: 4.17.0 + + ibm-iam-operator: + cr_version: 4.16.0 + + ibm-namespace-scope-operator: + cr_version: 4.3.4 + + ibm-cert-manager: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_events_operator: + case_version: 6.0.0 + sub_channel: "v6.0" + csv_version: 6.0.0 + cr_version: 4.1.1 + + streamsets: + case_version: 9.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-streamsets-sdi: + case_version: 2.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-licensing: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_usage_metering: + case_version: 1.0.4 + csv_version: 1.0.4 + sub_channel: "v1.0" + cr_version: 1.0.4 + + cpd_platform: + case_version: 5.4.0 + csv_version: 6.4.0 + sub_channel: "v6.4" + cr_version: 5.4.0 + + platform-config: + cr_version: 5.4.0 + + ibm_swhcc: + case_version: 5.4.0 + csv_version: 5.4.0 + sub_channel: "v5.4" + cr_version: 5.4.0 + + zen: + case_version: 6.4.0 + sub_channel: "v6.4" + csv_version: 6.4.0 + cr_version: 6.4.0 + + analyticsengine: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + cognos_analytics: + case_version: 29.1.0 + sub_channel: "v29.1" + cr_version: 29.1.0 + csv_version: 29.1.0 + + ccs: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + dashboard: + case_version: 4.0.0 + sub_channel: "v4.0" + csv_version: 4.0.0 + cr_version: 5.3.0 + + datarefinery: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: "v12.1" + cr_version: 12.1.0 + + canvasbase: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + spss: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + syntheticdata: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + datastage_ent: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + datastage_ent_plus: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + informix: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + informix_cp4d: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + openscale: + case_version: 10.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + ws: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + ws_runtimes: + case_version: 12.1.0 + cr_version: 12.1.0 + + db2aaservice: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2oltp: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2wh: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2u: + case_version: 7.5.2 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + datagate: + case_version: 11.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 9.1.0 + + dods: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + hee: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + dv: + case_version: 8.1.0 + sub_channel: "v8.1" + csv_version: 8.1.0 + cr_version: 3.3.1 + + bigsql: + case_version: 14.1.0 + sub_channel: "v14.1" + csv_version: 14.1.0 + cr_version: 8.3.1 + + planning_analytics: + case_version: 5.3.1 + sub_channel: "v11.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + rstudio: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + watson_assistant: + case_version: 5.11.0 + sub_channel: "v5.11" + csv_version: 5.11.0 + cr_version: "5.3.1" + + watson_discovery: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + watson_speech: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + wkc: + case_version: 5.3.1 + sub_channel: "v9.1" + csv_version: 2.3.1 + cr_version: 5.3.1 + + ikc_standard: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + ikc_premium: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + datalineage: + case_version: 5.3.1 + sub_channel: "v7.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + udp: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster: + case_version: 9.1.0 + csv_version: 9.1.0 + sub_channel: "v9.1" + cr_version: 9.1.0 + + dataproduct: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + semantic_automation: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster_instance: + cr_version: 9.1.0 + + dp: + case_version: 11.1.0 + csv_version: 11.1.0 + sub_channel: "v11.1" + cr_version: 5.3.1 + + wml: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + dmc: + case_version: 8.11.0 + csv_version: 5.11.0 + cr_version: 5.3.1 + sub_channel: "v5.11" + + openpages: + case_version: 10.1.0 + csv_version: 10.1.0 + cr_version: 9.7.0 + sub_channel: "v10.1" + + openpages_instance: + cr_version: 9.7.0 + + mantaflow: + case_version: 2.4.0 + csv_version: 2.4.0 + sub_channel: "v2.4" + cr_version: 42.15.0 + + match360: + case_version: 4.11.0 + csv_version: 4.11.0 + cr_version: 4.11.50 + sub_channel: "v4.11" + + model_gateway: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + opencontent_opensearch: + case_version: 1.2.0 + csv_version: 1.2.0 + cr_version: 1.2.0 + sub_channel: "v1.1" + + opencontent_redis: + case_version: 1.6.11 + csv_version: 1.6.11 + sub_channel: "v1.6" + + ibm_redis_cp: + case_version: 1.3.1 + csv_version: 1.3.1 + sub_channel: "v1.3" + cr_version: 1.3.1 + + opencontent_rabbitmq: + case_version: 1.3.0 + csv_version: 1.3.0 + sub_channel: "v1.0" + cr_version: 1.3.0 + + opencontent_fdb: + case_version: 5.3.1 + csv_version: 5.3.1 + cr_version: 5.3.1 + sub_channel: "v5.3" + + fdb_k8s: + csv_version: 5.3.1 + sub_channel: "v5.3" + + opencontent_minio: + case_version: 1.0.23 + csv_version: 1.0.18 + + opencontent_etcd: + case_version: 2.0.57 + csv_version: 1.0.47 + + opencontent_auditwebhook: + case_version: 1.0.24 + csv_version: 0.3.1 + + watson_gateway: + case_version: 2.2.0 + csv_version: 2.2.0 + cr_version: 2.2.0 + + data_governor: + case_version: 8.1.0 + csv_version: 8.1.0 + sub_channel: v8.1 + cr_version: 3.29.4 + + ws_pipelines: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 5.3.1 + + postgresql: + case_version: 5.31.0 + sub_channel: "stable-v1.25" + csv_version: 1.25.5 + cr_version: 1.25.5 + + edb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + mongodb: + case_version: 5.31.0 + sub_channel: "stable" + csv_version: 1.33.0 + cr_version: 5.31.0 + + mongodb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + dpra: + deprecated: true + case_version: 1.20.0 + sub_channel: "v1.20" + csv_version: 1.20.0 + cr_version: 1.20.0 + + factsheet: + case_version: 7.1.0 + csv_version: 7.1.0 + sub_channel: "v7.1" + cr_version: 5.3.1 + + replication: + case_version: 5.3.1 + csv_version: 7.1.0 + cr_version: 5.3.1 + sub_channel: "v7.1" + + voice_gateway: + case_version: 1.13.0 + csv_version: 1.13.0 + sub_channel: v1.13 + cr_version: 1.13.0 + + watsonx_data: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + watsonx_data_premium: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + wxd_query_optimizer: + component_dependencies: + - db2u + + watsonx_ai: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + osai_min_version: 2.19.0 + + watsonx_ai_ifm: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + + watsonx_bi_assistant: + case_version: 3.4.0 + csv_version: 3.4.0 + sub_channel: v3.4 + cr_version: 3.4.0 + + wca_ansible: + case_version: 4.1.0 + cr_version: 5.3.1 + + wca: + case_version: 3.1.0 + cr_version: 5.3.1 + + wca_z: + case_version: 4.1.0 + csv_version: 4.1.0 + sub_channel: v4.0 + cr_version: 5.3.1 + + wca_z_agentic: + case_version: 2.0.1 + csv_version: 2.0.1 + sub_channel: v2.1 + cr_version: 2.7.1 + + wca_z_ce: + case_version: 5.3.1 + sub_channel: v2.8 + csv_version: 2.8.10 + cr_version: 2.8.10 + + wca_z_cg: + case_version: 5.3.1 + sub_channel: v1.1 + csv_version: 1.1.1 + cr_version: 2.8.10 + + wca_base: + case_version: 4.1.0 + cr_version: 5.3.1 + + ibm_neo4j: + case_version: 1.3.1 + sub_channel: "v4.1" + csv_version: 1.3.1 + cr_version: 1.3.1 + + watsonx_governance: + case_version: 5.1.0 + sub_channel: "v5.1" + csv_version: 5.1.0 + cr_version: 2.3.1 + + watsonx_orchestrate: + case_version: 7.1.0 + sub_channel: "v7.1" + csv_version: 7.1.0 + cr_version: "7.1.0" + + watsonx_dataintegration: + case_version: 2.4.0 + sub_channel: "v2.4" + csv_version: 5.3.1 + cr_version: 2.3.1 + + watsonx_dataintelligence: + case_version: 2.3.1 + sub_channel: "v2.31" + csv_version: 2.3.1 + cr_version: 2.3.1 + + wca_z_understand: + case_version: 1.1.0 + csv_version: 1.1.0 + sub_channel: v1.1 + cr_version: 2.8.10 + + ibm-databand: + case_version: 1.0.0 + csv_version: 1.0.0 + cr_version: 1.0.0 + sub_channel: "v1.0.0" + + datastax_mc: + case_version: 1.16.1 + cr_version: 1.16.1 + + ibm_wxd_opensearch: + case_version: 3.3.2 + cr_version: 3.3.2 + release_version: 5.3.1 +{{- end }} + + + diff --git a/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml b/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml index 461104031..499b3ad64 100644 --- a/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml +++ b/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml @@ -293,4 +293,76 @@ spec: registryPoll: interval: 30m0s {{- end }} +{{- end }} + + +# cpd 5.3.1 catalog sources +{{- if eq .Values.cpd_product_version "5.3.1" }} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: CatalogSource +metadata: + name: cpd-platform + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "001" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + displayName: ibm-cp-datacore-6.4.0-50 + image: icr.io/cpopen/ibm-cpd-platform-operator-catalog@sha256:0a63f6bf9c312efc3daca05a657c70f300eaef7f5a36055753b11fcf014688ca + publisher: IBM + sourceType: grpc + updateStrategy: + registryPoll: + interval: 30m0s + +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: CatalogSource +metadata: + name: opencloud-operators + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "001" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} {{- end }} +spec: + displayName: ibm-cp-common-services-4.17.0 + image: icr.io/cpopen/ibm-common-service-catalog@sha256:de97dd2a35b4c58da9b7ad5d89976d7a4184541e2e0a78a1c71e441a0105ce6e + publisher: IBM + sourceType: grpc + updateStrategy: + registryPoll: + interval: 30m0s + +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: CatalogSource +metadata: + name: ibm-zen-operator-catalog + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "001" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + displayName: ibm-zen-6.4.0-92 + image: icr.io/cpopen/ibm-zen-operator-catalog@sha256:9a02519e5ab679f0807fc5b7cfc5fc96242961bee0e1d3144012d33e925e6a99 + publisher: IBM + sourceType: grpc + updateStrategy: + registryPoll: + interval: 30m0s +{{- end }} +{{- end }} + + + + diff --git a/instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml b/instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml new file mode 100644 index 000000000..ae436acc7 --- /dev/null +++ b/instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml @@ -0,0 +1,677 @@ +{{- if eq .Values.cpd_product_version "5.3.1" }} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: olm-utils-cm + namespace: {{ .Values.cpd_instance_namespace }} + annotations: + argocd.argoproj.io/sync-wave: "00" + labels: + app.kubernetes.io/name: olm-utils +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +data: + licenses_urls: |- + SWHP: + url: "https://ibm.biz/BdbGRu" + description: "IBM Software Hub Premium Cartridge" + SWHAI: + url: "https://ibm.biz/BdbGRL" + description: "IBM Softare Hub AI Assistant Cartridge" + EE: + url: https://ibm.biz/Bdbq3x + description: "IBM Cloud Pak for Data Enterprise Edition" + SE: + url: https://ibm.biz/Bdbq3H + description: "IBM Cloud Pak for Data Standard Edition" + WXAI: + url: https://ibm.biz/BdbKbw + description: "IBM watsonx.ai" + DB2CE: + url: https://ibm.biz/BdnPB7 + description: "IBM Db2 Community Edition" + DB2SE: + url: https://ibm.biz/BdnPdB + description: "IBM Db2 Standard Edition Cartridge for IBM Cloud Pak for Data" + DB2AE: + url: https://ibm.biz/BdnPBW + description: "IBM Db2 Advanced Edition Cartridge for IBM Cloud Pak for Data" + DG: + url: "https://ibm.biz/dg4zos_v320" + description: "IBM Data Gate for z/OS with Cloud Pak for Data" + DGWXD: + url: "https://ibm.biz/dgx_v13" + description: "IBM Data Gate for watsonx" + DGWXDB: + url: "https://ibm.biz/wxd-dgx" + description: "IBM watsonx.data with Data Gate for IBM Z" + DGWXDPB: + url: "https://ibm.biz/wxdprem-dgx111" + description: "IBM watsonx.data Premium with Data Gate for IBM Z" + DGFS: + url: "https://ibm.biz/dg4fs_v13" + description: "IBM Data Gate for Financial Services" + IKCS: + url: https://ibm.biz/Bdmm4V + description: "IBM Knowledge Catalog Standard" + IKCP: + url: https://ibm.biz/Bdmm4J + description: "IBM Knowledge Catalog Premium" + IDRC: + url: https://ibm.biz/BdpHpg + description: "IBM Data Replication Cartridge" + IIDRC: + url: https://ibm.biz/BdpHph + description: "IBM InfoSphere Data Replication Cartridge" + IDRM: + url: https://ibm.biz/BdpHpJ + description: "IBM Data Replication Modernization" + IIDRM: + url: https://ibm.biz/BdpHpA + description: "IBM InfoSphere Data Replication Modernization" + IDRZOS: + url: https://ibm.biz/BdpHp9 + description: "IBM Data Replication for Db2 z/OS Cartridge" + IIDRWXTO: + url: https://ibm.biz/BdpHpu + description: "IBM InfoSphere Data Replication for watsonx.data Cartridge" + IIDRWXAO: + url: https://ibm.biz/BdpHpL + description: "IBM InfoSphere Data Replication Cartridge Add-on for IBM watsonx.data" + WXD: + url: https://ibm.biz/BdpdBF + description: "IBM watsonx.data" + WXDP: + url: https://ibm.biz/BdpzEx + description: "IBM watsonx.data Premium Edition" + WCA: + url: https://ibm.biz/Bdbv9x + description: "IBM watsonx Code Assistant" + WCAA: + url: https://ibm.biz/Bdbv9D + description: "IBM watsonx Code Assistant for Red Hat Ansible Lightspeed" + DPH: + url: https://ibm.biz/BdbQMv + description: "IBM Data Product Hub" + + release_components_meta: |- + scheduler: + case_version: 1.61.0 + sub_channel: "v1.61" + csv_version: 1.61.0 + cr_version: 1.61.0 + + cpfs: + csv_version: 4.17.0 + case_version: 4.17.0 + sub_channel: "v4.17" + + ibm-common-service-operator: + cr_version: 4.17.0 + + ibm-iam-operator: + cr_version: 4.16.0 + + ibm-namespace-scope-operator: + cr_version: 4.3.4 + + ibm-cert-manager: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_events_operator: + case_version: 6.0.0 + sub_channel: "v6.0" + csv_version: 6.0.0 + cr_version: 4.1.1 + + streamsets: + case_version: 9.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-streamsets-sdi: + case_version: 2.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-licensing: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_usage_metering: + case_version: 1.0.4 + csv_version: 1.0.4 + sub_channel: "v1.0" + cr_version: 1.0.4 + + cpd_platform: + case_version: 5.4.0 + csv_version: 6.4.0 + sub_channel: "v6.4" + cr_version: 5.4.0 + + platform-config: + cr_version: 5.4.0 + + ibm_swhcc: + case_version: 5.4.0 + csv_version: 5.4.0 + sub_channel: "v5.4" + cr_version: 5.4.0 + + zen: + case_version: 6.4.0 + sub_channel: "v6.4" + csv_version: 6.4.0 + cr_version: 6.4.0 + + analyticsengine: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + cognos_analytics: + case_version: 29.1.0 + sub_channel: "v29.1" + cr_version: 29.1.0 + csv_version: 29.1.0 + + ccs: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + dashboard: + case_version: 4.0.0 + sub_channel: "v4.0" + csv_version: 4.0.0 + cr_version: 5.3.0 + + datarefinery: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: "v12.1" + cr_version: 12.1.0 + + canvasbase: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + spss: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + syntheticdata: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + datastage_ent: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + datastage_ent_plus: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + informix: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + informix_cp4d: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + openscale: + case_version: 10.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + ws: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + ws_runtimes: + case_version: 12.1.0 + cr_version: 12.1.0 + + db2aaservice: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2oltp: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2wh: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2u: + case_version: 7.5.2 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + datagate: + case_version: 11.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 9.1.0 + + dods: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + hee: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + dv: + case_version: 8.1.0 + sub_channel: "v8.1" + csv_version: 8.1.0 + cr_version: 3.3.1 + + bigsql: + case_version: 14.1.0 + sub_channel: "v14.1" + csv_version: 14.1.0 + cr_version: 8.3.1 + + planning_analytics: + case_version: 5.3.1 + sub_channel: "v11.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + rstudio: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + watson_assistant: + case_version: 5.11.0 + sub_channel: "v5.11" + csv_version: 5.11.0 + cr_version: "5.3.1" + + watson_discovery: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + watson_speech: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + wkc: + case_version: 5.3.1 + sub_channel: "v9.1" + csv_version: 2.3.1 + cr_version: 5.3.1 + + ikc_standard: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + ikc_premium: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + datalineage: + case_version: 5.3.1 + sub_channel: "v7.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + udp: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster: + case_version: 9.1.0 + csv_version: 9.1.0 + sub_channel: "v9.1" + cr_version: 9.1.0 + + dataproduct: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + semantic_automation: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster_instance: + cr_version: 9.1.0 + + dp: + case_version: 11.1.0 + csv_version: 11.1.0 + sub_channel: "v11.1" + cr_version: 5.3.1 + + wml: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + dmc: + case_version: 8.11.0 + csv_version: 5.11.0 + cr_version: 5.3.1 + sub_channel: "v5.11" + + openpages: + case_version: 10.1.0 + csv_version: 10.1.0 + cr_version: 9.7.0 + sub_channel: "v10.1" + + openpages_instance: + cr_version: 9.7.0 + + mantaflow: + case_version: 2.4.0 + csv_version: 2.4.0 + sub_channel: "v2.4" + cr_version: 42.15.0 + + match360: + case_version: 4.11.0 + csv_version: 4.11.0 + cr_version: 4.11.50 + sub_channel: "v4.11" + + model_gateway: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + opencontent_opensearch: + case_version: 1.2.0 + csv_version: 1.2.0 + cr_version: 1.2.0 + sub_channel: "v1.1" + + opencontent_redis: + case_version: 1.6.11 + csv_version: 1.6.11 + sub_channel: "v1.6" + + ibm_redis_cp: + case_version: 1.3.1 + csv_version: 1.3.1 + sub_channel: "v1.3" + cr_version: 1.3.1 + + opencontent_rabbitmq: + case_version: 1.3.0 + csv_version: 1.3.0 + sub_channel: "v1.0" + cr_version: 1.3.0 + + opencontent_fdb: + case_version: 5.3.1 + csv_version: 5.3.1 + cr_version: 5.3.1 + sub_channel: "v5.3" + + fdb_k8s: + csv_version: 5.3.1 + sub_channel: "v5.3" + + opencontent_minio: + case_version: 1.0.23 + csv_version: 1.0.18 + + opencontent_etcd: + case_version: 2.0.57 + csv_version: 1.0.47 + + opencontent_auditwebhook: + case_version: 1.0.24 + csv_version: 0.3.1 + + watson_gateway: + case_version: 2.2.0 + csv_version: 2.2.0 + cr_version: 2.2.0 + + data_governor: + case_version: 8.1.0 + csv_version: 8.1.0 + sub_channel: v8.1 + cr_version: 3.29.4 + + ws_pipelines: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 5.3.1 + + postgresql: + case_version: 5.31.0 + sub_channel: "stable-v1.25" + csv_version: 1.25.5 + cr_version: 1.25.5 + + edb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + mongodb: + case_version: 5.31.0 + sub_channel: "stable" + csv_version: 1.33.0 + cr_version: 5.31.0 + + mongodb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + dpra: + deprecated: true + case_version: 1.20.0 + sub_channel: "v1.20" + csv_version: 1.20.0 + cr_version: 1.20.0 + + factsheet: + case_version: 7.1.0 + csv_version: 7.1.0 + sub_channel: "v7.1" + cr_version: 5.3.1 + + replication: + case_version: 5.3.1 + csv_version: 7.1.0 + cr_version: 5.3.1 + sub_channel: "v7.1" + + voice_gateway: + case_version: 1.13.0 + csv_version: 1.13.0 + sub_channel: v1.13 + cr_version: 1.13.0 + + watsonx_data: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + watsonx_data_premium: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + wxd_query_optimizer: + component_dependencies: + - db2u + + watsonx_ai: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + osai_min_version: 2.19.0 + + watsonx_ai_ifm: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + + watsonx_bi_assistant: + case_version: 3.4.0 + csv_version: 3.4.0 + sub_channel: v3.4 + cr_version: 3.4.0 + + wca_ansible: + case_version: 4.1.0 + cr_version: 5.3.1 + + wca: + case_version: 3.1.0 + cr_version: 5.3.1 + + wca_z: + case_version: 4.1.0 + csv_version: 4.1.0 + sub_channel: v4.0 + cr_version: 5.3.1 + + wca_z_agentic: + case_version: 2.0.1 + csv_version: 2.0.1 + sub_channel: v2.1 + cr_version: 2.7.1 + + wca_z_ce: + case_version: 5.3.1 + sub_channel: v2.8 + csv_version: 2.8.10 + cr_version: 2.8.10 + + wca_z_cg: + case_version: 5.3.1 + sub_channel: v1.1 + csv_version: 1.1.1 + cr_version: 2.8.10 + + wca_base: + case_version: 4.1.0 + cr_version: 5.3.1 + + ibm_neo4j: + case_version: 1.3.1 + sub_channel: "v4.1" + csv_version: 1.3.1 + cr_version: 1.3.1 + + watsonx_governance: + case_version: 5.1.0 + sub_channel: "v5.1" + csv_version: 5.1.0 + cr_version: 2.3.1 + + watsonx_orchestrate: + case_version: 7.1.0 + sub_channel: "v7.1" + csv_version: 7.1.0 + cr_version: "7.1.0" + + watsonx_dataintegration: + case_version: 2.4.0 + sub_channel: "v2.4" + csv_version: 5.3.1 + cr_version: 2.3.1 + + watsonx_dataintelligence: + case_version: 2.3.1 + sub_channel: "v2.31" + csv_version: 2.3.1 + cr_version: 2.3.1 + + wca_z_understand: + case_version: 1.1.0 + csv_version: 1.1.0 + sub_channel: v1.1 + cr_version: 2.8.10 + + ibm-databand: + case_version: 1.0.0 + csv_version: 1.0.0 + cr_version: 1.0.0 + sub_channel: "v1.0.0" + + datastax_mc: + case_version: 1.16.1 + cr_version: 1.16.1 + + ibm_wxd_opensearch: + case_version: 3.3.2 + cr_version: 3.3.2 + release_version: 5.3.1 +{{- end }} + + diff --git a/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml b/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml index 980b17c49..b76edaa92 100644 --- a/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml @@ -4,6 +4,7 @@ {{- /* Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. */}} + {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} # From b7eb0941a2af1814aac1be368e318b2d23739556 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Wed, 22 Jul 2026 14:51:08 +0530 Subject: [PATCH 002/103] [minor] Fix CatalogSources template - add CPD 5.3.1 block (MASCORE-15507) --- .../templates/01-ibm-cp4d-CatalogSources.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml b/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml index 499b3ad64..8c0985a57 100644 --- a/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml +++ b/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml @@ -293,7 +293,7 @@ spec: registryPoll: interval: 30m0s {{- end }} -{{- end }} + # cpd 5.3.1 catalog sources From 8c99760df4aad462d42acad2200820fd2722d8b4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 28 Jul 2026 12:15:53 +0530 Subject: [PATCH 003/103] For CPD 5.3.1 services are installed via Helm --- .../templates/00-ibm-spark_Subscription.yaml | 3 +- .../templates/01-ibm-spark-cr.yaml | 7 ++ .../120-ibm-spark/values.yaml | 1 + .../templates/00-ibm-spss_Subscription.yaml | 2 + .../templates/01-ibm-spss-cr.yaml | 10 ++- .../120-ibm-spss/values.yaml | 1 + .../templates/01-ibm-wml_Subscription.yaml | 2 + .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 7 ++ instance-applications/120-ibm-wml/values.yaml | 1 + .../templates/00-ibm-wsl_Subscription.yaml | 22 ++++++ .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 71 +++++++++++++++++++ 11 files changed, 124 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml index 598d60619..99918936a 100644 --- a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml +++ b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,4 +17,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.spark_install_plan | default "Automatic" | quote }} - +{{- end }} diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 87a8a32c9..45a3588ed 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: ae.cpd.ibm.com/v1 kind: AnalyticsEngine @@ -22,3 +23,9 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.spark_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +# Spark (Analytics Engine) is installed via ansible-devops cp4d_service role using Helm +# No OLM Subscription or CR is created here for CPD >= 5.3.1 +{{- end }} diff --git a/instance-applications/120-ibm-spark/values.yaml b/instance-applications/120-ibm-spark/values.yaml index d6a766919..25e5c803b 100644 --- a/instance-applications/120-ibm-spark/values.yaml +++ b/instance-applications/120-ibm-spark/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" spark_channel: "" spark_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index dcb608e85..c37c39d91 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -35,3 +36,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.canvasbase_install_plan | default "Automatic" | quote }} +{{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 2869c08f6..f182ecf68 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,4 +1,4 @@ - +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: spssmodeler.cpd.ibm.com/v1 kind: Spss @@ -24,4 +24,10 @@ spec: version: "{{ .Values.spss_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" - wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" \ No newline at end of file + wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +# SPSS Modeler is installed via ansible-devops cp4d_service role using Helm +# No OLM Subscription or CR is created here for CPD >= 5.3.1 +{{- end }} diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml index 51ca216c9..b7c0618d7 100644 --- a/instance-applications/120-ibm-spss/values.yaml +++ b/instance-applications/120-ibm-spss/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" spss_channel: "" spss_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml index 327653732..8b80ea231 100644 --- a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml +++ b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,3 +17,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.wml_install_plan | default "Automatic" | quote }} +{{- end }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index e1e789973..f6e485cb5 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: wml.cpd.ibm.com/v1beta1 kind: WmlBase @@ -22,3 +23,9 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.wml_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +# WML is installed via ansible-devops cp4d_service role using Helm +# No OLM Subscription or CR is created here for CPD >= 5.3.1 +{{- end }} diff --git a/instance-applications/120-ibm-wml/values.yaml b/instance-applications/120-ibm-wml/values.yaml index b5ec6e992..56dedaab2 100644 --- a/instance-applications/120-ibm-wml/values.yaml +++ b/instance-applications/120-ibm-wml/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" wml_channel: "" wml_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index b2556409c..d205eb28b 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -1,3 +1,24 @@ +# --- +# apiVersion: operators.coreos.com/v1alpha1 +# kind: Subscription +# metadata: +# name: ibm-cpd-ws-operator +# namespace: "{{ .Values.cpd_operators_namespace }}" +# annotations: +# argocd.argoproj.io/sync-wave: "090" +# {{- if .Values.custom_labels }} +# labels: +# {{ .Values.custom_labels | toYaml | indent 4 }} +# {{- end }} +# spec: +# name: ibm-cpd-wsl +# channel: "{{ .Values.wsl_channel }}" +# source: ibm-operator-catalog +# sourceNamespace: openshift-marketplace +# installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} + + +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,3 +37,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} +{{- end }} \ No newline at end of file diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 11c9d89a3..a37ce5f29 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -1,3 +1,33 @@ +# --- +# apiVersion: ws.cpd.ibm.com/v1beta1 +# kind: WS +# metadata: +# name: "ws-cr" +# namespace: "{{ .Values.cpd_instance_namespace }}" +# annotations: +# argocd.argoproj.io/sync-wave: "091" +# argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +# {{- if .Values.custom_labels }} +# labels: +# {{ .Values.custom_labels | toYaml | indent 4 }} +# {{- end }} +# spec: +# imagePullSecret: ibm-entitlement-key +# ignoreForMaintenance: false +# license: +# accept: true +# license: Standard +# scaleConfig: "{{ .Values.cpd_service_scale_config }}" +# fileStorageClass: "{{ .Values.cpd_service_storage_class }}" +# blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" +# version: "{{ .Values.wsl_version }}" +# ccs_operand_version: "{{ .Values.ccs_version }}" +# datarefinery_operand_version: "{{ .Values.datarefinery_version }}" +# wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" + + + +{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} --- apiVersion: ws.cpd.ibm.com/v1beta1 kind: WS @@ -24,3 +54,44 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +apiVersion: batch/v1 +kind: Job +metadata: + name: install-wsl-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: quay.io/ibmmas/cli:latest + command: + - /bin/sh + - -c + - | + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + helm upgrade --install wsl ibm-charts/wsl \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set ws.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 30m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 +{{- end }} \ No newline at end of file From 31562eb6cf21d71e14f6267bea9d0513c214ca01 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 28 Jul 2026 16:19:48 +0530 Subject: [PATCH 004/103] MASCORE-15507: Fix WSL Helm Job - install deps in sequence; add Helm Jobs for WML, Spark, SPSS --- .../templates/01-ibm-spark-cr.yaml | 39 ++++- .../templates/01-ibm-spss-cr.yaml | 39 ++++- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 39 ++++- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 136 +++++++++++++++--- 4 files changed, 231 insertions(+), 22 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 45a3588ed..eecc35568 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -26,6 +26,41 @@ spec: {{- else }} --- # Helm-based installation for CPD 5.3.1+ -# Spark (Analytics Engine) is installed via ansible-devops cp4d_service role using Helm -# No OLM Subscription or CR is created here for CPD >= 5.3.1 +apiVersion: batch/v1 +kind: Job +metadata: + name: install-spark-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: quay.io/ibmmas/cli:latest + command: + - /bin/sh + - -c + - | + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + helm upgrade --install analyticsengine ibm-charts/analyticsengine \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set analyticsengine.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 30m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 {{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index f182ecf68..ba9b5ec61 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -28,6 +28,41 @@ spec: {{- else }} --- # Helm-based installation for CPD 5.3.1+ -# SPSS Modeler is installed via ansible-devops cp4d_service role using Helm -# No OLM Subscription or CR is created here for CPD >= 5.3.1 +apiVersion: batch/v1 +kind: Job +metadata: + name: install-spss-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: quay.io/ibmmas/cli:latest + command: + - /bin/sh + - -c + - | + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + helm upgrade --install spss-modeler ibm-charts/spss-modeler \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set spssmodeler.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 30m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 {{- end }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index f6e485cb5..dc4849977 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -26,6 +26,41 @@ spec: {{- else }} --- # Helm-based installation for CPD 5.3.1+ -# WML is installed via ansible-devops cp4d_service role using Helm -# No OLM Subscription or CR is created here for CPD >= 5.3.1 +apiVersion: batch/v1 +kind: Job +metadata: + name: install-wml-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: quay.io/ibmmas/cli:latest + command: + - /bin/sh + - -c + - | + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + helm upgrade --install wml ibm-charts/wml \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set wml.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 30m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 {{- end }} diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index a37ce5f29..2d4ceb0a7 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -57,6 +57,9 @@ spec: {{- else }} --- # Helm-based installation for CPD 5.3.1+ +# Installs WSL and all its dependencies (opensearch, ccs, datarefinery, ws-runtimes) +# using IBM Helm charts. Each component requires a cluster-scoped chart (CRDs/ClusterRoles) +# followed by a namespace-scoped chart (Operator + CR). apiVersion: batch/v1 kind: Job metadata: @@ -76,22 +79,123 @@ spec: - /bin/sh - -c - | - helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + set -e + + HELM_REPO=ibm-charts + HELM_REPO_URL=https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + OPERATORS_NS={{ .Values.cpd_operators_namespace }} + INSTANCE_NS={{ .Values.cpd_instance_namespace }} + FILE_SC={{ .Values.cpd_service_storage_class }} + BLOCK_SC={{ .Values.cpd_service_block_storage_class }} + SCALE={{ .Values.cpd_service_scale_config }} + CPD_VERSION={{ .Values.cpd_product_version }} + PULL_SECRET=ibm-entitlement-key + + echo "================================================================" + echo "Adding IBM Helm repository" + echo "================================================================" + helm repo add ${HELM_REPO} ${HELM_REPO_URL} || true helm repo update - helm upgrade --install wsl ibm-charts/wsl \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --set ws.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 30m + + # Shared values file used by all components + cat > /tmp/cpd-global-values.yaml << EOF + global: + licenseAccept: true + releaseVersion: ${CPD_VERSION} + operatorNamespace: ${OPERATORS_NS} + instanceNamespace: ${INSTANCE_NS} + fileStorageClass: ${FILE_SC} + blockStorageClass: ${BLOCK_SC} + imagePullSecret: ${PULL_SECRET} + imagePullPrefix: cp.icr.io + EOF + + install_component() { + local NAME=$1 + local CHART=$2 + local CLUSTER_CHART=$3 + local VERSION=$4 + local EXTRA_VALUES=$5 + + echo "================================================================" + echo "Installing ${NAME} (version ${VERSION})" + echo "================================================================" + + # 1. Cluster-scoped chart (CRDs, ClusterRoles) + echo " [${NAME}] Installing cluster-scoped chart..." + helm template ${NAME}-cluster ${HELM_REPO}/${CLUSTER_CHART} \ + --version ${VERSION} \ + -f /tmp/cpd-global-values.yaml \ + --namespace ${OPERATORS_NS} | oc apply -f - + + # 2. Namespace-scoped chart (Operator + CR) + echo " [${NAME}] Installing namespace-scoped chart..." + helm upgrade --install ${NAME} ${HELM_REPO}/${CHART} \ + --version ${VERSION} \ + -f /tmp/cpd-global-values.yaml \ + ${EXTRA_VALUES} \ + --namespace ${INSTANCE_NS} \ + --create-namespace \ + --wait --timeout 60m + } + + # ---------------------------------------------------------------- + # Step 1: OpenSearch (dependency) + # ---------------------------------------------------------------- + install_component \ + "opencontent-opensearch" \ + "opencontent-opensearch" \ + "opencontent-opensearch-cluster-scoped" \ + "1.2.0" + + # ---------------------------------------------------------------- + # Step 2: CCS - Common Core Services (dependency) + # ---------------------------------------------------------------- + install_component \ + "ccs" \ + "ccs" \ + "ccs-cluster-scoped" \ + "12.1.0" \ + "--set ccs.scaleConfig=${SCALE}" + + # Wait for CCS CR to be ready + echo "Waiting for CCS CR to be ready..." + oc wait ccs/ccs-cr -n ${INSTANCE_NS} \ + --for=jsonpath='{.status.controlPlaneStatus}'=Completed \ + --timeout=60m + + # ---------------------------------------------------------------- + # Step 3: DataRefinery (dependency) + # ---------------------------------------------------------------- + install_component \ + "datarefinery" \ + "datarefinery" \ + "datarefinery-cluster-scoped" \ + "12.1.0" + + # ---------------------------------------------------------------- + # Step 4: WS Runtimes (dependency) + # ---------------------------------------------------------------- + install_component \ + "ws-runtimes" \ + "ws-runtimes" \ + "ws-runtimes-cluster-scoped" \ + "12.1.0" + + # ---------------------------------------------------------------- + # Step 5: Watson Studio (main component) + # ---------------------------------------------------------------- + install_component \ + "wsl" \ + "ws" \ + "ws-cluster-scoped" \ + "12.1.0" \ + "--set ws.scaleConfig=${SCALE}" + + echo "================================================================" + echo "WSL installation complete" + echo "================================================================" restartPolicy: Never serviceAccountName: cpd-sa - backoffLimit: 2 -{{- end }} \ No newline at end of file + backoffLimit: 1 +{{- end }} From 2b6f7b44c8c575b627e62b2e6222a83af6373796 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 28 Jul 2026 19:06:59 +0530 Subject: [PATCH 005/103] MASCORE-15507: Pass cpd_product_version to WSL, Spark, SPSS ArgoCD Applications --- .../ibm-mas-instance-root/templates/120-ibm-spark-app.yaml | 1 + .../ibm-mas-instance-root/templates/120-ibm-spss-app.yaml | 1 + .../ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml | 1 + 3 files changed, 3 insertions(+) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml index d3edd8787..cfee55a4c 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml @@ -48,6 +48,7 @@ spec: application_admin_role: {{ .Values.application_admin_role }} ccs_version: "{{ .Values.ibm_spark.ccs_version }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_service_block_storage_class: "{{ .Values.ibm_spark.cpd_service_block_storage_class }}" cpd_service_scale_config: "{{ .Values.ibm_spark.cpd_service_scale_config }}" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index 5f16e9abe..c312d6053 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -47,6 +47,7 @@ spec: sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" cpd_service_storage_class: "{{ .Values.ibm_spss.cpd_service_storage_class }}" cpd_service_block_storage_class: "{{ .Values.ibm_spss.cpd_service_block_storage_class }}" cpd_service_scale_config: "{{ .Values.ibm_spss.cpd_service_scale_config }}" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index d770e7365..73e710050 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -48,6 +48,7 @@ spec: sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" cpd_service_storage_class: "{{ .Values.ibm_wsl.cpd_service_storage_class }}" cpd_service_block_storage_class: "{{ .Values.ibm_wsl.cpd_service_block_storage_class }}" cpd_service_scale_config: "{{ .Values.ibm_wsl.cpd_service_scale_config }}" From 326fe687908f220f2bc43a6641e704c9a7f8e0a4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 28 Jul 2026 20:41:30 +0530 Subject: [PATCH 006/103] MASCORE-15507: Fix heredoc in WSL Helm Job - use printf to avoid YAML/shell conflict --- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 2d4ceb0a7..d2e4e63f9 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -98,17 +98,9 @@ spec: helm repo update # Shared values file used by all components - cat > /tmp/cpd-global-values.yaml << EOF - global: - licenseAccept: true - releaseVersion: ${CPD_VERSION} - operatorNamespace: ${OPERATORS_NS} - instanceNamespace: ${INSTANCE_NS} - fileStorageClass: ${FILE_SC} - blockStorageClass: ${BLOCK_SC} - imagePullSecret: ${PULL_SECRET} - imagePullPrefix: cp.icr.io - EOF + printf 'global:\n licenseAccept: true\n releaseVersion: %s\n operatorNamespace: %s\n instanceNamespace: %s\n fileStorageClass: %s\n blockStorageClass: %s\n imagePullSecret: %s\n imagePullPrefix: cp.icr.io\n' \ + "${CPD_VERSION}" "${OPERATORS_NS}" "${INSTANCE_NS}" "${FILE_SC}" "${BLOCK_SC}" "${PULL_SECRET}" \ + > /tmp/cpd-global-values.yaml install_component() { local NAME=$1 From e8f2c0f052fdaa85d14d6a910313b18db08c2449 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 30 Jul 2026 16:35:26 +0530 Subject: [PATCH 007/103] Fix semver comparison - use toString to handle unquoted cpd_product_version value --- .../120-ibm-spark/templates/00-ibm-spark_Subscription.yaml | 2 +- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 2 +- .../120-ibm-spss/templates/00-ibm-spss_Subscription.yaml | 2 +- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- .../120-ibm-wml/templates/01-ibm-wml_Subscription.yaml | 2 +- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- .../120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml | 2 +- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml index 99918936a..f76f473ca 100644 --- a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml +++ b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index eecc35568..e12e2b3a3 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: ae.cpd.ibm.com/v1 kind: AnalyticsEngine diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index c37c39d91..87ad8ae35 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index ba9b5ec61..a88dc3343 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: spssmodeler.cpd.ibm.com/v1 kind: Spss diff --git a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml index 8b80ea231..fd899c668 100644 --- a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml +++ b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index dc4849977..64ea9fa2a 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: wml.cpd.ibm.com/v1beta1 kind: WmlBase diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index d205eb28b..b667f0b8e 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -18,7 +18,7 @@ # installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index d2e4e63f9..91f9b59df 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -27,7 +27,7 @@ -{{- if lt (semver .Values.cpd_product_version) (semver "5.3.1") }} +{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} --- apiVersion: ws.cpd.ibm.com/v1beta1 kind: WS From 892f5f0ec2a3676964e056b2640fe50318182cc4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 11:24:51 +0530 Subject: [PATCH 008/103] MASCORE-15507: skip OLM CCS/OpenSearch post-sync patching for CPD 5.3.1+ --- .../templates/01-cpd-service-post-ops.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml b/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml index 8aebe3f14..810599109 100644 --- a/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml +++ b/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml @@ -247,6 +247,15 @@ spec: echo $(( $V1 - $V2 )) } + # For CPD 5.3.1+, CCS and OpenSearch are installed via Helm (not OLM). + # The CCS CR and OpenSearch CR managed by this post-sync job do not exist + # in that deployment model, so skip all OLM-specific post-sync patching. + COMP_531=$(compare_versions ${CPD_PRODUCT_VERSION} 5.3.1) + if [[ ${COMP_531} -ge 0 ]]; then + echo "CPD ${CPD_PRODUCT_VERSION} detected (>= 5.3.1) - CCS/OpenSearch installed via Helm, skipping OLM post-sync patching" + exit 0 + fi + echo echo "================================================================================" echo "Wait for CCS Cr to be ready and patch if needed" From 7a99311d2d0d5b8732ebf914d0dd109077c56f68 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 12:08:24 +0530 Subject: [PATCH 009/103] MASCORE-15507: bump job version to v2 to force new job name after script change --- .../templates/01-cpd-service-post-ops.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml b/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml index 810599109..556806533 100644 --- a/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml +++ b/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml @@ -25,7 +25,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v1" }} +{{- $_job_version := "v2" }} {{- /* 10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest From 675a87c4b76045e9305cf435b08e5d778fa9e5d5 Mon Sep 17 00:00:00 2001 From: Nikita Kumble Date: Fri, 31 Jul 2026 14:28:16 +0530 Subject: [PATCH 010/103] minor update --- .../120-ibm-db2u-database/files/PostBackFlow.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh index 90d87d308..18a94ef57 100755 --- a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh +++ b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh @@ -5,7 +5,7 @@ INSTOWNER=`/usr/local/bin/db2greg -dump | grep -ae "I," | grep -v "/das," | awk # Find the home directory INSTHOME=` cat /etc/passwd | grep ${INSTOWNER} | cut -d: -f6` -DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep MANA | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` +DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep -E "MANA|FACI" | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` SCRIPT=/mnt/backup/bin/PostBF_Scripts.sh echo "db2 connect to bludb" > ${SCRIPT} From 647900b8d0367d43b2fc4d0f82fdeb8e1587df26 Mon Sep 17 00:00:00 2001 From: Nikita Kumble Date: Fri, 31 Jul 2026 14:47:10 +0530 Subject: [PATCH 011/103] changes undo --- .../120-ibm-db2u-database/files/PostBackFlow.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh index 18a94ef57..90d87d308 100755 --- a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh +++ b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh @@ -5,7 +5,7 @@ INSTOWNER=`/usr/local/bin/db2greg -dump | grep -ae "I," | grep -v "/das," | awk # Find the home directory INSTHOME=` cat /etc/passwd | grep ${INSTOWNER} | cut -d: -f6` -DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep -E "MANA|FACI" | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` +DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep MANA | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` SCRIPT=/mnt/backup/bin/PostBF_Scripts.sh echo "db2 connect to bludb" > ${SCRIPT} From 413dd4e80e5627813b8d59be0ddebf8e6e908658 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 17:19:48 +0530 Subject: [PATCH 012/103] MASCORE-15507: gate CCS/datarefinery/ws-runtimes OLM subscriptions behind < 5.3.1 --- .../110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml index 4a90cf334..cb0ec381b 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml @@ -146,6 +146,7 @@ spec: backoffLimit: 4 +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} {{- if or .Values.wml_channel .Values.wsl_channel .Values.spss_channel }} --- apiVersion: operators.coreos.com/v1alpha1 @@ -246,3 +247,4 @@ spec: {{- end }} {{- end }} +{{- end }} From 0da19330a84e3953b1f37f376ba59c235cf475a2 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 19:37:37 +0530 Subject: [PATCH 013/103] MASCORE-15507: fix semver comparison syntax - use .Compare pattern instead of lt(semver,semver) --- .../120-ibm-spark/templates/00-ibm-spark_Subscription.yaml | 2 +- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 2 +- .../120-ibm-spss/templates/00-ibm-spss_Subscription.yaml | 2 +- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- .../120-ibm-wml/templates/01-ibm-wml_Subscription.yaml | 2 +- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- .../120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml | 2 +- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml index f76f473ca..392b67cf3 100644 --- a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml +++ b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index e12e2b3a3..77884e561 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: ae.cpd.ibm.com/v1 kind: AnalyticsEngine diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index 87ad8ae35..d54dac607 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index a88dc3343..df3319f9b 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: spssmodeler.cpd.ibm.com/v1 kind: Spss diff --git a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml index fd899c668..01f75abbd 100644 --- a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml +++ b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 64ea9fa2a..4bad95c3c 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: wml.cpd.ibm.com/v1beta1 kind: WmlBase diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index b667f0b8e..2f30520a5 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -18,7 +18,7 @@ # installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 91f9b59df..08f0935b6 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -27,7 +27,7 @@ -{{- if lt (semver (.Values.cpd_product_version | toString)) (semver "5.3.1") }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: ws.cpd.ibm.com/v1beta1 kind: WS From 6ed6801afb9c3b95b69efe2d4173caa16a768fed Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 20:55:45 +0530 Subject: [PATCH 014/103] MASCORE-15507: install cluster-scoped chart first to register CRDs before namespace-scoped helm install --- .../templates/01-ibm-spark-cr.yaml | 29 +++++++++++++++++++ .../templates/01-ibm-spss-cr.yaml | 29 +++++++++++++++++++ .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 29 +++++++++++++++++++ 3 files changed, 87 insertions(+) diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 77884e561..694550523 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -45,8 +45,37 @@ spec: - /bin/sh - -c - | + set -e helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm helm repo update + + echo "Installing analyticsengine cluster-scoped chart (CRDs + ClusterRoles)..." + helm template analyticsengine-cluster ibm-charts/analyticsengine-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for analyticsengines.ae.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd analyticsengines.ae.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing analyticsengine namespace-scoped chart (operator + CR)..." helm upgrade --install analyticsengine ibm-charts/analyticsengine \ --version 12.1.0 \ --namespace {{ .Values.cpd_instance_namespace }} \ diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index df3319f9b..465f04217 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -47,8 +47,37 @@ spec: - /bin/sh - -c - | + set -e helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm helm repo update + + echo "Installing spss-modeler cluster-scoped chart (CRDs + ClusterRoles)..." + helm template spss-modeler-cluster ibm-charts/spss-modeler-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for spssmodelers.spssmodeler.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd spssmodelers.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing spss-modeler namespace-scoped chart (operator + CR)..." helm upgrade --install spss-modeler ibm-charts/spss-modeler \ --version 12.1.0 \ --namespace {{ .Values.cpd_instance_namespace }} \ diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 4bad95c3c..8c2be0a27 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -45,8 +45,37 @@ spec: - /bin/sh - -c - | + set -e helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm helm repo update + + echo "Installing wml cluster-scoped chart (CRDs + ClusterRoles)..." + helm template wml-cluster ibm-charts/wml-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for wmlbases.wml.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd wmlbases.wml.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing wml namespace-scoped chart (operator + CR)..." helm upgrade --install wml ibm-charts/wml \ --version 12.1.0 \ --namespace {{ .Values.cpd_instance_namespace }} \ From b7e2f54bc5a3e13aa044fa5759235d3eb85e5103 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 21:16:55 +0530 Subject: [PATCH 015/103] MASCORE-15507: grant cpd-sa cluster-level CRD/ClusterRole permissions for Helm 5.3.1+ installs --- .../templates/02-ibm-cp4d_rbac.yaml | 85 +++++++++++++++++++ 1 file changed, 85 insertions(+) diff --git a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml index 7797ff419..20f5db2fe 100644 --- a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml +++ b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml @@ -1526,3 +1526,88 @@ roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: admin + +{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0) }} +--- +# For CPD 5.3.1+, cpd-sa needs cluster-level permissions to apply CRDs and +# ClusterRoles from the Helm cluster-scoped charts during service installation. +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: "cpd-sa-helm-cluster-role-{{ .Values.instance_id }}" + annotations: + argocd.argoproj.io/sync-wave: "084" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +rules: + - verbs: + - get + - list + - create + - update + - patch + - delete + apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + - verbs: + - get + - list + - create + - update + - patch + - delete + apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + - verbs: + - get + - list + apiGroups: + - "" + resources: + - namespaces + - nodes + - verbs: + - get + - list + apiGroups: + - config.openshift.io + resources: + - clusterversions + - infrastructures + - verbs: + - use + apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - anyuid + - restricted + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: "cpd-sa-helm-cluster-rb-{{ .Values.instance_id }}" + annotations: + argocd.argoproj.io/sync-wave: "085" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +subjects: + - kind: ServiceAccount + name: cpd-sa + namespace: "{{ .Values.cpd_operators_namespace }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: "cpd-sa-helm-cluster-role-{{ .Values.instance_id }}" +{{- end }} From 846e49e0554f4c12d1a03c79fee7c943b7af2b75 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 22:32:54 +0530 Subject: [PATCH 016/103] MASCORE-15507: expand cpd-sa ClusterRole with escalate, roles, CPD API groups for Helm install --- .../templates/02-ibm-cp4d_rbac.yaml | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml index 20f5db2fe..2c8d3d747 100644 --- a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml +++ b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml @@ -1542,6 +1542,7 @@ metadata: {{ .Values.custom_labels | toYaml | indent 4 }} {{- end }} rules: + # CRD management (needed to apply cluster-scoped Helm charts) - verbs: - get - list @@ -1553,6 +1554,7 @@ rules: - apiextensions.k8s.io resources: - customresourcedefinitions + # ClusterRole/Binding management with escalate (allows granting permissions not yet held) - verbs: - get - list @@ -1560,11 +1562,28 @@ rules: - update - patch - delete + - bind + - escalate apiGroups: - rbac.authorization.k8s.io resources: - clusterroles - clusterrolebindings + # Namespaced roles/rolebindings (needed by Helm namespace-scoped charts) + - verbs: + - get + - list + - create + - update + - patch + - delete + - watch + apiGroups: + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + # Namespace/node read - verbs: - get - list @@ -1573,6 +1592,7 @@ rules: resources: - namespaces - nodes + # OpenShift infra - verbs: - get - list @@ -1581,6 +1601,7 @@ rules: resources: - clusterversions - infrastructures + # SCCs - verbs: - use apiGroups: @@ -1590,6 +1611,41 @@ rules: resourceNames: - anyuid - restricted + - nonroot + - privileged + # CPD service API groups (needed to grant these permissions in cluster-scoped ClusterRoles) + - verbs: + - get + - list + - create + - update + - patch + - delete + - watch + apiGroups: + - ae.cpd.ibm.com + - wml.cpd.ibm.com + - spssmodeler.cpd.ibm.com + - ws.cpd.ibm.com + - ccs.cpd.ibm.com + - opensearch.cloudpackopen.ibm.com + - datarefinery.cpd.ibm.com + - wsruntimes.cpd.ibm.com + resources: + - "*" + # Webhook configs (needed by some Helm charts) + - verbs: + - get + - list + - create + - update + - patch + - delete + apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations --- kind: ClusterRoleBinding From 9c91cf793257e2343d5a10723b81ca2b2d1d47dd Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 31 Jul 2026 23:48:54 +0530 Subject: [PATCH 017/103] MASCORE-15507: pin cli image to digest instead of :latest in Helm install jobs --- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 2 +- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 694550523..8dda22647 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -40,7 +40,7 @@ spec: spec: containers: - name: helm-install - image: quay.io/ibmmas/cli:latest + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 command: - /bin/sh - -c diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 465f04217..47612cb8b 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -42,7 +42,7 @@ spec: spec: containers: - name: helm-install - image: quay.io/ibmmas/cli:latest + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 command: - /bin/sh - -c diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 8c2be0a27..b8f7e5236 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -40,7 +40,7 @@ spec: spec: containers: - name: helm-install - image: quay.io/ibmmas/cli:latest + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 command: - /bin/sh - -c diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 08f0935b6..e44e2fea2 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -74,7 +74,7 @@ spec: spec: containers: - name: helm-install - image: quay.io/ibmmas/cli:latest + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 command: - /bin/sh - -c From e410251c2bbfae71166cecf3761b310c882fbcf1 Mon Sep 17 00:00:00 2001 From: Nikita Kumble Date: Mon, 3 Aug 2026 13:12:14 +0530 Subject: [PATCH 018/103] adding temp changes for facilities --- .../120-ibm-db2u-database/files/PostBackFlow.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh index 90d87d308..18a94ef57 100755 --- a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh +++ b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh @@ -5,7 +5,7 @@ INSTOWNER=`/usr/local/bin/db2greg -dump | grep -ae "I," | grep -v "/das," | awk # Find the home directory INSTHOME=` cat /etc/passwd | grep ${INSTOWNER} | cut -d: -f6` -DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep MANA | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` +DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep -E "MANA|FACI" | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` SCRIPT=/mnt/backup/bin/PostBF_Scripts.sh echo "db2 connect to bludb" > ${SCRIPT} From a561f1e92ccb1d073f6c808367ed11d3d2e73382 Mon Sep 17 00:00:00 2001 From: Nikita Kumble Date: Tue, 4 Aug 2026 13:28:52 +0530 Subject: [PATCH 019/103] undone postbackflow.sh script --- .../120-ibm-db2u-database/files/PostBackFlow.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh index 18a94ef57..90d87d308 100755 --- a/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh +++ b/instance-applications/120-ibm-db2u-database/files/PostBackFlow.sh @@ -5,7 +5,7 @@ INSTOWNER=`/usr/local/bin/db2greg -dump | grep -ae "I," | grep -v "/das," | awk # Find the home directory INSTHOME=` cat /etc/passwd | grep ${INSTOWNER} | cut -d: -f6` -DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep -E "MANA|FACI" | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` +DEST_USER=`db2 list applications show detail | cut -d" " -f1 | grep -v DB2INST1 | grep -v CTGINST1 | grep -v CONNECT |grep MANA | grep -v "\-\-" |grep -v MONITOR | sort -n | uniq | tail -1` SCRIPT=/mnt/backup/bin/PostBF_Scripts.sh echo "db2 connect to bludb" > ${SCRIPT} From 4aa87d7d22dfd534393fc83c09438177e952ca75 Mon Sep 17 00:00:00 2001 From: Adit Yarra Date: Wed, 5 Aug 2026 15:14:25 +0530 Subject: [PATCH 020/103] initial commit --- instance-applications/100-ibm-sls/README.md | 4 ++++ .../100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml | 4 ++++ .../ibm-mas-instance-root/templates/100-ibm-sls-app.yaml | 3 +++ .../ibm-mas-sls-root/templates/100-ibm-sls-app.yaml | 3 +++ .../100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml | 4 ++++ 5 files changed, 18 insertions(+) diff --git a/instance-applications/100-ibm-sls/README.md b/instance-applications/100-ibm-sls/README.md index 78ae3fbec..f0845de86 100644 --- a/instance-applications/100-ibm-sls/README.md +++ b/instance-applications/100-ibm-sls/README.md @@ -69,6 +69,10 @@ ibm_sls: - alias: string crt: string (multiline) + # Pod Templates (optional) + sls_pod_templates: + key: value + # Certificate Authority (optional) internal_certificate_authority: string ``` diff --git a/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml b/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml index b5b8b3aa8..2277794be 100644 --- a/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml +++ b/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml @@ -17,6 +17,10 @@ spec: {{ .Values.mongo_spec | toYaml | indent 4 }} license: accept: true +{{- if not (empty .Values.sls_pod_templates) }} + podTemplates: +{{ .Values.sls_pod_templates | toYaml | indent 4 }} +{{- end }} settings: auth: enforce: true diff --git a/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml b/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml index e1d364f59..e3ce37274 100644 --- a/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml @@ -80,6 +80,9 @@ spec: devops_build_number: "{{ .Values.devops.build_number }}" gitops_version: "{{ .Values.source.revision }}" cli_image_repo: {{ .Values.cli_image_repo }} + {{- if .Values.ibm_sls.sls_pod_templates }} + sls_pod_templates: {{ .Values.ibm_sls.sls_pod_templates | toYaml | nindent 14 }} + {{- end }} {{- if .Values.ibm_sls.internal_certificate_authority }} internal_certificate_authority: "{{ .Values.ibm_sls.internal_certificate_authority }}" {{- end }} diff --git a/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml b/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml index 71c353c2b..d852e67c4 100644 --- a/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml +++ b/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml @@ -78,6 +78,9 @@ spec: devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" devops_build_number: "{{ .Values.devops.build_number }}" gitops_version: "{{ .Values.source.revision }}" + {{- if .Values.ibm_sls_standalone.sls_pod_templates }} + sls_pod_templates: {{ .Values.ibm_sls_standalone.sls_pod_templates | toYaml | nindent 14 }} + {{- end }} {{- if .Values.ibm_sls_standalone.internal_certificate_authority }} internal_certificate_authority: "{{ .Values.ibm_sls_standalone.internal_certificate_authority }}" {{- end }} diff --git a/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml b/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml index 276cbc3f1..3914dc7d8 100644 --- a/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml +++ b/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml @@ -18,6 +18,10 @@ spec: {{ .Values.mongo_spec | toYaml | indent 4 }} license: accept: true +{{- if not (empty .Values.sls_pod_templates) }} + podTemplates: +{{ .Values.sls_pod_templates | toYaml | indent 4 }} +{{- end }} settings: auth: enforce: true From 5bf472cbbc1e2f962d8791b35553834675f86184 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 11:13:45 +0530 Subject: [PATCH 021/103] MASCORE-15507: fix CPD 5.3.1 Helm service install correctness - Gate OperandRegistry/OperandConfig to < 5.3.1 to prevent OLM resource drift when services are installed via Helm - Gate spark-hb-control-plane patch job to < 5.3.1; OLM-managed deployment does not exist in Helm install model - Add CRD establishment wait inside WSL install_component() between cluster-scoped apply and namespace-scoped helm upgrade to prevent race condition - Extend Helm Job --wait timeout from 30m to 60m for WML, SPSS and Spark to match WSL and avoid premature timeout on loaded clusters --- .../09-ibm-cp4d_services_dependencies.yaml | 2 +- .../templates/01-ibm-spark-cr.yaml | 2 +- .../templates/02-ibm-spark-control-plane.yaml | 3 +- .../templates/01-ibm-spss-cr.yaml | 2 +- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 54 +++++++++++++++++++ 6 files changed, 60 insertions(+), 5 deletions(-) diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml index aecaafdef..6a270dcee 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml @@ -1,4 +1,4 @@ -{{- if or .Values.wsl_channel .Values.spss_channel }} +{{- if and (or .Values.wsl_channel .Values.spss_channel) (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0) }} # Custom Operand Registries # ----------------------------------------------------------------------------- --- diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 8dda22647..be1a252fa 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -88,7 +88,7 @@ spec: --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ --set global.imagePullSecret=ibm-entitlement-key \ --set analyticsengine.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 30m + --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 2 diff --git a/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml b/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml index 65d3bf87d..e2c7b5f8a 100644 --- a/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml +++ b/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml @@ -55,6 +55,7 @@ are required here. */}} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- kind: ServiceAccount apiVersion: v1 @@ -165,5 +166,5 @@ spec: restartPolicy: Never serviceAccountName: spark-cp-sa backoffLimit: 4 - +{{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 47612cb8b..6f7c7368a 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -90,7 +90,7 @@ spec: --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ --set global.imagePullSecret=ibm-entitlement-key \ --set spssmodeler.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 30m + --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 2 diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index b8f7e5236..311232e18 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -88,7 +88,7 @@ spec: --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ --set global.imagePullSecret=ibm-entitlement-key \ --set wml.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 30m + --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 2 diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index e44e2fea2..477584a6f 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -120,6 +120,12 @@ spec: -f /tmp/cpd-global-values.yaml \ --namespace ${OPERATORS_NS} | oc apply -f - + # Wait for all CRDs from the cluster-scoped chart to be established + # before running the namespace-scoped chart that depends on them. + echo " [${NAME}] Waiting for CRDs to be established..." + sleep 5 + oc wait crd --all --for=condition=Established --timeout=120s 2>/dev/null || true + # 2. Namespace-scoped chart (Operator + CR) echo " [${NAME}] Installing namespace-scoped chart..." helm upgrade --install ${NAME} ${HELM_REPO}/${CHART} \ @@ -140,6 +146,22 @@ spec: "opencontent-opensearch-cluster-scoped" \ "1.2.0" + echo "Waiting for opensearchclusters.opensearch.cloudpackopen.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd opensearchclusters.opensearch.cloudpackopen.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + # ---------------------------------------------------------------- # Step 2: CCS - Common Core Services (dependency) # ---------------------------------------------------------------- @@ -165,6 +187,22 @@ spec: "datarefinery-cluster-scoped" \ "12.1.0" + echo "Waiting for datarefineries.datarefinery.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd datarefineries.datarefinery.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + # ---------------------------------------------------------------- # Step 4: WS Runtimes (dependency) # ---------------------------------------------------------------- @@ -174,6 +212,22 @@ spec: "ws-runtimes-cluster-scoped" \ "12.1.0" + echo "Waiting for wsruntimes.wsruntimes.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd wsruntimes.wsruntimes.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + # ---------------------------------------------------------------- # Step 5: Watson Studio (main component) # ---------------------------------------------------------------- From cdaa41aa92017136b3cebabf74200722585da5ba Mon Sep 17 00:00:00 2001 From: Adit Date: Thu, 6 Aug 2026 11:45:26 +0530 Subject: [PATCH 022/103] Merge 15507 and 15757 (#520) * Added CPD 5.3.1 gitops support * [minor] Fix CatalogSources template - add CPD 5.3.1 block (MASCORE-15507) * For CPD 5.3.1 services are installed via Helm * MASCORE-15507: Fix WSL Helm Job - install deps in sequence; add Helm Jobs for WML, Spark, SPSS * MASCORE-15507: Pass cpd_product_version to WSL, Spark, SPSS ArgoCD Applications * MASCORE-15507: Fix heredoc in WSL Helm Job - use printf to avoid YAML/shell conflict * Fix semver comparison - use toString to handle unquoted cpd_product_version value * MASCORE-15507: skip OLM CCS/OpenSearch post-sync patching for CPD 5.3.1+ * MASCORE-15507: bump job version to v2 to force new job name after script change * minor update * changes undo * MASCORE-15507: gate CCS/datarefinery/ws-runtimes OLM subscriptions behind < 5.3.1 * MASCORE-15507: fix semver comparison syntax - use .Compare pattern instead of lt(semver,semver) * MASCORE-15507: install cluster-scoped chart first to register CRDs before namespace-scoped helm install * MASCORE-15507: grant cpd-sa cluster-level CRD/ClusterRole permissions for Helm 5.3.1+ installs * MASCORE-15507: expand cpd-sa ClusterRole with escalate, roles, CPD API groups for Helm install * MASCORE-15507: pin cli image to digest instead of :latest in Helm install jobs * adding temp changes for facilities * undone postbackflow.sh script * MASCORE-15507: fix CPD 5.3.1 Helm service install correctness - Gate OperandRegistry/OperandConfig to < 5.3.1 to prevent OLM resource drift when services are installed via Helm - Gate spark-hb-control-plane patch job to < 5.3.1; OLM-managed deployment does not exist in Helm install model - Add CRD establishment wait inside WSL install_component() between cluster-scoped apply and namespace-scoped helm upgrade to prevent race condition - Extend Helm Job --wait timeout from 30m to 60m for WML, SPSS and Spark to match WSL and avoid premature timeout on loaded clusters --------- Co-authored-by: Sakshi Singhroha Co-authored-by: Nikita Kumble --- .../templates/00-ibm-cp4d-olm-531.yaml | 678 ++++++++++++++++++ .../templates/01-ibm-cp4d-CatalogSources.yaml | 72 ++ .../templates/00-ibm-cp4d-olm-531.yaml | 677 +++++++++++++++++ .../templates/02-ibm-cp4d_rbac.yaml | 141 ++++ .../templates/09-ibm-cp4d_services_base.yaml | 2 + .../09-ibm-cp4d_services_dependencies.yaml | 2 +- .../04-db2u-Volatile-Runstats_Cron.yaml | 1 + .../templates/00-ibm-spark_Subscription.yaml | 3 +- .../templates/01-ibm-spark-cr.yaml | 71 ++ .../templates/02-ibm-spark-control-plane.yaml | 3 +- .../120-ibm-spark/values.yaml | 1 + .../templates/00-ibm-spss_Subscription.yaml | 2 + .../templates/01-ibm-spss-cr.yaml | 74 +- .../120-ibm-spss/values.yaml | 1 + .../templates/01-ibm-wml_Subscription.yaml | 2 + .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 71 ++ instance-applications/120-ibm-wml/values.yaml | 1 + .../templates/00-ibm-wsl_Subscription.yaml | 22 + .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 221 ++++++ .../templates/01-cpd-service-post-ops.yaml | 11 +- .../templates/120-ibm-spark-app.yaml | 1 + .../templates/120-ibm-spss-app.yaml | 1 + .../templates/120-ibm-wsl-app.yaml | 1 + 23 files changed, 2053 insertions(+), 6 deletions(-) create mode 100644 instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml create mode 100644 instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml diff --git a/instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml b/instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml new file mode 100644 index 000000000..fb9b366fd --- /dev/null +++ b/instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml @@ -0,0 +1,678 @@ +{{- if eq .Values.cpd_product_version "5.3.1" }} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: olm-utils-cm + namespace: mas-{{ .Values.instance_id }}-syncres + annotations: + argocd.argoproj.io/sync-wave: "00" + labels: + app.kubernetes.io/name: olm-utils +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +data: + licenses_urls: |- + SWHP: + url: "https://ibm.biz/BdbGRu" + description: "IBM Software Hub Premium Cartridge" + SWHAI: + url: "https://ibm.biz/BdbGRL" + description: "IBM Softare Hub AI Assistant Cartridge" + EE: + url: https://ibm.biz/Bdbq3x + description: "IBM Cloud Pak for Data Enterprise Edition" + SE: + url: https://ibm.biz/Bdbq3H + description: "IBM Cloud Pak for Data Standard Edition" + WXAI: + url: https://ibm.biz/BdbKbw + description: "IBM watsonx.ai" + DB2CE: + url: https://ibm.biz/BdnPB7 + description: "IBM Db2 Community Edition" + DB2SE: + url: https://ibm.biz/BdnPdB + description: "IBM Db2 Standard Edition Cartridge for IBM Cloud Pak for Data" + DB2AE: + url: https://ibm.biz/BdnPBW + description: "IBM Db2 Advanced Edition Cartridge for IBM Cloud Pak for Data" + DG: + url: "https://ibm.biz/dg4zos_v320" + description: "IBM Data Gate for z/OS with Cloud Pak for Data" + DGWXD: + url: "https://ibm.biz/dgx_v13" + description: "IBM Data Gate for watsonx" + DGWXDB: + url: "https://ibm.biz/wxd-dgx" + description: "IBM watsonx.data with Data Gate for IBM Z" + DGWXDPB: + url: "https://ibm.biz/wxdprem-dgx111" + description: "IBM watsonx.data Premium with Data Gate for IBM Z" + DGFS: + url: "https://ibm.biz/dg4fs_v13" + description: "IBM Data Gate for Financial Services" + IKCS: + url: https://ibm.biz/Bdmm4V + description: "IBM Knowledge Catalog Standard" + IKCP: + url: https://ibm.biz/Bdmm4J + description: "IBM Knowledge Catalog Premium" + IDRC: + url: https://ibm.biz/BdpHpg + description: "IBM Data Replication Cartridge" + IIDRC: + url: https://ibm.biz/BdpHph + description: "IBM InfoSphere Data Replication Cartridge" + IDRM: + url: https://ibm.biz/BdpHpJ + description: "IBM Data Replication Modernization" + IIDRM: + url: https://ibm.biz/BdpHpA + description: "IBM InfoSphere Data Replication Modernization" + IDRZOS: + url: https://ibm.biz/BdpHp9 + description: "IBM Data Replication for Db2 z/OS Cartridge" + IIDRWXTO: + url: https://ibm.biz/BdpHpu + description: "IBM InfoSphere Data Replication for watsonx.data Cartridge" + IIDRWXAO: + url: https://ibm.biz/BdpHpL + description: "IBM InfoSphere Data Replication Cartridge Add-on for IBM watsonx.data" + WXD: + url: https://ibm.biz/BdpdBF + description: "IBM watsonx.data" + WXDP: + url: https://ibm.biz/BdpzEx + description: "IBM watsonx.data Premium Edition" + WCA: + url: https://ibm.biz/Bdbv9x + description: "IBM watsonx Code Assistant" + WCAA: + url: https://ibm.biz/Bdbv9D + description: "IBM watsonx Code Assistant for Red Hat Ansible Lightspeed" + DPH: + url: https://ibm.biz/BdbQMv + description: "IBM Data Product Hub" + + release_components_meta: |- + scheduler: + case_version: 1.61.0 + sub_channel: "v1.61" + csv_version: 1.61.0 + cr_version: 1.61.0 + + cpfs: + csv_version: 4.17.0 + case_version: 4.17.0 + sub_channel: "v4.17" + + ibm-common-service-operator: + cr_version: 4.17.0 + + ibm-iam-operator: + cr_version: 4.16.0 + + ibm-namespace-scope-operator: + cr_version: 4.3.4 + + ibm-cert-manager: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_events_operator: + case_version: 6.0.0 + sub_channel: "v6.0" + csv_version: 6.0.0 + cr_version: 4.1.1 + + streamsets: + case_version: 9.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-streamsets-sdi: + case_version: 2.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-licensing: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_usage_metering: + case_version: 1.0.4 + csv_version: 1.0.4 + sub_channel: "v1.0" + cr_version: 1.0.4 + + cpd_platform: + case_version: 5.4.0 + csv_version: 6.4.0 + sub_channel: "v6.4" + cr_version: 5.4.0 + + platform-config: + cr_version: 5.4.0 + + ibm_swhcc: + case_version: 5.4.0 + csv_version: 5.4.0 + sub_channel: "v5.4" + cr_version: 5.4.0 + + zen: + case_version: 6.4.0 + sub_channel: "v6.4" + csv_version: 6.4.0 + cr_version: 6.4.0 + + analyticsengine: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + cognos_analytics: + case_version: 29.1.0 + sub_channel: "v29.1" + cr_version: 29.1.0 + csv_version: 29.1.0 + + ccs: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + dashboard: + case_version: 4.0.0 + sub_channel: "v4.0" + csv_version: 4.0.0 + cr_version: 5.3.0 + + datarefinery: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: "v12.1" + cr_version: 12.1.0 + + canvasbase: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + spss: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + syntheticdata: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + datastage_ent: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + datastage_ent_plus: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + informix: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + informix_cp4d: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + openscale: + case_version: 10.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + ws: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + ws_runtimes: + case_version: 12.1.0 + cr_version: 12.1.0 + + db2aaservice: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2oltp: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2wh: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2u: + case_version: 7.5.2 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + datagate: + case_version: 11.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 9.1.0 + + dods: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + hee: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + dv: + case_version: 8.1.0 + sub_channel: "v8.1" + csv_version: 8.1.0 + cr_version: 3.3.1 + + bigsql: + case_version: 14.1.0 + sub_channel: "v14.1" + csv_version: 14.1.0 + cr_version: 8.3.1 + + planning_analytics: + case_version: 5.3.1 + sub_channel: "v11.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + rstudio: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + watson_assistant: + case_version: 5.11.0 + sub_channel: "v5.11" + csv_version: 5.11.0 + cr_version: "5.3.1" + + watson_discovery: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + watson_speech: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + wkc: + case_version: 5.3.1 + sub_channel: "v9.1" + csv_version: 2.3.1 + cr_version: 5.3.1 + + ikc_standard: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + ikc_premium: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + datalineage: + case_version: 5.3.1 + sub_channel: "v7.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + udp: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster: + case_version: 9.1.0 + csv_version: 9.1.0 + sub_channel: "v9.1" + cr_version: 9.1.0 + + dataproduct: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + semantic_automation: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster_instance: + cr_version: 9.1.0 + + dp: + case_version: 11.1.0 + csv_version: 11.1.0 + sub_channel: "v11.1" + cr_version: 5.3.1 + + wml: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + dmc: + case_version: 8.11.0 + csv_version: 5.11.0 + cr_version: 5.3.1 + sub_channel: "v5.11" + + openpages: + case_version: 10.1.0 + csv_version: 10.1.0 + cr_version: 9.7.0 + sub_channel: "v10.1" + + openpages_instance: + cr_version: 9.7.0 + + mantaflow: + case_version: 2.4.0 + csv_version: 2.4.0 + sub_channel: "v2.4" + cr_version: 42.15.0 + + match360: + case_version: 4.11.0 + csv_version: 4.11.0 + cr_version: 4.11.50 + sub_channel: "v4.11" + + model_gateway: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + opencontent_opensearch: + case_version: 1.2.0 + csv_version: 1.2.0 + cr_version: 1.2.0 + sub_channel: "v1.1" + + opencontent_redis: + case_version: 1.6.11 + csv_version: 1.6.11 + sub_channel: "v1.6" + + ibm_redis_cp: + case_version: 1.3.1 + csv_version: 1.3.1 + sub_channel: "v1.3" + cr_version: 1.3.1 + + opencontent_rabbitmq: + case_version: 1.3.0 + csv_version: 1.3.0 + sub_channel: "v1.0" + cr_version: 1.3.0 + + opencontent_fdb: + case_version: 5.3.1 + csv_version: 5.3.1 + cr_version: 5.3.1 + sub_channel: "v5.3" + + fdb_k8s: + csv_version: 5.3.1 + sub_channel: "v5.3" + + opencontent_minio: + case_version: 1.0.23 + csv_version: 1.0.18 + + opencontent_etcd: + case_version: 2.0.57 + csv_version: 1.0.47 + + opencontent_auditwebhook: + case_version: 1.0.24 + csv_version: 0.3.1 + + watson_gateway: + case_version: 2.2.0 + csv_version: 2.2.0 + cr_version: 2.2.0 + + data_governor: + case_version: 8.1.0 + csv_version: 8.1.0 + sub_channel: v8.1 + cr_version: 3.29.4 + + ws_pipelines: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 5.3.1 + + postgresql: + case_version: 5.31.0 + sub_channel: "stable-v1.25" + csv_version: 1.25.5 + cr_version: 1.25.5 + + edb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + mongodb: + case_version: 5.31.0 + sub_channel: "stable" + csv_version: 1.33.0 + cr_version: 5.31.0 + + mongodb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + dpra: + deprecated: true + case_version: 1.20.0 + sub_channel: "v1.20" + csv_version: 1.20.0 + cr_version: 1.20.0 + + factsheet: + case_version: 7.1.0 + csv_version: 7.1.0 + sub_channel: "v7.1" + cr_version: 5.3.1 + + replication: + case_version: 5.3.1 + csv_version: 7.1.0 + cr_version: 5.3.1 + sub_channel: "v7.1" + + voice_gateway: + case_version: 1.13.0 + csv_version: 1.13.0 + sub_channel: v1.13 + cr_version: 1.13.0 + + watsonx_data: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + watsonx_data_premium: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + wxd_query_optimizer: + component_dependencies: + - db2u + + watsonx_ai: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + osai_min_version: 2.19.0 + + watsonx_ai_ifm: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + + watsonx_bi_assistant: + case_version: 3.4.0 + csv_version: 3.4.0 + sub_channel: v3.4 + cr_version: 3.4.0 + + wca_ansible: + case_version: 4.1.0 + cr_version: 5.3.1 + + wca: + case_version: 3.1.0 + cr_version: 5.3.1 + + wca_z: + case_version: 4.1.0 + csv_version: 4.1.0 + sub_channel: v4.0 + cr_version: 5.3.1 + + wca_z_agentic: + case_version: 2.0.1 + csv_version: 2.0.1 + sub_channel: v2.1 + cr_version: 2.7.1 + + wca_z_ce: + case_version: 5.3.1 + sub_channel: v2.8 + csv_version: 2.8.10 + cr_version: 2.8.10 + + wca_z_cg: + case_version: 5.3.1 + sub_channel: v1.1 + csv_version: 1.1.1 + cr_version: 2.8.10 + + wca_base: + case_version: 4.1.0 + cr_version: 5.3.1 + + ibm_neo4j: + case_version: 1.3.1 + sub_channel: "v4.1" + csv_version: 1.3.1 + cr_version: 1.3.1 + + watsonx_governance: + case_version: 5.1.0 + sub_channel: "v5.1" + csv_version: 5.1.0 + cr_version: 2.3.1 + + watsonx_orchestrate: + case_version: 7.1.0 + sub_channel: "v7.1" + csv_version: 7.1.0 + cr_version: "7.1.0" + + watsonx_dataintegration: + case_version: 2.4.0 + sub_channel: "v2.4" + csv_version: 5.3.1 + cr_version: 2.3.1 + + watsonx_dataintelligence: + case_version: 2.3.1 + sub_channel: "v2.31" + csv_version: 2.3.1 + cr_version: 2.3.1 + + wca_z_understand: + case_version: 1.1.0 + csv_version: 1.1.0 + sub_channel: v1.1 + cr_version: 2.8.10 + + ibm-databand: + case_version: 1.0.0 + csv_version: 1.0.0 + cr_version: 1.0.0 + sub_channel: "v1.0.0" + + datastax_mc: + case_version: 1.16.1 + cr_version: 1.16.1 + + ibm_wxd_opensearch: + case_version: 3.3.2 + cr_version: 3.3.2 + release_version: 5.3.1 +{{- end }} + + + diff --git a/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml b/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml index 461104031..8c0985a57 100644 --- a/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml +++ b/instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml @@ -293,4 +293,76 @@ spec: registryPoll: interval: 30m0s {{- end }} + + + +# cpd 5.3.1 catalog sources +{{- if eq .Values.cpd_product_version "5.3.1" }} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: CatalogSource +metadata: + name: cpd-platform + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "001" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + displayName: ibm-cp-datacore-6.4.0-50 + image: icr.io/cpopen/ibm-cpd-platform-operator-catalog@sha256:0a63f6bf9c312efc3daca05a657c70f300eaef7f5a36055753b11fcf014688ca + publisher: IBM + sourceType: grpc + updateStrategy: + registryPoll: + interval: 30m0s + +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: CatalogSource +metadata: + name: opencloud-operators + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "001" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + displayName: ibm-cp-common-services-4.17.0 + image: icr.io/cpopen/ibm-common-service-catalog@sha256:de97dd2a35b4c58da9b7ad5d89976d7a4184541e2e0a78a1c71e441a0105ce6e + publisher: IBM + sourceType: grpc + updateStrategy: + registryPoll: + interval: 30m0s + +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: CatalogSource +metadata: + name: ibm-zen-operator-catalog + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "001" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + displayName: ibm-zen-6.4.0-92 + image: icr.io/cpopen/ibm-zen-operator-catalog@sha256:9a02519e5ab679f0807fc5b7cfc5fc96242961bee0e1d3144012d33e925e6a99 + publisher: IBM + sourceType: grpc + updateStrategy: + registryPoll: + interval: 30m0s +{{- end }} {{- end }} + + + + diff --git a/instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml b/instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml new file mode 100644 index 000000000..ae436acc7 --- /dev/null +++ b/instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml @@ -0,0 +1,677 @@ +{{- if eq .Values.cpd_product_version "5.3.1" }} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: olm-utils-cm + namespace: {{ .Values.cpd_instance_namespace }} + annotations: + argocd.argoproj.io/sync-wave: "00" + labels: + app.kubernetes.io/name: olm-utils +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +data: + licenses_urls: |- + SWHP: + url: "https://ibm.biz/BdbGRu" + description: "IBM Software Hub Premium Cartridge" + SWHAI: + url: "https://ibm.biz/BdbGRL" + description: "IBM Softare Hub AI Assistant Cartridge" + EE: + url: https://ibm.biz/Bdbq3x + description: "IBM Cloud Pak for Data Enterprise Edition" + SE: + url: https://ibm.biz/Bdbq3H + description: "IBM Cloud Pak for Data Standard Edition" + WXAI: + url: https://ibm.biz/BdbKbw + description: "IBM watsonx.ai" + DB2CE: + url: https://ibm.biz/BdnPB7 + description: "IBM Db2 Community Edition" + DB2SE: + url: https://ibm.biz/BdnPdB + description: "IBM Db2 Standard Edition Cartridge for IBM Cloud Pak for Data" + DB2AE: + url: https://ibm.biz/BdnPBW + description: "IBM Db2 Advanced Edition Cartridge for IBM Cloud Pak for Data" + DG: + url: "https://ibm.biz/dg4zos_v320" + description: "IBM Data Gate for z/OS with Cloud Pak for Data" + DGWXD: + url: "https://ibm.biz/dgx_v13" + description: "IBM Data Gate for watsonx" + DGWXDB: + url: "https://ibm.biz/wxd-dgx" + description: "IBM watsonx.data with Data Gate for IBM Z" + DGWXDPB: + url: "https://ibm.biz/wxdprem-dgx111" + description: "IBM watsonx.data Premium with Data Gate for IBM Z" + DGFS: + url: "https://ibm.biz/dg4fs_v13" + description: "IBM Data Gate for Financial Services" + IKCS: + url: https://ibm.biz/Bdmm4V + description: "IBM Knowledge Catalog Standard" + IKCP: + url: https://ibm.biz/Bdmm4J + description: "IBM Knowledge Catalog Premium" + IDRC: + url: https://ibm.biz/BdpHpg + description: "IBM Data Replication Cartridge" + IIDRC: + url: https://ibm.biz/BdpHph + description: "IBM InfoSphere Data Replication Cartridge" + IDRM: + url: https://ibm.biz/BdpHpJ + description: "IBM Data Replication Modernization" + IIDRM: + url: https://ibm.biz/BdpHpA + description: "IBM InfoSphere Data Replication Modernization" + IDRZOS: + url: https://ibm.biz/BdpHp9 + description: "IBM Data Replication for Db2 z/OS Cartridge" + IIDRWXTO: + url: https://ibm.biz/BdpHpu + description: "IBM InfoSphere Data Replication for watsonx.data Cartridge" + IIDRWXAO: + url: https://ibm.biz/BdpHpL + description: "IBM InfoSphere Data Replication Cartridge Add-on for IBM watsonx.data" + WXD: + url: https://ibm.biz/BdpdBF + description: "IBM watsonx.data" + WXDP: + url: https://ibm.biz/BdpzEx + description: "IBM watsonx.data Premium Edition" + WCA: + url: https://ibm.biz/Bdbv9x + description: "IBM watsonx Code Assistant" + WCAA: + url: https://ibm.biz/Bdbv9D + description: "IBM watsonx Code Assistant for Red Hat Ansible Lightspeed" + DPH: + url: https://ibm.biz/BdbQMv + description: "IBM Data Product Hub" + + release_components_meta: |- + scheduler: + case_version: 1.61.0 + sub_channel: "v1.61" + csv_version: 1.61.0 + cr_version: 1.61.0 + + cpfs: + csv_version: 4.17.0 + case_version: 4.17.0 + sub_channel: "v4.17" + + ibm-common-service-operator: + cr_version: 4.17.0 + + ibm-iam-operator: + cr_version: 4.16.0 + + ibm-namespace-scope-operator: + cr_version: 4.3.4 + + ibm-cert-manager: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_events_operator: + case_version: 6.0.0 + sub_channel: "v6.0" + csv_version: 6.0.0 + cr_version: 4.1.1 + + streamsets: + case_version: 9.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-streamsets-sdi: + case_version: 2.0.0 + csv_version: 6.3.1 + cr_version: 6.3.1 + sub_channel: "v6.3.1" + + ibm-licensing: + csv_version: 4.2.20 + case_version: 4.2.20 + sub_channel: "v4.2" + + ibm_usage_metering: + case_version: 1.0.4 + csv_version: 1.0.4 + sub_channel: "v1.0" + cr_version: 1.0.4 + + cpd_platform: + case_version: 5.4.0 + csv_version: 6.4.0 + sub_channel: "v6.4" + cr_version: 5.4.0 + + platform-config: + cr_version: 5.4.0 + + ibm_swhcc: + case_version: 5.4.0 + csv_version: 5.4.0 + sub_channel: "v5.4" + cr_version: 5.4.0 + + zen: + case_version: 6.4.0 + sub_channel: "v6.4" + csv_version: 6.4.0 + cr_version: 6.4.0 + + analyticsengine: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + cognos_analytics: + case_version: 29.1.0 + sub_channel: "v29.1" + cr_version: 29.1.0 + csv_version: 29.1.0 + + ccs: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + dashboard: + case_version: 4.0.0 + sub_channel: "v4.0" + csv_version: 4.0.0 + cr_version: 5.3.0 + + datarefinery: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: "v12.1" + cr_version: 12.1.0 + + canvasbase: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + spss: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + syntheticdata: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + datastage_ent: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + datastage_ent_plus: + case_version: 11.1.0 + csv_version: 9.1.0 + cr_version: 5.3.1 + sub_channel: "v9.1" + + informix: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + informix_cp4d: + case_version: 10.1.0 + sub_channel: "v10.1" + csv_version: 10.1.0 + cr_version: 10.1.0 + + openscale: + case_version: 10.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + ws: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + ws_runtimes: + case_version: 12.1.0 + cr_version: 12.1.0 + + db2aaservice: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2oltp: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2wh: + case_version: 5.3.1 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + db2u: + case_version: 7.5.2 + sub_channel: "v7.7" + csv_version: 7.7.0 + cr_version: 5.3.1 + + datagate: + case_version: 11.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 9.1.0 + + dods: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + hee: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + dv: + case_version: 8.1.0 + sub_channel: "v8.1" + csv_version: 8.1.0 + cr_version: 3.3.1 + + bigsql: + case_version: 14.1.0 + sub_channel: "v14.1" + csv_version: 14.1.0 + cr_version: 8.3.1 + + planning_analytics: + case_version: 5.3.1 + sub_channel: "v11.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + rstudio: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + watson_assistant: + case_version: 5.11.0 + sub_channel: "v5.11" + csv_version: 5.11.0 + cr_version: "5.3.1" + + watson_discovery: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + watson_speech: + case_version: 11.1.0 + sub_channel: "v11.1" + csv_version: 11.1.0 + cr_version: 5.3.1 + + wkc: + case_version: 5.3.1 + sub_channel: "v9.1" + csv_version: 2.3.1 + cr_version: 5.3.1 + + ikc_standard: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + ikc_premium: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + datalineage: + case_version: 5.3.1 + sub_channel: "v7.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + udp: + case_version: 5.3.1 + sub_channel: "v5.31" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster: + case_version: 9.1.0 + csv_version: 9.1.0 + sub_channel: "v9.1" + cr_version: 9.1.0 + + dataproduct: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + semantic_automation: + case_version: 5.3.1 + sub_channel: "v8.1" + csv_version: 5.3.1 + cr_version: 5.3.1 + + productmaster_instance: + cr_version: 9.1.0 + + dp: + case_version: 11.1.0 + csv_version: 11.1.0 + sub_channel: "v11.1" + cr_version: 5.3.1 + + wml: + case_version: 12.1.0 + sub_channel: "v9.1" + csv_version: 9.1.0 + cr_version: 5.3.1 + + dmc: + case_version: 8.11.0 + csv_version: 5.11.0 + cr_version: 5.3.1 + sub_channel: "v5.11" + + openpages: + case_version: 10.1.0 + csv_version: 10.1.0 + cr_version: 9.7.0 + sub_channel: "v10.1" + + openpages_instance: + cr_version: 9.7.0 + + mantaflow: + case_version: 2.4.0 + csv_version: 2.4.0 + sub_channel: "v2.4" + cr_version: 42.15.0 + + match360: + case_version: 4.11.0 + csv_version: 4.11.0 + cr_version: 4.11.50 + sub_channel: "v4.11" + + model_gateway: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 12.1.0 + + opencontent_opensearch: + case_version: 1.2.0 + csv_version: 1.2.0 + cr_version: 1.2.0 + sub_channel: "v1.1" + + opencontent_redis: + case_version: 1.6.11 + csv_version: 1.6.11 + sub_channel: "v1.6" + + ibm_redis_cp: + case_version: 1.3.1 + csv_version: 1.3.1 + sub_channel: "v1.3" + cr_version: 1.3.1 + + opencontent_rabbitmq: + case_version: 1.3.0 + csv_version: 1.3.0 + sub_channel: "v1.0" + cr_version: 1.3.0 + + opencontent_fdb: + case_version: 5.3.1 + csv_version: 5.3.1 + cr_version: 5.3.1 + sub_channel: "v5.3" + + fdb_k8s: + csv_version: 5.3.1 + sub_channel: "v5.3" + + opencontent_minio: + case_version: 1.0.23 + csv_version: 1.0.18 + + opencontent_etcd: + case_version: 2.0.57 + csv_version: 1.0.47 + + opencontent_auditwebhook: + case_version: 1.0.24 + csv_version: 0.3.1 + + watson_gateway: + case_version: 2.2.0 + csv_version: 2.2.0 + cr_version: 2.2.0 + + data_governor: + case_version: 8.1.0 + csv_version: 8.1.0 + sub_channel: v8.1 + cr_version: 3.29.4 + + ws_pipelines: + case_version: 12.1.0 + sub_channel: "v12.1" + csv_version: 12.1.0 + cr_version: 5.3.1 + + postgresql: + case_version: 5.31.0 + sub_channel: "stable-v1.25" + csv_version: 1.25.5 + cr_version: 1.25.5 + + edb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + mongodb: + case_version: 5.31.0 + sub_channel: "stable" + csv_version: 1.33.0 + cr_version: 5.31.0 + + mongodb_cp4d: + case_version: 5.31.0 + sub_channel: "v5.31" + csv_version: 5.31.0 + cr_version: 5.31.0 + + dpra: + deprecated: true + case_version: 1.20.0 + sub_channel: "v1.20" + csv_version: 1.20.0 + cr_version: 1.20.0 + + factsheet: + case_version: 7.1.0 + csv_version: 7.1.0 + sub_channel: "v7.1" + cr_version: 5.3.1 + + replication: + case_version: 5.3.1 + csv_version: 7.1.0 + cr_version: 5.3.1 + sub_channel: "v7.1" + + voice_gateway: + case_version: 1.13.0 + csv_version: 1.13.0 + sub_channel: v1.13 + cr_version: 1.13.0 + + watsonx_data: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + watsonx_data_premium: + case_version: 6.1.0 + sub_channel: "v6.1" + csv_version: 6.1.0 + cr_version: 2.3.1 + + wxd_query_optimizer: + component_dependencies: + - db2u + + watsonx_ai: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + osai_min_version: 2.19.0 + + watsonx_ai_ifm: + case_version: 12.1.0 + csv_version: 12.1.0 + sub_channel: v12.1 + cr_version: 12.1.0 + + watsonx_bi_assistant: + case_version: 3.4.0 + csv_version: 3.4.0 + sub_channel: v3.4 + cr_version: 3.4.0 + + wca_ansible: + case_version: 4.1.0 + cr_version: 5.3.1 + + wca: + case_version: 3.1.0 + cr_version: 5.3.1 + + wca_z: + case_version: 4.1.0 + csv_version: 4.1.0 + sub_channel: v4.0 + cr_version: 5.3.1 + + wca_z_agentic: + case_version: 2.0.1 + csv_version: 2.0.1 + sub_channel: v2.1 + cr_version: 2.7.1 + + wca_z_ce: + case_version: 5.3.1 + sub_channel: v2.8 + csv_version: 2.8.10 + cr_version: 2.8.10 + + wca_z_cg: + case_version: 5.3.1 + sub_channel: v1.1 + csv_version: 1.1.1 + cr_version: 2.8.10 + + wca_base: + case_version: 4.1.0 + cr_version: 5.3.1 + + ibm_neo4j: + case_version: 1.3.1 + sub_channel: "v4.1" + csv_version: 1.3.1 + cr_version: 1.3.1 + + watsonx_governance: + case_version: 5.1.0 + sub_channel: "v5.1" + csv_version: 5.1.0 + cr_version: 2.3.1 + + watsonx_orchestrate: + case_version: 7.1.0 + sub_channel: "v7.1" + csv_version: 7.1.0 + cr_version: "7.1.0" + + watsonx_dataintegration: + case_version: 2.4.0 + sub_channel: "v2.4" + csv_version: 5.3.1 + cr_version: 2.3.1 + + watsonx_dataintelligence: + case_version: 2.3.1 + sub_channel: "v2.31" + csv_version: 2.3.1 + cr_version: 2.3.1 + + wca_z_understand: + case_version: 1.1.0 + csv_version: 1.1.0 + sub_channel: v1.1 + cr_version: 2.8.10 + + ibm-databand: + case_version: 1.0.0 + csv_version: 1.0.0 + cr_version: 1.0.0 + sub_channel: "v1.0.0" + + datastax_mc: + case_version: 1.16.1 + cr_version: 1.16.1 + + ibm_wxd_opensearch: + case_version: 3.3.2 + cr_version: 3.3.2 + release_version: 5.3.1 +{{- end }} + + diff --git a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml index 7797ff419..2c8d3d747 100644 --- a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml +++ b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml @@ -1526,3 +1526,144 @@ roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: admin + +{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0) }} +--- +# For CPD 5.3.1+, cpd-sa needs cluster-level permissions to apply CRDs and +# ClusterRoles from the Helm cluster-scoped charts during service installation. +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: "cpd-sa-helm-cluster-role-{{ .Values.instance_id }}" + annotations: + argocd.argoproj.io/sync-wave: "084" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +rules: + # CRD management (needed to apply cluster-scoped Helm charts) + - verbs: + - get + - list + - create + - update + - patch + - delete + apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + # ClusterRole/Binding management with escalate (allows granting permissions not yet held) + - verbs: + - get + - list + - create + - update + - patch + - delete + - bind + - escalate + apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + # Namespaced roles/rolebindings (needed by Helm namespace-scoped charts) + - verbs: + - get + - list + - create + - update + - patch + - delete + - watch + apiGroups: + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + # Namespace/node read + - verbs: + - get + - list + apiGroups: + - "" + resources: + - namespaces + - nodes + # OpenShift infra + - verbs: + - get + - list + apiGroups: + - config.openshift.io + resources: + - clusterversions + - infrastructures + # SCCs + - verbs: + - use + apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - anyuid + - restricted + - nonroot + - privileged + # CPD service API groups (needed to grant these permissions in cluster-scoped ClusterRoles) + - verbs: + - get + - list + - create + - update + - patch + - delete + - watch + apiGroups: + - ae.cpd.ibm.com + - wml.cpd.ibm.com + - spssmodeler.cpd.ibm.com + - ws.cpd.ibm.com + - ccs.cpd.ibm.com + - opensearch.cloudpackopen.ibm.com + - datarefinery.cpd.ibm.com + - wsruntimes.cpd.ibm.com + resources: + - "*" + # Webhook configs (needed by some Helm charts) + - verbs: + - get + - list + - create + - update + - patch + - delete + apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: "cpd-sa-helm-cluster-rb-{{ .Values.instance_id }}" + annotations: + argocd.argoproj.io/sync-wave: "085" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +subjects: + - kind: ServiceAccount + name: cpd-sa + namespace: "{{ .Values.cpd_operators_namespace }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: "cpd-sa-helm-cluster-role-{{ .Values.instance_id }}" +{{- end }} diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml index 4a90cf334..cb0ec381b 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml @@ -146,6 +146,7 @@ spec: backoffLimit: 4 +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} {{- if or .Values.wml_channel .Values.wsl_channel .Values.spss_channel }} --- apiVersion: operators.coreos.com/v1alpha1 @@ -246,3 +247,4 @@ spec: {{- end }} {{- end }} +{{- end }} diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml index aecaafdef..6a270dcee 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml @@ -1,4 +1,4 @@ -{{- if or .Values.wsl_channel .Values.spss_channel }} +{{- if and (or .Values.wsl_channel .Values.spss_channel) (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0) }} # Custom Operand Registries # ----------------------------------------------------------------------------- --- diff --git a/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml b/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml index 980b17c49..b76edaa92 100644 --- a/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/04-db2u-Volatile-Runstats_Cron.yaml @@ -4,6 +4,7 @@ {{- /* Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. */}} + {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} # diff --git a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml index 598d60619..392b67cf3 100644 --- a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml +++ b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,4 +17,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.spark_install_plan | default "Automatic" | quote }} - +{{- end }} diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 87a8a32c9..be1a252fa 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: ae.cpd.ibm.com/v1 kind: AnalyticsEngine @@ -22,3 +23,73 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.spark_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +apiVersion: batch/v1 +kind: Job +metadata: + name: install-spark-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + command: + - /bin/sh + - -c + - | + set -e + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + + echo "Installing analyticsengine cluster-scoped chart (CRDs + ClusterRoles)..." + helm template analyticsengine-cluster ibm-charts/analyticsengine-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for analyticsengines.ae.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd analyticsengines.ae.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing analyticsengine namespace-scoped chart (operator + CR)..." + helm upgrade --install analyticsengine ibm-charts/analyticsengine \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set analyticsengine.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 60m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 +{{- end }} diff --git a/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml b/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml index 65d3bf87d..e2c7b5f8a 100644 --- a/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml +++ b/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml @@ -55,6 +55,7 @@ are required here. */}} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- kind: ServiceAccount apiVersion: v1 @@ -165,5 +166,5 @@ spec: restartPolicy: Never serviceAccountName: spark-cp-sa backoffLimit: 4 - +{{- end }} diff --git a/instance-applications/120-ibm-spark/values.yaml b/instance-applications/120-ibm-spark/values.yaml index d6a766919..25e5c803b 100644 --- a/instance-applications/120-ibm-spark/values.yaml +++ b/instance-applications/120-ibm-spark/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" spark_channel: "" spark_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index dcb608e85..d54dac607 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -35,3 +36,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.canvasbase_install_plan | default "Automatic" | quote }} +{{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 2869c08f6..6f7c7368a 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,4 +1,4 @@ - +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: spssmodeler.cpd.ibm.com/v1 kind: Spss @@ -24,4 +24,74 @@ spec: version: "{{ .Values.spss_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" - wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" \ No newline at end of file + wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +apiVersion: batch/v1 +kind: Job +metadata: + name: install-spss-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + command: + - /bin/sh + - -c + - | + set -e + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + + echo "Installing spss-modeler cluster-scoped chart (CRDs + ClusterRoles)..." + helm template spss-modeler-cluster ibm-charts/spss-modeler-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for spssmodelers.spssmodeler.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd spssmodelers.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing spss-modeler namespace-scoped chart (operator + CR)..." + helm upgrade --install spss-modeler ibm-charts/spss-modeler \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set spssmodeler.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 60m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 +{{- end }} diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml index 51ca216c9..b7c0618d7 100644 --- a/instance-applications/120-ibm-spss/values.yaml +++ b/instance-applications/120-ibm-spss/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" spss_channel: "" spss_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml index 327653732..01f75abbd 100644 --- a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml +++ b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,3 +17,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.wml_install_plan | default "Automatic" | quote }} +{{- end }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index e1e789973..311232e18 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -1,3 +1,4 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: wml.cpd.ibm.com/v1beta1 kind: WmlBase @@ -22,3 +23,73 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.wml_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +apiVersion: batch/v1 +kind: Job +metadata: + name: install-wml-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + command: + - /bin/sh + - -c + - | + set -e + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + + echo "Installing wml cluster-scoped chart (CRDs + ClusterRoles)..." + helm template wml-cluster ibm-charts/wml-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for wmlbases.wml.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd wmlbases.wml.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing wml namespace-scoped chart (operator + CR)..." + helm upgrade --install wml ibm-charts/wml \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set wml.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 60m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 2 +{{- end }} diff --git a/instance-applications/120-ibm-wml/values.yaml b/instance-applications/120-ibm-wml/values.yaml index b5ec6e992..56dedaab2 100644 --- a/instance-applications/120-ibm-wml/values.yaml +++ b/instance-applications/120-ibm-wml/values.yaml @@ -5,3 +5,4 @@ cpd_service_scale_config: "" cpd_service_storage_class: "" wml_channel: "" wml_version: "" +cpd_product_version: "" diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index b2556409c..2f30520a5 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -1,3 +1,24 @@ +# --- +# apiVersion: operators.coreos.com/v1alpha1 +# kind: Subscription +# metadata: +# name: ibm-cpd-ws-operator +# namespace: "{{ .Values.cpd_operators_namespace }}" +# annotations: +# argocd.argoproj.io/sync-wave: "090" +# {{- if .Values.custom_labels }} +# labels: +# {{ .Values.custom_labels | toYaml | indent 4 }} +# {{- end }} +# spec: +# name: ibm-cpd-wsl +# channel: "{{ .Values.wsl_channel }}" +# source: ibm-operator-catalog +# sourceNamespace: openshift-marketplace +# installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} + + +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription @@ -16,3 +37,4 @@ spec: source: ibm-operator-catalog sourceNamespace: openshift-marketplace installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} +{{- end }} \ No newline at end of file diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 11c9d89a3..477584a6f 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -1,3 +1,33 @@ +# --- +# apiVersion: ws.cpd.ibm.com/v1beta1 +# kind: WS +# metadata: +# name: "ws-cr" +# namespace: "{{ .Values.cpd_instance_namespace }}" +# annotations: +# argocd.argoproj.io/sync-wave: "091" +# argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +# {{- if .Values.custom_labels }} +# labels: +# {{ .Values.custom_labels | toYaml | indent 4 }} +# {{- end }} +# spec: +# imagePullSecret: ibm-entitlement-key +# ignoreForMaintenance: false +# license: +# accept: true +# license: Standard +# scaleConfig: "{{ .Values.cpd_service_scale_config }}" +# fileStorageClass: "{{ .Values.cpd_service_storage_class }}" +# blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" +# version: "{{ .Values.wsl_version }}" +# ccs_operand_version: "{{ .Values.ccs_version }}" +# datarefinery_operand_version: "{{ .Values.datarefinery_version }}" +# wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" + + + +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} --- apiVersion: ws.cpd.ibm.com/v1beta1 kind: WS @@ -24,3 +54,194 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +# Installs WSL and all its dependencies (opensearch, ccs, datarefinery, ws-runtimes) +# using IBM Helm charts. Each component requires a cluster-scoped chart (CRDs/ClusterRoles) +# followed by a namespace-scoped chart (Operator + CR). +apiVersion: batch/v1 +kind: Job +metadata: + name: install-wsl-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded +spec: + template: + spec: + containers: + - name: helm-install + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + command: + - /bin/sh + - -c + - | + set -e + + HELM_REPO=ibm-charts + HELM_REPO_URL=https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + OPERATORS_NS={{ .Values.cpd_operators_namespace }} + INSTANCE_NS={{ .Values.cpd_instance_namespace }} + FILE_SC={{ .Values.cpd_service_storage_class }} + BLOCK_SC={{ .Values.cpd_service_block_storage_class }} + SCALE={{ .Values.cpd_service_scale_config }} + CPD_VERSION={{ .Values.cpd_product_version }} + PULL_SECRET=ibm-entitlement-key + + echo "================================================================" + echo "Adding IBM Helm repository" + echo "================================================================" + helm repo add ${HELM_REPO} ${HELM_REPO_URL} || true + helm repo update + + # Shared values file used by all components + printf 'global:\n licenseAccept: true\n releaseVersion: %s\n operatorNamespace: %s\n instanceNamespace: %s\n fileStorageClass: %s\n blockStorageClass: %s\n imagePullSecret: %s\n imagePullPrefix: cp.icr.io\n' \ + "${CPD_VERSION}" "${OPERATORS_NS}" "${INSTANCE_NS}" "${FILE_SC}" "${BLOCK_SC}" "${PULL_SECRET}" \ + > /tmp/cpd-global-values.yaml + + install_component() { + local NAME=$1 + local CHART=$2 + local CLUSTER_CHART=$3 + local VERSION=$4 + local EXTRA_VALUES=$5 + + echo "================================================================" + echo "Installing ${NAME} (version ${VERSION})" + echo "================================================================" + + # 1. Cluster-scoped chart (CRDs, ClusterRoles) + echo " [${NAME}] Installing cluster-scoped chart..." + helm template ${NAME}-cluster ${HELM_REPO}/${CLUSTER_CHART} \ + --version ${VERSION} \ + -f /tmp/cpd-global-values.yaml \ + --namespace ${OPERATORS_NS} | oc apply -f - + + # Wait for all CRDs from the cluster-scoped chart to be established + # before running the namespace-scoped chart that depends on them. + echo " [${NAME}] Waiting for CRDs to be established..." + sleep 5 + oc wait crd --all --for=condition=Established --timeout=120s 2>/dev/null || true + + # 2. Namespace-scoped chart (Operator + CR) + echo " [${NAME}] Installing namespace-scoped chart..." + helm upgrade --install ${NAME} ${HELM_REPO}/${CHART} \ + --version ${VERSION} \ + -f /tmp/cpd-global-values.yaml \ + ${EXTRA_VALUES} \ + --namespace ${INSTANCE_NS} \ + --create-namespace \ + --wait --timeout 60m + } + + # ---------------------------------------------------------------- + # Step 1: OpenSearch (dependency) + # ---------------------------------------------------------------- + install_component \ + "opencontent-opensearch" \ + "opencontent-opensearch" \ + "opencontent-opensearch-cluster-scoped" \ + "1.2.0" + + echo "Waiting for opensearchclusters.opensearch.cloudpackopen.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd opensearchclusters.opensearch.cloudpackopen.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + # ---------------------------------------------------------------- + # Step 2: CCS - Common Core Services (dependency) + # ---------------------------------------------------------------- + install_component \ + "ccs" \ + "ccs" \ + "ccs-cluster-scoped" \ + "12.1.0" \ + "--set ccs.scaleConfig=${SCALE}" + + # Wait for CCS CR to be ready + echo "Waiting for CCS CR to be ready..." + oc wait ccs/ccs-cr -n ${INSTANCE_NS} \ + --for=jsonpath='{.status.controlPlaneStatus}'=Completed \ + --timeout=60m + + # ---------------------------------------------------------------- + # Step 3: DataRefinery (dependency) + # ---------------------------------------------------------------- + install_component \ + "datarefinery" \ + "datarefinery" \ + "datarefinery-cluster-scoped" \ + "12.1.0" + + echo "Waiting for datarefineries.datarefinery.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd datarefineries.datarefinery.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + # ---------------------------------------------------------------- + # Step 4: WS Runtimes (dependency) + # ---------------------------------------------------------------- + install_component \ + "ws-runtimes" \ + "ws-runtimes" \ + "ws-runtimes-cluster-scoped" \ + "12.1.0" + + echo "Waiting for wsruntimes.wsruntimes.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd wsruntimes.wsruntimes.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + # ---------------------------------------------------------------- + # Step 5: Watson Studio (main component) + # ---------------------------------------------------------------- + install_component \ + "wsl" \ + "ws" \ + "ws-cluster-scoped" \ + "12.1.0" \ + "--set ws.scaleConfig=${SCALE}" + + echo "================================================================" + echo "WSL installation complete" + echo "================================================================" + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 1 +{{- end }} diff --git a/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml b/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml index 8aebe3f14..556806533 100644 --- a/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml +++ b/instance-applications/121-ibm-post-sync-job-cp4d-services/templates/01-cpd-service-post-ops.yaml @@ -25,7 +25,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v1" }} +{{- $_job_version := "v2" }} {{- /* 10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest @@ -247,6 +247,15 @@ spec: echo $(( $V1 - $V2 )) } + # For CPD 5.3.1+, CCS and OpenSearch are installed via Helm (not OLM). + # The CCS CR and OpenSearch CR managed by this post-sync job do not exist + # in that deployment model, so skip all OLM-specific post-sync patching. + COMP_531=$(compare_versions ${CPD_PRODUCT_VERSION} 5.3.1) + if [[ ${COMP_531} -ge 0 ]]; then + echo "CPD ${CPD_PRODUCT_VERSION} detected (>= 5.3.1) - CCS/OpenSearch installed via Helm, skipping OLM post-sync patching" + exit 0 + fi + echo echo "================================================================================" echo "Wait for CCS Cr to be ready and patch if needed" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml index 6834f1a38..af0446795 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml @@ -48,6 +48,7 @@ spec: application_admin_role: {{ .Values.application_admin_role }} ccs_version: "{{ .Values.ibm_spark.ccs_version }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_service_block_storage_class: "{{ .Values.ibm_spark.cpd_service_block_storage_class }}" cpd_service_scale_config: "{{ .Values.ibm_spark.cpd_service_scale_config }}" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index 7609a1110..03b5be98a 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -47,6 +47,7 @@ spec: sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" cpd_service_storage_class: "{{ .Values.ibm_spss.cpd_service_storage_class }}" cpd_service_block_storage_class: "{{ .Values.ibm_spss.cpd_service_block_storage_class }}" cpd_service_scale_config: "{{ .Values.ibm_spss.cpd_service_scale_config }}" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index 21c3074b9..43098f834 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -48,6 +48,7 @@ spec: sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" cpd_service_storage_class: "{{ .Values.ibm_wsl.cpd_service_storage_class }}" cpd_service_block_storage_class: "{{ .Values.ibm_wsl.cpd_service_block_storage_class }}" cpd_service_scale_config: "{{ .Values.ibm_wsl.cpd_service_scale_config }}" From 7f9302d47788e3fc909380b45aecc924b8d32544 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 12:18:55 +0530 Subject: [PATCH 023/103] MASCORE-15507: add HookFailed delete policy to CPD 5.3.1 Helm install Jobs Static-named ArgoCD sync hook Jobs (install-wsl-helm, install-wml-helm, install-spss-helm, install-spark-helm) were failing with: 'spec.template: Invalid value ... field is immutable' This happens when an old Job with the same name exists from a prior sync and ArgoCD tries to patch it. Since Job spec.template is immutable, the patch is rejected. Fix: add HookFailed to hook-delete-policy on all four Jobs so ArgoCD deletes the Job on both success AND failure, ensuring no stale Job exists when the next sync runs. --- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 2 +- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index be1a252fa..b7bd144bd 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -34,7 +34,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed spec: template: spec: diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 6f7c7368a..2600203b8 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -36,7 +36,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed spec: template: spec: diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 311232e18..cfc1e0477 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -34,7 +34,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed spec: template: spec: diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 477584a6f..de0ff0875 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -68,7 +68,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "091" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed spec: template: spec: From ca746ce3c9e0d3e51e5dc6b57805a04c20e30bf2 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 13:45:22 +0530 Subject: [PATCH 024/103] MASCORE-15507: fix wrong OpenSearch CRD name in WSL Helm Job wait loop The wait loop was polling for: opensearchclusters.opensearch.cloudpackopen.ibm.com (does not exist) The actual CRD name registered by the IBM OpenSearch Helm chart is: clusters.opensearch.cloudpackopen.ibm.com This caused the WSL Helm Job to always timeout after 5 minutes at the OpenSearch step, blocking CCS, DataRefinery, WS-Runtimes and WSL from ever installing. --- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 3b3920893..81925a30e 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -148,7 +148,7 @@ spec: "opencontent-opensearch-cluster-scoped" \ "1.2.0" - echo "Waiting for opensearchclusters.opensearch.cloudpackopen.ibm.com CRD to be established..." + echo "Waiting for clusters.opensearch.cloudpackopen.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -156,7 +156,7 @@ spec: echo "CRD not established after 5 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd opensearchclusters.opensearch.cloudpackopen.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd clusters.opensearch.cloudpackopen.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "CRD established." break From 861314a69c0bdcec3de46a2c60a32bcc8978f76f Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 13:59:58 +0530 Subject: [PATCH 025/103] MASCORE-15507: fix CCS CR wait - poll with ignore-not-found instead of oc wait oc wait exits immediately with error if the resource does not exist. The CCS CR (ccs-cr) is created by the CCS operator after Helm installs it, so it is not immediately present. Replace oc wait with a polling loop using --ignore-not-found, same pattern used for all other CRD waits in this script. Polls every 30s up to 60 minutes. --- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 24 +++++++++++++++---- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 81925a30e..205a23107 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -174,11 +174,25 @@ spec: "12.1.0" \ "--set ccs.scaleConfig=${SCALE}" - # Wait for CCS CR to be ready - echo "Waiting for CCS CR to be ready..." - oc wait ccs/ccs-cr -n ${INSTANCE_NS} \ - --for=jsonpath='{.status.controlPlaneStatus}'=Completed \ - --timeout=60m + # Wait for CCS CR to be created then reach Completed status + echo "Waiting for CCS CR to be created and ready..." + wait_period=0 + while true; do + wait_period=$((wait_period+30)) + if [ $wait_period -gt 3600 ]; then + echo "CCS CR not ready after 60 minutes. Exiting." + exit 1 + fi + CCS_STATUS=$(oc get ccs ccs-cr -n ${INSTANCE_NS} \ + -o jsonpath='{.status.controlPlaneStatus}' \ + --ignore-not-found 2>/dev/null) + if [ "${CCS_STATUS}" = "Completed" ]; then + echo "CCS CR is ready." + break + fi + echo " CCS status: '${CCS_STATUS:-not found}' - waiting 30s..." + sleep 30 + done # ---------------------------------------------------------------- # Step 3: DataRefinery (dependency) From 54ced4a345e1ce13bd93418ea0384a5f5233e319 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 14:33:01 +0530 Subject: [PATCH 026/103] fix WSL Helm Job: explicitly create ccs-cr with non_olm_deploy=true after CCS Helm install --- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 205a23107..189ca59f1 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -174,8 +174,17 @@ spec: "12.1.0" \ "--set ccs.scaleConfig=${SCALE}" - # Wait for CCS CR to be created then reach Completed status - echo "Waiting for CCS CR to be created and ready..." + # In CPD 5.3.1 Helm mode the namespace-scoped chart only deploys the + # operator; the CCS CR must be created explicitly with non_olm_deploy=true + # so the operator reconciles the actual CCS instance. + echo "Creating ccs-cr (non_olm_deploy=true) if not already present..." + printf 'apiVersion: ccs.cpd.ibm.com/v1beta1\nkind: Ccs\nmetadata:\n name: ccs-cr\n namespace: %s\nspec:\n license:\n accept: true\n license: Standard\n imagePullSecret: %s\n fileStorageClass: %s\n blockStorageClass: %s\n scaleConfig: %s\n non_olm_deploy: true\n' \ + "${INSTANCE_NS}" "${PULL_SECRET}" "${FILE_SC}" "${BLOCK_SC}" "${SCALE}" \ + > /tmp/ccs-cr.yaml + oc apply -f /tmp/ccs-cr.yaml + + # Wait for CCS CR to reach Completed status + echo "Waiting for CCS CR to be ready..." wait_period=0 while true; do wait_period=$((wait_period+30)) From b0793fdc97a4a50cad9f9e6f851b25870499546b Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 15:17:32 +0530 Subject: [PATCH 027/103] fix WSL Helm Job: correct CCS CR kind from 'Ccs' to 'CCS' --- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 189ca59f1..a03b32549 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -178,7 +178,7 @@ spec: # operator; the CCS CR must be created explicitly with non_olm_deploy=true # so the operator reconciles the actual CCS instance. echo "Creating ccs-cr (non_olm_deploy=true) if not already present..." - printf 'apiVersion: ccs.cpd.ibm.com/v1beta1\nkind: Ccs\nmetadata:\n name: ccs-cr\n namespace: %s\nspec:\n license:\n accept: true\n license: Standard\n imagePullSecret: %s\n fileStorageClass: %s\n blockStorageClass: %s\n scaleConfig: %s\n non_olm_deploy: true\n' \ + printf 'apiVersion: ccs.cpd.ibm.com/v1beta1\nkind: CCS\nmetadata:\n name: ccs-cr\n namespace: %s\nspec:\n license:\n accept: true\n license: Standard\n imagePullSecret: %s\n fileStorageClass: %s\n blockStorageClass: %s\n scaleConfig: %s\n non_olm_deploy: true\n' \ "${INSTANCE_NS}" "${PULL_SECRET}" "${FILE_SC}" "${BLOCK_SC}" "${SCALE}" \ > /tmp/ccs-cr.yaml oc apply -f /tmp/ccs-cr.yaml From 417bd713d9add1fa1b2550b95644c27548b1ffb4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 15:25:09 +0530 Subject: [PATCH 028/103] fix WSL Helm Job: poll .status.ccsStatus not .status.controlPlaneStatus for CCS CR readiness --- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index a03b32549..d8c72c400 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -193,7 +193,7 @@ spec: exit 1 fi CCS_STATUS=$(oc get ccs ccs-cr -n ${INSTANCE_NS} \ - -o jsonpath='{.status.controlPlaneStatus}' \ + -o jsonpath='{.status.ccsStatus}' \ --ignore-not-found 2>/dev/null) if [ "${CCS_STATUS}" = "Completed" ]; then echo "CCS CR is ready." From 796c2c94a6781ec5e4dfef1b6df93c1b9f1581aa Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 23:29:37 +0530 Subject: [PATCH 029/103] increase backoffLimit to 4 for all CPD 5.3.1 Helm service Jobs --- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 2 +- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index 246ad32be..a27460904 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -93,5 +93,5 @@ spec: --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa - backoffLimit: 2 + backoffLimit: 4 {{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 592d18fa4..f68ad41aa 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -95,5 +95,5 @@ spec: --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa - backoffLimit: 2 + backoffLimit: 4 {{- end }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 204d8406f..969c75f1b 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -93,5 +93,5 @@ spec: --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa - backoffLimit: 2 + backoffLimit: 4 {{- end }} diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index d8c72c400..ee07620e4 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -268,5 +268,5 @@ spec: echo "================================================================" restartPolicy: Never serviceAccountName: cpd-sa - backoffLimit: 1 + backoffLimit: 4 {{- end }} From 25b432113e16a14a129eb71c7a918675cc12d6db Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 6 Aug 2026 23:47:35 +0530 Subject: [PATCH 030/103] fix WSL YAML indentation: backoffLimit must align with spec fields --- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index ee07620e4..124d2deed 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -268,5 +268,5 @@ spec: echo "================================================================" restartPolicy: Never serviceAccountName: cpd-sa - backoffLimit: 4 + backoffLimit: 4 {{- end }} From b251a9a860df4447adb0ef0229bbeb988dfaefb2 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 7 Aug 2026 10:58:11 +0530 Subject: [PATCH 031/103] increase CRD wait timeout from 5min to 20min for DataRefinery and WS-Runtimes --- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 124d2deed..4138a49a8 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -216,8 +216,8 @@ spec: wait_period=0 while true; do wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." + if [ $wait_period -gt 1200 ]; then + echo "CRD not established after 20 minutes. Exiting." exit 1 fi STATUS=$(oc get crd datarefineries.datarefinery.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) @@ -241,8 +241,8 @@ spec: wait_period=0 while true; do wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." + if [ $wait_period -gt 1200 ]; then + echo "CRD not established after 20 minutes. Exiting." exit 1 fi STATUS=$(oc get crd wsruntimes.wsruntimes.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) From cd78e7335250fdba146a7b3bac10f78e22432a5a Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 7 Aug 2026 11:28:29 +0530 Subject: [PATCH 032/103] fix WSL Job: correct CRD names - datarefinery (singular) and runtimeassemblies --- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 4138a49a8..53331456c 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -212,7 +212,7 @@ spec: "datarefinery-cluster-scoped" \ "12.1.0" - echo "Waiting for datarefineries.datarefinery.cpd.ibm.com CRD to be established..." + echo "Waiting for datarefinery.datarefinery.cpd.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -220,7 +220,7 @@ spec: echo "CRD not established after 20 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd datarefineries.datarefinery.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd datarefinery.datarefinery.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "CRD established." break @@ -237,7 +237,7 @@ spec: "ws-runtimes-cluster-scoped" \ "12.1.0" - echo "Waiting for wsruntimes.wsruntimes.cpd.ibm.com CRD to be established..." + echo "Waiting for runtimeassemblies.runtimes.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -245,7 +245,7 @@ spec: echo "CRD not established after 20 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd wsruntimes.wsruntimes.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd runtimeassemblies.runtimes.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "CRD established." break From da4c3deb9fc42e72b435a2ee3d09303c32344a62 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 7 Aug 2026 14:39:23 +0530 Subject: [PATCH 033/103] fix SPSS Helm Job: increase CRD wait timeout from 5min to 20min --- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index f68ad41aa..0fe2ad430 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -67,8 +67,8 @@ spec: wait_period=0 while true; do wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." + if [ $wait_period -gt 1200 ]; then + echo "CRD not established after 20 minutes. Exiting." exit 1 fi STATUS=$(oc get crd spssmodelers.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) From 3df4a31a4759f6240384b3d6785b4bd0d8839ca1 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 7 Aug 2026 15:46:19 +0530 Subject: [PATCH 034/103] added 4th cpd service (CA) --- .../00-ibm-cognos-analytics_Subscription.yaml | 19 ++++ .../templates/01-ibm-cognos-analytics-cr.yaml | 98 +++++++++++++++++++ .../120-ibm-cognos-analytics/values.yaml | 8 ++ 3 files changed, 125 insertions(+) create mode 100644 instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml create mode 100644 instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml create mode 100644 instance-applications/120-ibm-cognos-analytics/values.yaml diff --git a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml new file mode 100644 index 000000000..169108421 --- /dev/null +++ b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml @@ -0,0 +1,19 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: cognos-analytics-subscription + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + channel: "{{ .Values.cognos_analytics_channel }}" + name: cognos-analytics-operator + source: ibm-operator-catalog + sourceNamespace: openshift-marketplace +{{- end }} diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml new file mode 100644 index 000000000..c54fb2565 --- /dev/null +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -0,0 +1,98 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +--- +apiVersion: cognosanalytics.cpd.ibm.com/v1 +kind: CognosAnalytics +metadata: + name: "cognos-analytics-sample" + namespace: "{{ .Values.cpd_instance_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + imagePullSecret: ibm-entitlement-key + ignoreForMaintenance: false + license: + accept: true + license: Standard + fileStorageClass: "{{ .Values.cpd_service_storage_class }}" + blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" + scaleConfig: "{{ .Values.cpd_service_scale_config }}" + version: "{{ .Values.cognos_analytics_version }}" + ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +# Cognos Analytics is an optional analytics and reporting service +apiVersion: batch/v1 +kind: Job +metadata: + name: install-cognos-analytics-helm + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed + +spec: + template: + spec: + containers: + - name: helm-install + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + command: + - /bin/sh + - -c + - | + set -e + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + + echo "Installing cognos-analytics cluster-scoped chart (CRDs + ClusterRoles)..." + helm template cognos-analytics-cluster ibm-charts/cognos-analytics-cluster-scoped \ + --version 29.1.8 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for cognosanalytics.cognosanalytics.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd cognosanalytics.cognosanalytics.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing cognos-analytics namespace-scoped chart (operator + CR)..." + helm upgrade --install cognos-analytics ibm-charts/cognos-analytics \ + --version 29.1.8 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set cognosanalytics.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 60m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 4 +{{- end }} diff --git a/instance-applications/120-ibm-cognos-analytics/values.yaml b/instance-applications/120-ibm-cognos-analytics/values.yaml new file mode 100644 index 000000000..19981f481 --- /dev/null +++ b/instance-applications/120-ibm-cognos-analytics/values.yaml @@ -0,0 +1,8 @@ +--- +ccs_version: "" +cpd_service_block_storage_class: "" +cpd_service_scale_config: "" +cpd_service_storage_class: "" +cognos_analytics_channel: "" +cognos_analytics_version: "" +cpd_product_version: "" From 6d28a85b0ed2861b26dc813667c2ebe33eaec049 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 10:11:17 +0530 Subject: [PATCH 035/103] Remove SPSS CPD service - focus on Cognos Analytics only --- instance-applications/120-ibm-spss/Chart.yaml | 11 --- instance-applications/120-ibm-spss/README.md | 62 ------------ .../templates/00-ibm-spss_Subscription.yaml | 39 -------- .../templates/01-ibm-spss-cr.yaml | 99 ------------------- .../120-ibm-spss/values.yaml | 8 -- 5 files changed, 219 deletions(-) delete mode 100644 instance-applications/120-ibm-spss/Chart.yaml delete mode 100644 instance-applications/120-ibm-spss/README.md delete mode 100644 instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml delete mode 100644 instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml delete mode 100644 instance-applications/120-ibm-spss/values.yaml diff --git a/instance-applications/120-ibm-spss/Chart.yaml b/instance-applications/120-ibm-spss/Chart.yaml deleted file mode 100644 index 9c9f81ec4..000000000 --- a/instance-applications/120-ibm-spss/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: ibm-spss -description: SPSS Modeler -type: application -version: 1.0.0 - -dependencies: -- name: junitreporter - version: 1.0.0 - repository: "file://../../sub-charts/junitreporter/" - condition: junitreporter.devops_mongo_uri != "" \ No newline at end of file diff --git a/instance-applications/120-ibm-spss/README.md b/instance-applications/120-ibm-spss/README.md deleted file mode 100644 index 094e3e453..000000000 --- a/instance-applications/120-ibm-spss/README.md +++ /dev/null @@ -1,62 +0,0 @@ -SPSS Modeler -=============================================================================== -Deploys and configures the CP4D Service, SPSS Modeler. - - - - -[SPSS Modeler](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.8.x?topic=modeler-installing) optional dependency for [Predict](https://www.ibm.com/docs/en/mas-cd/mhmpmh-and-p-u/continuous-delivery) - -## Resources Created - -| Resource Type | Resource Name | Namespace | Condition | Installed By | -|--------------|---------------|-----------|-----------|--------------| -| `Subscription` | SPSS operator subscriptions | CP4D instance namespace | Always | `application_admin_role` | -| `Spss` | SPSS service CR | CP4D instance namespace | Always | `application_admin_role` | - -## Configuration - -This chart accepts the following configuration values in the ArgoCD Application values: - -```yaml -ibm_spss: - ccs_version: string (secret reference) - cpd_service_block_storage_class: string - cpd_service_scale_config: string - cpd_service_storage_class: string - spss_channel: string (secret reference) - spss_version: string (secret reference) - spss_install_plan: string - canvasbase_channel: string (secret reference) - canvasbase_install_plan: string -``` - -**Note**: Values marked with "(secret reference)" should use the format `` to reference secrets stored in the Secrets Vault. - -## Base Instance Values - -This chart inherits common instance configuration values. The most frequently used base values are: - -```yaml -account: - id: string # Account identifier - name: string # Account name - -region: - id: string # Region identifier - name: string # Region name - -cluster: - id: string # Cluster identifier - name: string # Cluster name - -instance: - id: string # MAS instance identifier - -sm: # Secrets Manager configuration - aws_secret_region: string - aws_access_key_id: string (secret reference) - aws_secret_access_key: string (secret reference) -``` - -For complete documentation of all base instance values including optional fields like `custom_labels`, `argocluster_instance`, `application_admin_service_account`, `mas_wipe_mongo_data`, `allow_list`, `additional_vpn`, `application_configuration`, `use_postdelete_hooks`, `additional_resources`, `extensions`, `enhanced_dr`, and `cli_image_repo`, see the [Instance Base Values Reference](../../docs/reference/instance-base-values.md). diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml deleted file mode 100644 index d54dac607..000000000 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ /dev/null @@ -1,39 +0,0 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: "cpd-spss-operator" - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - name: "ibm-cpd-spss" - channel: "{{ .Values.spss_channel }}" - source: ibm-operator-catalog - sourceNamespace: openshift-marketplace - installPlanApproval: {{ .Values.spss_install_plan | default "Automatic" | quote }} - ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: "ibm-cpd-canvasbase-operator-catalog-subscription" # needed only by spss - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - name: "ibm-cpd-canvasbase" - channel: "{{ .Values.canvasbase_channel }}" - source: ibm-operator-catalog - sourceNamespace: openshift-marketplace - installPlanApproval: {{ .Values.canvasbase_install_plan | default "Automatic" | quote }} -{{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml deleted file mode 100644 index 0fe2ad430..000000000 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ /dev/null @@ -1,99 +0,0 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} ---- -apiVersion: spssmodeler.cpd.ibm.com/v1 -kind: Spss -metadata: - name: "spss-sample" - namespace: "{{ .Values.cpd_instance_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - imagePullSecret: ibm-entitlement-key - ignoreForMaintenance: false - license: - accept: true - license: Standard - scaleConfig: "{{ .Values.cpd_service_scale_config }}" - fileStorageClass: "{{ .Values.cpd_service_storage_class }}" - blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" - version: "{{ .Values.spss_version }}" - ccs_operand_version: "{{ .Values.ccs_version }}" - datarefinery_operand_version: "{{ .Values.datarefinery_version }}" - wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" -{{- else }} ---- -# Helm-based installation for CPD 5.3.1+ -apiVersion: batch/v1 -kind: Job -metadata: - name: install-spss-helm - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/hook: Sync - - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed - -spec: - template: - spec: - containers: - - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 - command: - - /bin/sh - - -c - - | - set -e - helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm - helm repo update - - echo "Installing spss-modeler cluster-scoped chart (CRDs + ClusterRoles)..." - helm template spss-modeler-cluster ibm-charts/spss-modeler-cluster-scoped \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Waiting for spssmodelers.spssmodeler.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 1200 ]; then - echo "CRD not established after 20 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd spssmodelers.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - echo "Installing spss-modeler namespace-scoped chart (operator + CR)..." - helm upgrade --install spss-modeler ibm-charts/spss-modeler \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --set spssmodeler.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 60m - restartPolicy: Never - serviceAccountName: cpd-sa - backoffLimit: 4 -{{- end }} diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml deleted file mode 100644 index b7c0618d7..000000000 --- a/instance-applications/120-ibm-spss/values.yaml +++ /dev/null @@ -1,8 +0,0 @@ ---- -ccs_version: "" -cpd_service_block_storage_class: "" -cpd_service_scale_config: "" -cpd_service_storage_class: "" -spss_channel: "" -spss_version: "" -cpd_product_version: "" From 7621047450d5fb66b5a291c01355d94e63f4703c Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 12:04:48 +0530 Subject: [PATCH 036/103] Add Cognos Analytics ArgoCD Application definition to instance root --- .../120-ibm-cognos-analytics-app.yaml | 83 +++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml new file mode 100644 index 000000000..9c29b0c07 --- /dev/null +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -0,0 +1,83 @@ +{{- if and (not (empty .Values.ibm_cognos_analytics)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} +{{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +--- +# IBM Cognos Analytics Application +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cognos.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "120" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + repoURL: "{{ .Values.source.repo_url }}" + path: instance-applications/120-ibm-cognos-analytics + targetRevision: "{{ .Values.source.revision }}" + plugin: + name: {{ .Values.avp.name }} + env: + - name: {{ .Values.avp.values_varname }} + value: | + account_id: "{{ .Values.account.id }}" + region_id: "{{ .Values.region.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + cli_image_repo: {{ .Values.cli_image_repo }} + cluster_admin_role: {{ .Values.cluster_admin_role }} + application_admin_role: {{ .Values.application_admin_role }} + sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" + sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" + cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" + cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" + cpd_service_storage_class: "{{ .Values.ibm_cognos_analytics.cpd_service_storage_class }}" + cpd_service_block_storage_class: "{{ .Values.ibm_cognos_analytics.cpd_service_block_storage_class }}" + cpd_service_scale_config: "{{ .Values.ibm_cognos_analytics.cpd_service_scale_config }}" + ccs_version: "{{ .Values.ibm_cognos_analytics.ccs_version }}" + {{- if .Values.custom_labels }} + custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} + {{- end }} + junitreporter: + reporter_name: "ibm-cognos-analytics-{{ .Values.instance.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" + devops_build_number: "{{ .Values.devops.build_number }}" + gitops_version: "{{ .Values.source.revision }}" + cli_image_repo: {{ .Values.cli_image_repo }} + - name: ARGOCD_APP_NAME + value: cpdcognosapp + {{- if not (empty .Values.avp.secret) }} + - name: AVP_SECRET + value: {{ .Values.avp.secret }} + {{- end }} + syncPolicy: + automated: + {{- if .Values.auto_delete }} + prune: true + {{- end }} + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false +{{- end }} From 5d69bf498419e660b21a83feee225d2035e6de7a Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 12:16:24 +0530 Subject: [PATCH 037/103] Remove SPSS application definition - SPSS service deleted --- .../templates/120-ibm-spss-app.yaml | 87 ------------------- 1 file changed, 87 deletions(-) delete mode 100644 root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml deleted file mode 100644 index 03b5be98a..000000000 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ /dev/null @@ -1,87 +0,0 @@ -{{- if and (not (empty .Values.ibm_spss)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} -{{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} ---- -# IBM Maximo Operator Catalog -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: spss.{{ .Values.cluster.id }}.{{ .Values.instance.id }} - namespace: {{ .Values.argo.namespace }} - labels: - environment: '{{ .Values.account.id }}' - region: '{{ .Values.region.id }}' - cluster: '{{ .Values.cluster.id }}' - {{- if .Values.argo.instance }} - argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' - {{- end }} - instance: '{{ .Values.instance.id }}' - annotations: - argocd.argoproj.io/sync-wave: "120" - {{- if and .Values.notifications .Values.notifications.slack_channel_id }} - notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} - notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} - {{- end }} - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: "{{ .Values.argo.projects.apps }}" - destination: - server: {{ .Values.cluster.url }} - namespace: {{ $cpd_operators_ns }} - source: - repoURL: "{{ .Values.source.repo_url }}" - path: instance-applications/120-ibm-spss - targetRevision: "{{ .Values.source.revision }}" - plugin: - name: {{ .Values.avp.name }} - env: - - name: {{ .Values.avp.values_varname }} - value: | - account_id: "{{ .Values.account.id }}" - region_id: "{{ .Values.region.id }}" - cluster_id: "{{ .Values.cluster.id }}" - instance_id: "{{ .Values.instance.id }}" - cluster_admin_role: {{ .Values.cluster_admin_role }} - application_admin_role: {{ .Values.application_admin_role }} - sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" - sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" - cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" - cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" - cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" - cpd_service_storage_class: "{{ .Values.ibm_spss.cpd_service_storage_class }}" - cpd_service_block_storage_class: "{{ .Values.ibm_spss.cpd_service_block_storage_class }}" - cpd_service_scale_config: "{{ .Values.ibm_spss.cpd_service_scale_config }}" - spss_version: "{{ .Values.ibm_spss.spss_version }}" - spss_channel: "{{ .Values.ibm_spss.spss_channel }}" - spss_install_plan: "{{ .Values.ibm_spss.spss_install_plan }}" - ccs_version: "{{ .Values.ibm_spss.ccs_version }}" - canvasbase_channel: "{{ .Values.ibm_spss.canvasbase_channel }}" - canvasbase_install_plan: "{{ .Values.ibm_spss.canvasbase_install_plan }}" - {{- if .Values.custom_labels }} - custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} - {{- end }} - junitreporter: - reporter_name: "ibm-spss-{{ .Values.instance.id }}" - cluster_id: "{{ .Values.cluster.id }}" - instance_id: "{{ .Values.instance.id }}" - devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" - devops_build_number: "{{ .Values.devops.build_number }}" - gitops_version: "{{ .Values.source.revision }}" - cli_image_repo: {{ .Values.cli_image_repo }} - - name: ARGOCD_APP_NAME - value: cpdspssapp - {{- if not (empty .Values.avp.secret) }} - - name: AVP_SECRET - value: {{ .Values.avp.secret }} - {{- end }} - syncPolicy: - automated: - {{- if .Values.auto_delete }} - prune: true - {{- end }} - selfHeal: true - retry: - limit: 20 - syncOptions: - - CreateNamespace=false -{{- end }} \ No newline at end of file From a59cb950884f24cbcc4e747fcb2b4c3d8e5740fb Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 12:23:00 +0530 Subject: [PATCH 038/103] Fix Cognos Analytics Application - use default values, remove ibm_cognos_analytics dependency --- .../templates/120-ibm-cognos-analytics-app.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index 9c29b0c07..a025e0711 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -1,4 +1,4 @@ -{{- if and (not (empty .Values.ibm_cognos_analytics)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} +{{- if and (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} --- # IBM Cognos Analytics Application @@ -49,10 +49,10 @@ spec: cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" - cpd_service_storage_class: "{{ .Values.ibm_cognos_analytics.cpd_service_storage_class }}" - cpd_service_block_storage_class: "{{ .Values.ibm_cognos_analytics.cpd_service_block_storage_class }}" - cpd_service_scale_config: "{{ .Values.ibm_cognos_analytics.cpd_service_scale_config }}" - ccs_version: "{{ .Values.ibm_cognos_analytics.ccs_version }}" + cpd_service_storage_class: "{{ .Values.ibm_cp4d.cpd_service_storage_class | default \"nfs-client\" }}" + cpd_service_block_storage_class: "{{ .Values.ibm_cp4d.cpd_service_block_storage_class | default \"nfs-client\" }}" + cpd_service_scale_config: "{{ .Values.ibm_cp4d.cpd_service_scale_config | default \"small\" }}" + ccs_version: "{{ .Values.ibm_cp4d.ccs_version | default \"12.1.0\" }}" {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} {{- end }} From 309fbaceeb5d7205c20f5392b9d886d2a524d665 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 12:42:34 +0530 Subject: [PATCH 039/103] MASCORE-15507: Fix parse error caused by escaped quotes in default values --- .../templates/120-ibm-cognos-analytics-app.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index a025e0711..2143a7188 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -49,10 +49,10 @@ spec: cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" - cpd_service_storage_class: "{{ .Values.ibm_cp4d.cpd_service_storage_class | default \"nfs-client\" }}" - cpd_service_block_storage_class: "{{ .Values.ibm_cp4d.cpd_service_block_storage_class | default \"nfs-client\" }}" - cpd_service_scale_config: "{{ .Values.ibm_cp4d.cpd_service_scale_config | default \"small\" }}" - ccs_version: "{{ .Values.ibm_cp4d.ccs_version | default \"12.1.0\" }}" + cpd_service_storage_class: "{{ .Values.ibm_cp4d.cpd_service_storage_class | default "nfs-client" }}" + cpd_service_block_storage_class: "{{ .Values.ibm_cp4d.cpd_service_block_storage_class | default "nfs-client" }}" + cpd_service_scale_config: "{{ .Values.ibm_cp4d.cpd_service_scale_config | default "small" }}" + ccs_version: "{{ .Values.ibm_cp4d.ccs_version | default "12.1.0" }}" {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} {{- end }} From 28fe970885e9d97800c016609a15b9bd08cefda6 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 13:00:54 +0530 Subject: [PATCH 040/103] MASCORE-15507: Add missing Chart.yaml for ibm-cognos-analytics chart --- .../120-ibm-cognos-analytics/Chart.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 instance-applications/120-ibm-cognos-analytics/Chart.yaml diff --git a/instance-applications/120-ibm-cognos-analytics/Chart.yaml b/instance-applications/120-ibm-cognos-analytics/Chart.yaml new file mode 100644 index 000000000..44c18d098 --- /dev/null +++ b/instance-applications/120-ibm-cognos-analytics/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: ibm-cognos-analytics +description: IBM Cognos Analytics +type: application +version: 1.0.0 + +dependencies: +- name: junitreporter + version: 1.0.0 + repository: "file://../../sub-charts/junitreporter/" + condition: junitreporter.devops_mongo_uri != "" From f1acbf52cef76037cfe3033bffe546c4ae6a559f Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 13:42:57 +0530 Subject: [PATCH 041/103] MASCORE-15507: Add ibm-redis-cp operator Subscription for CPD 5.3.1+ WML The WmlBase CR was failing with: 'Failed to find exact match for redis.ibm.com/v1.Rediscp' The WML operator Ansible playbook requires the IBM Redis CP operator (ibm-redis-cp) to be installed. For CPD < 5.3.1 this was handled via OLM, but the Helm-based path for CPD >= 5.3.1 had no Subscription for ibm-redis-cp, leaving the Rediscp CRD uninstalled. Changes: - Add ibm-redis-cp Subscription to 09-ibm-cp4d_services_base.yaml, gated on wml_channel being set and CPD version >= 5.3.1 - Add ibm_redis_cp_channel and ibm_redis_cp_install_plan to 110-ibm-cp4d/values.yaml - Pass ibm_redis_cp_channel and ibm_redis_cp_install_plan through 110-ibm-cp4d-app.yaml from ibm_cp4d_services_base config block - Regenerate RBAC rules --- .../templates/09-ibm-cp4d_services_base.yaml | 23 +++++++++++++++++++ .../110-ibm-cp4d/values.yaml | 2 ++ .../templates/per-namespace-rbac.yaml | 1 + .../base/application-admin-role.yaml | 1 + .../templates/110-ibm-cp4d-app.yaml | 2 ++ 5 files changed, 29 insertions(+) diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml index cb0ec381b..38b3cfc95 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml @@ -146,6 +146,29 @@ spec: backoffLimit: 4 + +{{- if and .Values.wml_channel (not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0)) }} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: ibm-redis-cp-operator + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "090" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + channel: "{{ .Values.ibm_redis_cp_channel }}" + installPlanApproval: {{ .Values.ibm_redis_cp_install_plan | default "Automatic" | quote }} + name: ibm-redis-cp + source: ibm-operator-catalog + sourceNamespace: openshift-marketplace +{{- end }} + + {{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} {{- if or .Values.wml_channel .Values.wsl_channel .Values.spss_channel }} --- diff --git a/instance-applications/110-ibm-cp4d/values.yaml b/instance-applications/110-ibm-cp4d/values.yaml index 631fbe216..8ac4c34d3 100644 --- a/instance-applications/110-ibm-cp4d/values.yaml +++ b/instance-applications/110-ibm-cp4d/values.yaml @@ -10,3 +10,5 @@ cpd_product_version: "" cpd_iam_integration: false cpd_primary_storage_class: "" cpd_metadata_storage_class: "" +ibm_redis_cp_channel: "" +ibm_redis_cp_install_plan: "" diff --git a/instance-applications/600-application-admin-rbac/templates/per-namespace-rbac.yaml b/instance-applications/600-application-admin-rbac/templates/per-namespace-rbac.yaml index 73e72ce7f..c2f8f96c4 100644 --- a/instance-applications/600-application-admin-rbac/templates/per-namespace-rbac.yaml +++ b/instance-applications/600-application-admin-rbac/templates/per-namespace-rbac.yaml @@ -122,6 +122,7 @@ rules: - apiGroups: - config.mas.ibm.com resources: + - aicfgs - appcfgs - bascfgs - idpcfgs diff --git a/rbac/kustomize/base/application-admin-role.yaml b/rbac/kustomize/base/application-admin-role.yaml index 4ca7260b7..110749def 100644 --- a/rbac/kustomize/base/application-admin-role.yaml +++ b/rbac/kustomize/base/application-admin-role.yaml @@ -95,6 +95,7 @@ rules: - apiGroups: - config.mas.ibm.com resources: + - aicfgs - appcfgs - bascfgs - idpcfgs diff --git a/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml b/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml index 490ccef2b..a7af31521 100644 --- a/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml @@ -94,6 +94,8 @@ spec: opencontent_opensearch_channel: "{{ .Values.ibm_cp4d_services_base.opencontent_opensearch_channel }}" elasticsearch_install_plan: "{{ .Values.ibm_cp4d_services_base.elasticsearch_install_plan }}" opensearch_install_plan: "{{ .Values.ibm_cp4d_services_base.opensearch_install_plan }}" + ibm_redis_cp_channel: "{{ .Values.ibm_cp4d_services_base.ibm_redis_cp_channel }}" + ibm_redis_cp_install_plan: "{{ .Values.ibm_cp4d_services_base.ibm_redis_cp_install_plan }}" {{- end }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} From 7e1636b708b7fd585547919b9c9844f7a52b392d Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 15:50:56 +0530 Subject: [PATCH 042/103] MASCORE-15507: Fix ibm-redis-cp install - use Helm not OLM Subscription The IBM Maximo catalog does not contain an ibm-redis-cp OLM package. The previous fix (OLM Subscription) was wrong for this environment. ibm-redis-cp for CPD 5.3.1 must be installed via Helm, the same way WML itself is installed. Changes: - Remove the ibm-redis-cp OLM Subscription added in previous commit (no such package exists in ibm-operator-catalog on this cluster) - Revert ibm_redis_cp_channel/install_plan values and root app changes - Add ibm-redis-cp Helm install steps to the existing install-wml-helm job in 02-ibm-wml-cr.yaml, running before WML itself so the Rediscp CRD is established before the WmlBase CR reconcile begins - Regenerate RBAC rules --- .../templates/09-ibm-cp4d_services_base.yaml | 22 ------------ .../110-ibm-cp4d/values.yaml | 2 -- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 34 +++++++++++++++++++ .../templates/110-ibm-cp4d-app.yaml | 2 -- 4 files changed, 34 insertions(+), 26 deletions(-) diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml index 38b3cfc95..ed8eb2cff 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml @@ -147,28 +147,6 @@ spec: -{{- if and .Values.wml_channel (not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0)) }} ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: ibm-redis-cp-operator - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "090" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - channel: "{{ .Values.ibm_redis_cp_channel }}" - installPlanApproval: {{ .Values.ibm_redis_cp_install_plan | default "Automatic" | quote }} - name: ibm-redis-cp - source: ibm-operator-catalog - sourceNamespace: openshift-marketplace -{{- end }} - - {{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} {{- if or .Values.wml_channel .Values.wsl_channel .Values.spss_channel }} --- diff --git a/instance-applications/110-ibm-cp4d/values.yaml b/instance-applications/110-ibm-cp4d/values.yaml index 8ac4c34d3..631fbe216 100644 --- a/instance-applications/110-ibm-cp4d/values.yaml +++ b/instance-applications/110-ibm-cp4d/values.yaml @@ -10,5 +10,3 @@ cpd_product_version: "" cpd_iam_integration: false cpd_primary_storage_class: "" cpd_metadata_storage_class: "" -ibm_redis_cp_channel: "" -ibm_redis_cp_install_plan: "" diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 969c75f1b..e7fb9a3f9 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -51,6 +51,40 @@ spec: helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm helm repo update + echo "Installing ibm-redis-cp cluster-scoped chart (CRDs + ClusterRoles)..." + helm template ibm-redis-cp-cluster ibm-charts/ibm-redis-cp-cluster-scoped \ + --version 1.6.11 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Installing ibm-redis-cp namespace-scoped chart (operator)..." + helm upgrade --install ibm-redis-cp ibm-charts/ibm-redis-cp \ + --version 1.6.11 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key + + echo "Waiting for redicps.redis.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "Rediscp CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd redicps.redis.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "Rediscp CRD established." + break + fi + sleep 10 + done + echo "Installing wml cluster-scoped chart (CRDs + ClusterRoles)..." helm template wml-cluster ibm-charts/wml-cluster-scoped \ --version 12.1.0 \ diff --git a/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml b/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml index a7af31521..490ccef2b 100644 --- a/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/110-ibm-cp4d-app.yaml @@ -94,8 +94,6 @@ spec: opencontent_opensearch_channel: "{{ .Values.ibm_cp4d_services_base.opencontent_opensearch_channel }}" elasticsearch_install_plan: "{{ .Values.ibm_cp4d_services_base.elasticsearch_install_plan }}" opensearch_install_plan: "{{ .Values.ibm_cp4d_services_base.opensearch_install_plan }}" - ibm_redis_cp_channel: "{{ .Values.ibm_cp4d_services_base.ibm_redis_cp_channel }}" - ibm_redis_cp_install_plan: "{{ .Values.ibm_cp4d_services_base.ibm_redis_cp_install_plan }}" {{- end }} {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} From 89f7365b248c7cd66f1f57d4b5ff733e521d955e Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 16:25:32 +0530 Subject: [PATCH 043/103] MASCORE-15507: Keep failed install-wml-helm pod for log inspection Temporarily remove HookFailed from delete policy so failed pods stay alive long enough to read their logs and diagnose the ibm-redis-cp Helm chart name issue. --- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index e7fb9a3f9..8581eedee 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -34,8 +34,7 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed + argocd.argoproj.io/hook-delete-policy: HookSucceeded spec: template: From cafe354e84cfd3b8a13f0764810703300523a599 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 17:03:02 +0530 Subject: [PATCH 044/103] MASCORE-15507: Fix ibm-redis-cp Helm chart version to 1.3.1 Version 1.6.11 does not exist in ibm-charts repo. Available versions are 1.3.1 and 1.4.0. Using 1.3.1 to match the sub_channel v1.3 defined in olm-utils-cm for CPD 5.3.1. --- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 8581eedee..1455b79b5 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -52,7 +52,7 @@ spec: echo "Installing ibm-redis-cp cluster-scoped chart (CRDs + ClusterRoles)..." helm template ibm-redis-cp-cluster ibm-charts/ibm-redis-cp-cluster-scoped \ - --version 1.6.11 \ + --version 1.3.1 \ --namespace {{ .Values.cpd_operators_namespace }} \ --set global.licenseAccept=true \ --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ @@ -61,7 +61,7 @@ spec: echo "Installing ibm-redis-cp namespace-scoped chart (operator)..." helm upgrade --install ibm-redis-cp ibm-charts/ibm-redis-cp \ - --version 1.6.11 \ + --version 1.3.1 \ --namespace {{ .Values.cpd_operators_namespace }} \ --set global.licenseAccept=true \ --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ From f45914d113966a02273ab275d20a3c63d99e8b8c Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 17:30:14 +0530 Subject: [PATCH 045/103] MASCORE-15507: Fix install-wml-helm Job - hash-based name and cleanup on failure --- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 1455b79b5..18ca565bc 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -26,22 +26,28 @@ spec: {{- else }} --- # Helm-based installation for CPD 5.3.1+ +{{- $_job_name_prefix := "install-wml-helm" }} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_job_config_values := omit .Values "junitreporter" }} +{{- $_job_version := "v1" }} +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} apiVersion: batch/v1 kind: Job metadata: - name: install-wml-helm + name: {{ $_job_name }} namespace: "{{ .Values.cpd_operators_namespace }}" annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed spec: template: spec: containers: - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} command: - /bin/sh - -c From 9f7b76c07ebb35feff751abc56808b43141b8ec7 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 17:45:53 +0530 Subject: [PATCH 046/103] MASCORE-15507: Fix typo redicps -> rediscps in CRD poll, bump job version to v2 --- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 18ca565bc..49cb50c0f 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -29,7 +29,7 @@ spec: {{- $_job_name_prefix := "install-wml-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v1" }} +{{- $_job_version := "v2" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} apiVersion: batch/v1 @@ -74,7 +74,7 @@ spec: --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ --set global.imagePullSecret=ibm-entitlement-key - echo "Waiting for redicps.redis.ibm.com CRD to be established..." + echo "Waiting for rediscps.redis.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -82,7 +82,7 @@ spec: echo "Rediscp CRD not established after 5 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd redicps.redis.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd rediscps.redis.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "Rediscp CRD established." break From 4a3203e80bf29b6ed19401198f144675e9f9bc17 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 19:01:13 +0530 Subject: [PATCH 047/103] MASCORE-15507: Add hashed job name and cleanup-group label to cognos-analytics helm install job --- .../templates/01-ibm-cognos-analytics-cr.yaml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index c54fb2565..df19bf161 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -27,23 +27,30 @@ spec: --- # Helm-based installation for CPD 5.3.1+ # Cognos Analytics is an optional analytics and reporting service +{{- $_job_name_prefix := "install-cognos-helm" }} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_job_config_values := omit .Values "junitreporter" }} +{{- $_job_version := "v1" }} +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} +{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} apiVersion: batch/v1 kind: Job metadata: - name: install-cognos-analytics-helm + name: {{ $_job_name }} namespace: "{{ .Values.cpd_operators_namespace }}" + labels: + mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed - spec: template: spec: containers: - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} command: - /bin/sh - -c From 4ec13b45da30a399df5ba2510d2b44f7b9b79956 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 19:40:05 +0530 Subject: [PATCH 048/103] MASCORE-15507: Fix CRD poll name for cognos-analytics, bump job version to v2 --- .../templates/01-ibm-cognos-analytics-cr.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index df19bf161..de5025325 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -30,7 +30,7 @@ spec: {{- $_job_name_prefix := "install-cognos-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v1" }} +{{- $_job_version := "v2" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -69,7 +69,7 @@ spec: --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - echo "Waiting for cognosanalytics.cognosanalytics.cpd.ibm.com CRD to be established..." + echo "Waiting for caservices.ca.cpd.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -77,7 +77,7 @@ spec: echo "CRD not established after 5 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd cognosanalytics.cognosanalytics.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd caservices.ca.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "CRD established." break From 7991777eb74bb3bf9830e180a27bb5b526ff9de2 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 21:26:06 +0530 Subject: [PATCH 049/103] MASCORE-15507: Revert unrelated SLS pod templates changes --- instance-applications/100-ibm-sls/README.md | 4 ---- .../100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml | 4 ---- 2 files changed, 8 deletions(-) diff --git a/instance-applications/100-ibm-sls/README.md b/instance-applications/100-ibm-sls/README.md index f0845de86..78ae3fbec 100644 --- a/instance-applications/100-ibm-sls/README.md +++ b/instance-applications/100-ibm-sls/README.md @@ -69,10 +69,6 @@ ibm_sls: - alias: string crt: string (multiline) - # Pod Templates (optional) - sls_pod_templates: - key: value - # Certificate Authority (optional) internal_certificate_authority: string ``` diff --git a/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml b/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml index 2277794be..b5b8b3aa8 100644 --- a/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml +++ b/instance-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml @@ -17,10 +17,6 @@ spec: {{ .Values.mongo_spec | toYaml | indent 4 }} license: accept: true -{{- if not (empty .Values.sls_pod_templates) }} - podTemplates: -{{ .Values.sls_pod_templates | toYaml | indent 4 }} -{{- end }} settings: auth: enforce: true From 3b8775300e30836232fc6486ea68d59f9ce387af Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 21:43:57 +0530 Subject: [PATCH 050/103] MASCORE-15507: Revert unrelated SLS pod templates changes; add SPSS Modeler chart with CPD 5.3.1 Helm support --- instance-applications/120-ibm-spss/Chart.yaml | 11 ++ .../templates/00-ibm-spss_Subscription.yaml | 19 ++++ .../templates/01-ibm-spss-cr.yaml | 104 ++++++++++++++++++ .../120-ibm-spss/values.yaml | 8 ++ .../templates/120-ibm-spss-app.yaml | 85 ++++++++++++++ .../templates/100-ibm-sls-app.yaml | 3 - .../templates/06-ibm-sls_LicenseService.yaml | 4 - 7 files changed, 227 insertions(+), 7 deletions(-) create mode 100644 instance-applications/120-ibm-spss/Chart.yaml create mode 100644 instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml create mode 100644 instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml create mode 100644 instance-applications/120-ibm-spss/values.yaml create mode 100644 root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml diff --git a/instance-applications/120-ibm-spss/Chart.yaml b/instance-applications/120-ibm-spss/Chart.yaml new file mode 100644 index 000000000..9f703e5fb --- /dev/null +++ b/instance-applications/120-ibm-spss/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: ibm-spss +description: SPSS Modeler +type: application +version: 1.0.0 + +dependencies: +- name: junitreporter + version: 1.0.0 + repository: "file://../../sub-charts/junitreporter/" + condition: junitreporter.devops_mongo_uri != "" diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml new file mode 100644 index 000000000..5d5fd60f8 --- /dev/null +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -0,0 +1,19 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: spss-modeler-subscription + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + channel: "{{ .Values.spss_channel }}" + name: spss-modeler + source: ibm-operator-catalog + sourceNamespace: openshift-marketplace +{{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml new file mode 100644 index 000000000..f27800f64 --- /dev/null +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -0,0 +1,104 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +--- +apiVersion: spssmodeler.cpd.ibm.com/v1 +kind: SPSSModeler +metadata: + name: "spssmodeler-cr" + namespace: "{{ .Values.cpd_instance_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + imagePullSecret: ibm-entitlement-key + ignoreForMaintenance: false + license: + accept: true + license: Standard + fileStorageClass: "{{ .Values.cpd_service_storage_class }}" + blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" + scaleConfig: "{{ .Values.cpd_service_scale_config }}" + version: "{{ .Values.spss_version }}" + ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} +--- +# Helm-based installation for CPD 5.3.1+ +{{- $_job_name_prefix := "install-spss-helm" }} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_job_config_values := omit .Values "junitreporter" }} +{{- $_job_version := "v1" }} +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} +{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ $_job_name }} + namespace: "{{ .Values.cpd_operators_namespace }}" + labels: + mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed +spec: + template: + spec: + containers: + - name: helm-install + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} + command: + - /bin/sh + - -c + - | + set -e + helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + helm repo update + + echo "Installing spss-modeler cluster-scoped chart (CRDs + ClusterRoles)..." + helm template spss-modeler-cluster ibm-charts/spss-modeler-cluster-scoped \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for spssmodelerbases.spssmodeler.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd spssmodelerbases.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "CRD established." + break + fi + sleep 10 + done + + echo "Installing spss-modeler namespace-scoped chart (operator + CR)..." + helm upgrade --install spss-modeler ibm-charts/spss-modeler \ + --version 12.1.0 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --set spssmodeler.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --wait --timeout 60m + restartPolicy: Never + serviceAccountName: cpd-sa + backoffLimit: 4 +{{- end }} diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml new file mode 100644 index 000000000..b7c0618d7 --- /dev/null +++ b/instance-applications/120-ibm-spss/values.yaml @@ -0,0 +1,8 @@ +--- +ccs_version: "" +cpd_service_block_storage_class: "" +cpd_service_scale_config: "" +cpd_service_storage_class: "" +spss_channel: "" +spss_version: "" +cpd_product_version: "" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml new file mode 100644 index 000000000..ed753aca9 --- /dev/null +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -0,0 +1,85 @@ +{{- if and (not (empty .Values.ibm_spss)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} +{{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +--- +# IBM SPSS Modeler Application +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spss.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "120" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + repoURL: "{{ .Values.source.repo_url }}" + path: instance-applications/120-ibm-spss + targetRevision: "{{ .Values.source.revision }}" + plugin: + name: {{ .Values.avp.name }} + env: + - name: {{ .Values.avp.values_varname }} + value: | + account_id: "{{ .Values.account.id }}" + region_id: "{{ .Values.region.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + cli_image_repo: {{ .Values.cli_image_repo }} + cluster_admin_role: {{ .Values.cluster_admin_role }} + application_admin_role: {{ .Values.application_admin_role }} + sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" + sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" + cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" + cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" + cpd_service_storage_class: "{{ .Values.ibm_spss.cpd_service_storage_class }}" + cpd_service_block_storage_class: "{{ .Values.ibm_spss.cpd_service_block_storage_class }}" + cpd_service_scale_config: "{{ .Values.ibm_spss.cpd_service_scale_config }}" + spss_version: "{{ .Values.ibm_spss.spss_version }}" + spss_channel: "{{ .Values.ibm_spss.spss_channel }}" + ccs_version: "{{ .Values.ibm_spss.ccs_version }}" + {{- if .Values.custom_labels }} + custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} + {{- end }} + junitreporter: + reporter_name: "ibm-spss-{{ .Values.instance.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" + devops_build_number: "{{ .Values.devops.build_number }}" + gitops_version: "{{ .Values.source.revision }}" + cli_image_repo: {{ .Values.cli_image_repo }} + - name: ARGOCD_APP_NAME + value: cpdspssapp + {{- if not (empty .Values.avp.secret) }} + - name: AVP_SECRET + value: {{ .Values.avp.secret }} + {{- end }} + syncPolicy: + automated: + {{- if .Values.auto_delete }} + prune: true + {{- end }} + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false +{{- end }} diff --git a/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml b/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml index d852e67c4..71c353c2b 100644 --- a/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml +++ b/root-applications/ibm-mas-sls-root/templates/100-ibm-sls-app.yaml @@ -78,9 +78,6 @@ spec: devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" devops_build_number: "{{ .Values.devops.build_number }}" gitops_version: "{{ .Values.source.revision }}" - {{- if .Values.ibm_sls_standalone.sls_pod_templates }} - sls_pod_templates: {{ .Values.ibm_sls_standalone.sls_pod_templates | toYaml | nindent 14 }} - {{- end }} {{- if .Values.ibm_sls_standalone.internal_certificate_authority }} internal_certificate_authority: "{{ .Values.ibm_sls_standalone.internal_certificate_authority }}" {{- end }} diff --git a/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml b/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml index 3914dc7d8..276cbc3f1 100644 --- a/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml +++ b/sls-applications/100-ibm-sls/templates/06-ibm-sls_LicenseService.yaml @@ -18,10 +18,6 @@ spec: {{ .Values.mongo_spec | toYaml | indent 4 }} license: accept: true -{{- if not (empty .Values.sls_pod_templates) }} - podTemplates: -{{ .Values.sls_pod_templates | toYaml | indent 4 }} -{{- end }} settings: auth: enforce: true From 14709be5fffca71e113af5c1cbd935b09b596466 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 21:50:24 +0530 Subject: [PATCH 051/103] MASCORE-15507: Revert unrelated SLS pod templates change from instance-root --- .../ibm-mas-instance-root/templates/100-ibm-sls-app.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml b/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml index e3ce37274..e1d364f59 100644 --- a/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/100-ibm-sls-app.yaml @@ -80,9 +80,6 @@ spec: devops_build_number: "{{ .Values.devops.build_number }}" gitops_version: "{{ .Values.source.revision }}" cli_image_repo: {{ .Values.cli_image_repo }} - {{- if .Values.ibm_sls.sls_pod_templates }} - sls_pod_templates: {{ .Values.ibm_sls.sls_pod_templates | toYaml | nindent 14 }} - {{- end }} {{- if .Values.ibm_sls.internal_certificate_authority }} internal_certificate_authority: "{{ .Values.ibm_sls.internal_certificate_authority }}" {{- end }} From 362022cd9cec5d073bd6332dd2563fc4f34e33e4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 22:01:46 +0530 Subject: [PATCH 052/103] MASCORE-15507: Fix SPSS Helm chart names (spss-cluster-scoped/spss v13.0.4), bump job to v2 --- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index f27800f64..5a4415ff9 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -29,7 +29,7 @@ spec: {{- $_job_name_prefix := "install-spss-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v1" }} +{{- $_job_version := "v2" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -58,9 +58,9 @@ spec: helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm helm repo update - echo "Installing spss-modeler cluster-scoped chart (CRDs + ClusterRoles)..." - helm template spss-modeler-cluster ibm-charts/spss-modeler-cluster-scoped \ - --version 12.1.0 \ + echo "Installing spss cluster-scoped chart (CRDs + ClusterRoles)..." + helm template spss-cluster ibm-charts/spss-cluster-scoped \ + --version 13.0.4 \ --namespace {{ .Values.cpd_operators_namespace }} \ --set global.licenseAccept=true \ --set global.releaseVersion={{ .Values.cpd_product_version }} \ @@ -84,9 +84,9 @@ spec: sleep 10 done - echo "Installing spss-modeler namespace-scoped chart (operator + CR)..." - helm upgrade --install spss-modeler ibm-charts/spss-modeler \ - --version 12.1.0 \ + echo "Installing spss namespace-scoped chart (operator + CR)..." + helm upgrade --install spss ibm-charts/spss \ + --version 13.0.4 \ --namespace {{ .Values.cpd_instance_namespace }} \ --create-namespace \ --set global.licenseAccept=true \ @@ -96,7 +96,7 @@ spec: --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ --set global.imagePullSecret=ibm-entitlement-key \ - --set spssmodeler.scaleConfig={{ .Values.cpd_service_scale_config }} \ + --set spss.scaleConfig={{ .Values.cpd_service_scale_config }} \ --wait --timeout 60m restartPolicy: Never serviceAccountName: cpd-sa From 46223fe061fd55701e17fab4310c5d575403a671 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 22:07:26 +0530 Subject: [PATCH 053/103] MASCORE-15507: Fix SPSS CRD poll name spss.spssmodeler.cpd.ibm.com, bump job to v3 --- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 5a4415ff9..982d54c4c 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -29,7 +29,7 @@ spec: {{- $_job_name_prefix := "install-spss-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v2" }} +{{- $_job_version := "v3" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -68,7 +68,7 @@ spec: --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - echo "Waiting for spssmodelerbases.spssmodeler.cpd.ibm.com CRD to be established..." + echo "Waiting for spss.spssmodeler.cpd.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -76,7 +76,7 @@ spec: echo "CRD not established after 5 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd spssmodelerbases.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd spss.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "CRD established." break From f8735f43075f9ba90cce1f11aafb347a8126baed Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 22:41:14 +0530 Subject: [PATCH 054/103] MASCORE-15507: Add canvasbase dependency before SPSS install, bump job to v4 --- .../templates/01-ibm-spss-cr.yaml | 42 ++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 982d54c4c..8521b9334 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -29,7 +29,7 @@ spec: {{- $_job_name_prefix := "install-spss-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v3" }} +{{- $_job_version := "v4" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -58,6 +58,46 @@ spec: helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm helm repo update + echo "Installing canvasbase cluster-scoped chart (CRDs + ClusterRoles)..." + helm template canvasbase-cluster ibm-charts/canvasbase-cluster-scoped \ + --version 13.0.4 \ + --namespace {{ .Values.cpd_operators_namespace }} \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - + + echo "Waiting for canvasbases.cpd.ibm.com CRD to be established..." + wait_period=0 + while true; do + wait_period=$((wait_period+10)) + if [ $wait_period -gt 300 ]; then + echo "Canvasbase CRD not established after 5 minutes. Exiting." + exit 1 + fi + STATUS=$(oc get crd canvasbases.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + if [ "$STATUS" = "True" ]; then + echo "Canvasbase CRD established." + break + fi + sleep 10 + done + + echo "Installing canvasbase namespace-scoped chart (operator + CR)..." + helm upgrade --install canvasbase ibm-charts/canvasbase \ + --version 13.0.4 \ + --namespace {{ .Values.cpd_instance_namespace }} \ + --create-namespace \ + --set global.licenseAccept=true \ + --set global.releaseVersion={{ .Values.cpd_product_version }} \ + --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ + --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ + --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ + --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ + --set global.imagePullSecret=ibm-entitlement-key \ + --wait --timeout 60m + echo "Installing spss cluster-scoped chart (CRDs + ClusterRoles)..." helm template spss-cluster ibm-charts/spss-cluster-scoped \ --version 13.0.4 \ From 313f4c689af0ff3640050ae182ef4a66d787d9a4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 10 Aug 2026 22:49:00 +0530 Subject: [PATCH 055/103] MASCORE-15507: Fix canvasbase CRD poll name, bump job to v5 --- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 8521b9334..48dd4ba25 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -29,7 +29,7 @@ spec: {{- $_job_name_prefix := "install-spss-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v4" }} +{{- $_job_version := "v5" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -68,7 +68,7 @@ spec: --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - echo "Waiting for canvasbases.cpd.ibm.com CRD to be established..." + echo "Waiting for canvasbase.canvasbase.cpd.ibm.com CRD to be established..." wait_period=0 while true; do wait_period=$((wait_period+10)) @@ -76,7 +76,7 @@ spec: echo "Canvasbase CRD not established after 5 minutes. Exiting." exit 1 fi - STATUS=$(oc get crd canvasbases.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) + STATUS=$(oc get crd canvasbase.canvasbase.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) if [ "$STATUS" = "True" ]; then echo "Canvasbase CRD established." break From 44d18ac1f863ad1339b2fe3d677251e7c26cbff7 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 11 Aug 2026 11:33:55 +0530 Subject: [PATCH 056/103] MASCORE-15507: Fix Helm chart versions to match CPD 5.3.1 release metadata (spss/canvasbase 12.1.0, cognos 29.1.0) --- .../templates/01-ibm-cognos-analytics-cr.yaml | 6 +++--- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 10 +++++----- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index de5025325..7752e28db 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -30,7 +30,7 @@ spec: {{- $_job_name_prefix := "install-cognos-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v2" }} +{{- $_job_version := "v3" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -61,7 +61,7 @@ spec: echo "Installing cognos-analytics cluster-scoped chart (CRDs + ClusterRoles)..." helm template cognos-analytics-cluster ibm-charts/cognos-analytics-cluster-scoped \ - --version 29.1.8 \ + --version 29.1.0 \ --namespace {{ .Values.cpd_operators_namespace }} \ --set global.licenseAccept=true \ --set global.releaseVersion={{ .Values.cpd_product_version }} \ @@ -87,7 +87,7 @@ spec: echo "Installing cognos-analytics namespace-scoped chart (operator + CR)..." helm upgrade --install cognos-analytics ibm-charts/cognos-analytics \ - --version 29.1.8 \ + --version 29.1.0 \ --namespace {{ .Values.cpd_instance_namespace }} \ --create-namespace \ --set global.licenseAccept=true \ diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 48dd4ba25..aaa464068 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -29,7 +29,7 @@ spec: {{- $_job_name_prefix := "install-spss-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} {{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v5" }} +{{- $_job_version := "v6" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} @@ -60,7 +60,7 @@ spec: echo "Installing canvasbase cluster-scoped chart (CRDs + ClusterRoles)..." helm template canvasbase-cluster ibm-charts/canvasbase-cluster-scoped \ - --version 13.0.4 \ + --version 12.1.0 \ --namespace {{ .Values.cpd_operators_namespace }} \ --set global.licenseAccept=true \ --set global.releaseVersion={{ .Values.cpd_product_version }} \ @@ -86,7 +86,7 @@ spec: echo "Installing canvasbase namespace-scoped chart (operator + CR)..." helm upgrade --install canvasbase ibm-charts/canvasbase \ - --version 13.0.4 \ + --version 12.1.0 \ --namespace {{ .Values.cpd_instance_namespace }} \ --create-namespace \ --set global.licenseAccept=true \ @@ -100,7 +100,7 @@ spec: echo "Installing spss cluster-scoped chart (CRDs + ClusterRoles)..." helm template spss-cluster ibm-charts/spss-cluster-scoped \ - --version 13.0.4 \ + --version 12.1.0 \ --namespace {{ .Values.cpd_operators_namespace }} \ --set global.licenseAccept=true \ --set global.releaseVersion={{ .Values.cpd_product_version }} \ @@ -126,7 +126,7 @@ spec: echo "Installing spss namespace-scoped chart (operator + CR)..." helm upgrade --install spss ibm-charts/spss \ - --version 13.0.4 \ + --version 12.1.0 \ --namespace {{ .Values.cpd_instance_namespace }} \ --create-namespace \ --set global.licenseAccept=true \ From 7123d28ab56ef819f5966682506a918233c04c84 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 11 Aug 2026 12:29:02 +0530 Subject: [PATCH 057/103] MASCORE-15507: Fix helm lint - add default 0.0.0 for cpd_product_version semver check in SPSS --- .../120-ibm-spss/templates/00-ibm-spss_Subscription.yaml | 2 +- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index 5d5fd60f8..2602216e4 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index aaa464068..9aaa9eba0 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: spssmodeler.cpd.ibm.com/v1 kind: SPSSModeler From 745622846b3f367ca38df9e4a0e5a8948315e7d2 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 11 Aug 2026 12:31:37 +0530 Subject: [PATCH 058/103] MASCORE-15507: Fix helm lint - add default 0.0.0 for all cpd_product_version semver checks --- .../110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml | 2 +- .../110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml | 2 +- .../templates/09-ibm-cp4d_services_dependencies.yaml | 2 +- .../templates/00-ibm-cognos-analytics_Subscription.yaml | 2 +- .../templates/01-ibm-cognos-analytics-cr.yaml | 2 +- .../120-ibm-spark/templates/00-ibm-spark_Subscription.yaml | 2 +- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 2 +- .../120-ibm-spark/templates/02-ibm-spark-control-plane.yaml | 2 +- .../120-ibm-wml/templates/01-ibm-wml_Subscription.yaml | 2 +- instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml | 2 +- .../120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml | 2 +- instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml index 2c8d3d747..4c9e7cff5 100644 --- a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml +++ b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml @@ -1527,7 +1527,7 @@ roleRef: kind: ClusterRole name: admin -{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0) }} +{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0) }} --- # For CPD 5.3.1+, cpd-sa needs cluster-level permissions to apply CRDs and # ClusterRoles from the Helm cluster-scoped charts during service installation. diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml index ed8eb2cff..bc0a3dc0a 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_base.yaml @@ -147,7 +147,7 @@ spec: -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} {{- if or .Values.wml_channel .Values.wsl_channel .Values.spss_channel }} --- apiVersion: operators.coreos.com/v1alpha1 diff --git a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml index 6a270dcee..5fb58cfe3 100644 --- a/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml +++ b/instance-applications/110-ibm-cp4d/templates/09-ibm-cp4d_services_dependencies.yaml @@ -1,4 +1,4 @@ -{{- if and (or .Values.wsl_channel .Values.spss_channel) (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0) }} +{{- if and (or .Values.wsl_channel .Values.spss_channel) (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0) }} # Custom Operand Registries # ----------------------------------------------------------------------------- --- diff --git a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml index 169108421..7c909d3ba 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index 7752e28db..64014240c 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: cognosanalytics.cpd.ibm.com/v1 kind: CognosAnalytics diff --git a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml index 392b67cf3..717d69362 100644 --- a/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml +++ b/instance-applications/120-ibm-spark/templates/00-ibm-spark_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index a27460904..c7d6cb80a 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: ae.cpd.ibm.com/v1 kind: AnalyticsEngine diff --git a/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml b/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml index e2c7b5f8a..49c5f0d33 100644 --- a/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml +++ b/instance-applications/120-ibm-spark/templates/02-ibm-spark-control-plane.yaml @@ -55,7 +55,7 @@ are required here. */}} {{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- kind: ServiceAccount apiVersion: v1 diff --git a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml index 01f75abbd..0bc0af93c 100644 --- a/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml +++ b/instance-applications/120-ibm-wml/templates/01-ibm-wml_Subscription.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 49cb50c0f..8fe2dea76 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -1,4 +1,4 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: wml.cpd.ibm.com/v1beta1 kind: WmlBase diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index 2f30520a5..f207bbaae 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -18,7 +18,7 @@ # installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 53331456c..8e8855f17 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -27,7 +27,7 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: ws.cpd.ibm.com/v1beta1 kind: WS From 229d27b5c5fb18d7219e67648b7ffb87911db70c Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 11 Aug 2026 12:34:48 +0530 Subject: [PATCH 059/103] MASCORE-15507: Fix README validation - add cognos-analytics-app to instance-root README, add Job to WML README --- instance-applications/120-ibm-wml/README.md | 5 +++-- root-applications/ibm-mas-instance-root/README.md | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-wml/README.md b/instance-applications/120-ibm-wml/README.md index ae239a251..cd572f96e 100644 --- a/instance-applications/120-ibm-wml/README.md +++ b/instance-applications/120-ibm-wml/README.md @@ -10,8 +10,9 @@ Deploys and configures the CP4D Service, Watson Machine Learning (WML) needed fo | Resource Type | Resource Name | Namespace | Condition | Installed By | |--------------|---------------|-----------|-----------|--------------| -| `Subscription` | WML operator subscription | CP4D instance namespace | Always | `application_admin_role` | -| `WmlBase` | Watson Machine Learning service CR | CP4D instance namespace | Always | `application_admin_role` | +| `Subscription` | WML operator subscription | CP4D operators namespace | CPD < 5.3.1 | `application_admin_role` | +| `WmlBase` | Watson Machine Learning service CR | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `Job` | Helm install job (ibm-redis-cp + wml) | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | ## Configuration diff --git a/root-applications/ibm-mas-instance-root/README.md b/root-applications/ibm-mas-instance-root/README.md index b65e28ac1..74e2893d6 100644 --- a/root-applications/ibm-mas-instance-root/README.md +++ b/root-applications/ibm-mas-instance-root/README.md @@ -205,6 +205,7 @@ The following table lists all ArgoCD applications defined in the templates folde | [`110-ibm-db2u-app.yaml`](templates/110-ibm-db2u-app.yaml) | db2u | ✓ | | | 110 | | [`120-db2-databases-app.yaml`](templates/120-db2-databases-app.yaml) | db2-db | | ✓ | | 120 | | [`120-dbs-rds-databases-app.yaml`](templates/120-dbs-rds-databases-app.yaml) | dbs-rds-db | | | ✓ | 120 | +| [`120-ibm-cognos-analytics-app.yaml`](templates/120-ibm-cognos-analytics-app.yaml) | cognos | ✓ | | | 120 | | [`120-ibm-spark-app.yaml`](templates/120-ibm-spark-app.yaml) | spark | ✓ | | | 120 | | [`120-ibm-spss-app.yaml`](templates/120-ibm-spss-app.yaml) | spss | ✓ | | | 120 | | [`120-ibm-wml-app.yaml`](templates/120-ibm-wml-app.yaml) | wml | ✓ | | | 120 | From b4bd4cdbf60a0bf3a26d3461f7710773ec0565f4 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 11 Aug 2026 12:37:02 +0530 Subject: [PATCH 060/103] MASCORE-15507: Fix verify-job-definitions - add hashed job name pattern and $_cli_image_digest to WSL and Spark Helm install jobs --- .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 15 +++++++++++---- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 15 +++++++++++---- 2 files changed, 22 insertions(+), 8 deletions(-) diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index c7d6cb80a..ca46aec4f 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -26,23 +26,30 @@ spec: {{- else }} --- # Helm-based installation for CPD 5.3.1+ +{{- $_job_name_prefix := "install-spark-helm" }} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_job_config_values := omit .Values "junitreporter" }} +{{- $_job_version := "v1" }} +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} +{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} apiVersion: batch/v1 kind: Job metadata: - name: install-spark-helm + name: {{ $_job_name }} namespace: "{{ .Values.cpd_operators_namespace }}" + labels: + mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} annotations: argocd.argoproj.io/sync-wave: "092" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed - spec: template: spec: containers: - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} command: - /bin/sh - -c diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 8e8855f17..a887d12b2 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -60,23 +60,30 @@ spec: # Installs WSL and all its dependencies (opensearch, ccs, datarefinery, ws-runtimes) # using IBM Helm charts. Each component requires a cluster-scoped chart (CRDs/ClusterRoles) # followed by a namespace-scoped chart (Operator + CR). +{{- $_job_name_prefix := "install-wsl-helm" }} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_job_config_values := omit .Values "junitreporter" }} +{{- $_job_version := "v1" }} +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} +{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} apiVersion: batch/v1 kind: Job metadata: - name: install-wsl-helm + name: {{ $_job_name }} namespace: "{{ .Values.cpd_operators_namespace }}" + labels: + mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} annotations: argocd.argoproj.io/sync-wave: "091" argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed - spec: template: spec: containers: - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9 + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} command: - /bin/sh - -c From 43a7bf7be9411e8c3bc32856a5ff859f89e40c0a Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Wed, 12 Aug 2026 11:50:24 +0530 Subject: [PATCH 061/103] Update 07-postsync-setup-db2_Job.yaml --- .../templates/07-postsync-setup-db2_Job.yaml | 52 ++++++++++++++++++- 1 file changed, 51 insertions(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml index 05476c2cb..4b1286f36 100644 --- a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml @@ -35,7 +35,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v22" }} +{{- $_job_version := "v23" }} {{- /* 10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest This is to ensure ArgoCD will create a new job resource intead of attempting (and failing) to update an @@ -579,6 +579,56 @@ spec: oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "cd ${DB2_INSTANCE_HOME_PATH}/bin; ${CREATE_ROLES_SH_PATH} | tee /tmp/createroles.log" db2inst1 || exit $? fi + # Path to the audit policy setup script, on both this pod and on the db2u pod + AUDITPOLICY_SH_PATH="/tmp/auditpolicy.sh" + + echo "" + echo "================================================================================" + echo "Setting up DB2 audit policy for Manage" + echo "================================================================================" + + echo "" + echo "Create ${AUDITPOLICY_SH_PATH}" + echo "--------------------------------------------------------------------------------" + + # Generate the audit policy script to copy and run on the db2u pod + cat > ${AUDITPOLICY_SH_PATH} << EOF + #!/bin/bash + set -e + + echo "Creating audit policy USER_AUDIT (instance-level)" + db2 "CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATION STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL" || true + + echo "Connecting to database ${DB2_DBNAME}" + db2 connect to ${DB2_DBNAME} + if [ \$? != 0 ]; then + echo "Failed to connect to database!" + exit 1 + fi + + echo "Applying audit policy to MAXIMO_READ and MAXIMO_WRITE roles" + db2 "AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT" + + echo "Applying audit policy to db2inst1 user" + db2 "AUDIT USER db2inst1 USING POLICY USER_AUDIT" + + db2 connect reset + echo "Audit policy setup complete" + EOF + # IMPORTANT: Do not make any changes to the "EOF" line above (including its indentation) + + chmod +x ${AUDITPOLICY_SH_PATH} + + echo "" + echo "Copy ${AUDITPOLICY_SH_PATH} to ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0" + echo "--------------------------------------------------------------------------------" + oc cp ${AUDITPOLICY_SH_PATH} ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0:${AUDITPOLICY_SH_PATH} -c db2u || exit $? + + echo "" + echo "Executing ${AUDITPOLICY_SH_PATH} file on ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0" + echo "--------------------------------------------------------------------------------" + oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "${AUDITPOLICY_SH_PATH} | tee /tmp/auditpolicy.log" db2inst1 || exit $? + fi # [[ "$MAS_APP_ID" == "manage" ]] From c702932d0d6840a585a457ec34634a5715558ab0 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 15:37:34 +0530 Subject: [PATCH 062/103] MASCORE-15507: Remove Cognos Analytics OLM Subscription Cognos Analytics is only available on CPD >= 5.3.1 and is installed via Helm only. There is no OLM path for Cognos - it was never available on CPD < 5.3.1. The Subscription file was incorrect. --- .../00-ibm-cognos-analytics_Subscription.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml diff --git a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml deleted file mode 100644 index 7c909d3ba..000000000 --- a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml +++ /dev/null @@ -1,19 +0,0 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: cognos-analytics-subscription - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - channel: "{{ .Values.cognos_analytics_channel }}" - name: cognos-analytics-operator - source: ibm-operator-catalog - sourceNamespace: openshift-marketplace -{{- end }} From 759bdd94a2d9d8633782ce8e239a8aaa181b963c Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 15:41:48 +0530 Subject: [PATCH 063/103] MASCORE-15507: Remove OLM version gate from Cognos Analytics CR Cognos Analytics is only available on CPD >= 5.3.1 via Helm. There is no OLM/CR path for older versions. Removed the incorrect version gate and the CognosAnalytics CR block that was gating on CPD < 5.3.1. --- .../templates/01-ibm-cognos-analytics-cr.yaml | 27 ------------------- 1 file changed, 27 deletions(-) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index 64014240c..04fa2ce8d 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,29 +1,3 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} ---- -apiVersion: cognosanalytics.cpd.ibm.com/v1 -kind: CognosAnalytics -metadata: - name: "cognos-analytics-sample" - namespace: "{{ .Values.cpd_instance_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - imagePullSecret: ibm-entitlement-key - ignoreForMaintenance: false - license: - accept: true - license: Standard - fileStorageClass: "{{ .Values.cpd_service_storage_class }}" - blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" - scaleConfig: "{{ .Values.cpd_service_scale_config }}" - version: "{{ .Values.cognos_analytics_version }}" - ccs_operand_version: "{{ .Values.ccs_version }}" -{{- else }} --- # Helm-based installation for CPD 5.3.1+ # Cognos Analytics is an optional analytics and reporting service @@ -102,4 +76,3 @@ spec: restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 4 -{{- end }} From 8a162bc0b2623696b5a135c36d05d69859a2720e Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 15:46:35 +0530 Subject: [PATCH 064/103] Revert "MASCORE-15507: Remove OLM version gate from Cognos Analytics CR" This reverts commit 759bdd94a2d9d8633782ce8e239a8aaa181b963c. --- .../templates/01-ibm-cognos-analytics-cr.yaml | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index 04fa2ce8d..64014240c 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,3 +1,29 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} +--- +apiVersion: cognosanalytics.cpd.ibm.com/v1 +kind: CognosAnalytics +metadata: + name: "cognos-analytics-sample" + namespace: "{{ .Values.cpd_instance_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + imagePullSecret: ibm-entitlement-key + ignoreForMaintenance: false + license: + accept: true + license: Standard + fileStorageClass: "{{ .Values.cpd_service_storage_class }}" + blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" + scaleConfig: "{{ .Values.cpd_service_scale_config }}" + version: "{{ .Values.cognos_analytics_version }}" + ccs_operand_version: "{{ .Values.ccs_version }}" +{{- else }} --- # Helm-based installation for CPD 5.3.1+ # Cognos Analytics is an optional analytics and reporting service @@ -76,3 +102,4 @@ spec: restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 4 +{{- end }} From e9d0039efd5bf607400ac5f9784e9d96936822eb Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 15:46:35 +0530 Subject: [PATCH 065/103] Revert "MASCORE-15507: Remove Cognos Analytics OLM Subscription" This reverts commit c702932d0d6840a585a457ec34634a5715558ab0. --- .../00-ibm-cognos-analytics_Subscription.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml diff --git a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml new file mode 100644 index 000000000..7c909d3ba --- /dev/null +++ b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml @@ -0,0 +1,19 @@ +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: cognos-analytics-subscription + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + channel: "{{ .Values.cognos_analytics_channel }}" + name: cognos-analytics-operator + source: ibm-operator-catalog + sourceNamespace: openshift-marketplace +{{- end }} From 138ad046f1ca88b562f0f318128a54701186fe61 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 16:01:21 +0530 Subject: [PATCH 066/103] MASCORE-15507: Cognos Analytics - remove OLM path, 5.3.1+ Helm only MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cognos Analytics was never deployed via this GitOps repo before this story. It was newly added as part of MASCORE-15507 for CPD 5.3.1+ only via Helm. No OLM path is needed. - Remove 00-ibm-cognos-analytics_Subscription.yaml entirely - Remove version gate and CognosAnalytics CR block from 01-ibm-cognos-analytics-cr.yaml — Helm install job always applies --- .../00-ibm-cognos-analytics_Subscription.yaml | 19 ------------- .../templates/01-ibm-cognos-analytics-cr.yaml | 27 ------------------- 2 files changed, 46 deletions(-) delete mode 100644 instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml diff --git a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml b/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml deleted file mode 100644 index 7c909d3ba..000000000 --- a/instance-applications/120-ibm-cognos-analytics/templates/00-ibm-cognos-analytics_Subscription.yaml +++ /dev/null @@ -1,19 +0,0 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: cognos-analytics-subscription - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - channel: "{{ .Values.cognos_analytics_channel }}" - name: cognos-analytics-operator - source: ibm-operator-catalog - sourceNamespace: openshift-marketplace -{{- end }} diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index 64014240c..04fa2ce8d 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,29 +1,3 @@ -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} ---- -apiVersion: cognosanalytics.cpd.ibm.com/v1 -kind: CognosAnalytics -metadata: - name: "cognos-analytics-sample" - namespace: "{{ .Values.cpd_instance_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -spec: - imagePullSecret: ibm-entitlement-key - ignoreForMaintenance: false - license: - accept: true - license: Standard - fileStorageClass: "{{ .Values.cpd_service_storage_class }}" - blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" - scaleConfig: "{{ .Values.cpd_service_scale_config }}" - version: "{{ .Values.cognos_analytics_version }}" - ccs_operand_version: "{{ .Values.ccs_version }}" -{{- else }} --- # Helm-based installation for CPD 5.3.1+ # Cognos Analytics is an optional analytics and reporting service @@ -102,4 +76,3 @@ spec: restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 4 -{{- end }} From a995fb44020cbb8a28c94b2b8b7c6c2fa2a40bc6 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 16:34:18 +0530 Subject: [PATCH 067/103] =?UTF-8?q?fix:=20correct=20imagePullSecret=20name?= =?UTF-8?q?=20in=20Ibmcpd=20CR=20(underscore=20=E2=86=92=20dash)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Ibmcpd CR spec.imagePullSecret was set to 'ibm_entitlement_key' (underscores) instead of the actual Kubernetes Secret name 'ibm-entitlement-key' (dashes). This caused the CP4D operator's Ansible playbook to fail to pull Common Services images, resulting in: 'Fail to wait for commonservice CR to reach Succeeded status' Fixes MASCORE-15507 --- .../110-ibm-cp4d/templates/07-ibm-cp4d_Ibmcpd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/110-ibm-cp4d/templates/07-ibm-cp4d_Ibmcpd.yaml b/instance-applications/110-ibm-cp4d/templates/07-ibm-cp4d_Ibmcpd.yaml index 2fc6e57ed..a00db1949 100644 --- a/instance-applications/110-ibm-cp4d/templates/07-ibm-cp4d_Ibmcpd.yaml +++ b/instance-applications/110-ibm-cp4d/templates/07-ibm-cp4d_Ibmcpd.yaml @@ -12,7 +12,7 @@ metadata: {{ .Values.custom_labels | toYaml | indent 4 }} {{- end }} spec: - imagePullSecret: ibm_entitlement_key + imagePullSecret: ibm-entitlement-key version: "{{ .Values.cpd_product_version }}" license: accept: true From 74238ce6ce69d77b913ca65cfb1649798d0ce394 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 17:06:16 +0530 Subject: [PATCH 068/103] fix: add persistent ConfigMap to CPD 5.3.1 Helm charts to stop ArgoCD OutOfSync loop When only an ArgoCD Hook Job exists in a chart (no non-hook resources), ArgoCD enters an OutOfSync/Progressing loop after the job deletes itself (HookSucceeded,HookFailed delete policy). The app shows OutOfSync because ArgoCD sees zero managed resources. Add a stable ConfigMap (sync-wave 091, before the hook job at 092) to WML, Spark, SPSS, Cognos Analytics and WSL 5.3.1 Helm branches so ArgoCD always has a persistent resource to track. Fixes: wml.noble8.inst02, spark.noble8.inst02, spss.noble8.inst02 cognos.noble8.inst02, wsl.noble8.inst02 OutOfSync/Progressing --- .../templates/01-ibm-cognos-analytics-cr.yaml | 13 +++++++++++++ .../120-ibm-spark/templates/01-ibm-spark-cr.yaml | 13 +++++++++++++ .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 13 +++++++++++++ .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 13 +++++++++++++ .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 13 +++++++++++++ 5 files changed, 65 insertions(+) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index 04fa2ce8d..6b826bd1e 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,4 +1,17 @@ --- +# Persistent resource so ArgoCD has a stable non-hook object to track. +# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. +apiVersion: v1 +kind: ConfigMap +metadata: + name: ibm-cognos-helm-install-config + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" +data: + cpd_product_version: "{{ .Values.cpd_product_version }}" + install_method: "helm" +--- # Helm-based installation for CPD 5.3.1+ # Cognos Analytics is an optional analytics and reporting service {{- $_job_name_prefix := "install-cognos-helm" }} diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index ca46aec4f..b7a6a913b 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -25,6 +25,19 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" {{- else }} --- +# Persistent resource so ArgoCD has a stable non-hook object to track. +# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. +apiVersion: v1 +kind: ConfigMap +metadata: + name: ibm-spark-helm-install-config + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" +data: + cpd_product_version: "{{ .Values.cpd_product_version }}" + install_method: "helm" +--- # Helm-based installation for CPD 5.3.1+ {{- $_job_name_prefix := "install-spark-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index 9aaa9eba0..e75bf0777 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -25,6 +25,19 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" {{- else }} --- +# Persistent resource so ArgoCD has a stable non-hook object to track. +# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. +apiVersion: v1 +kind: ConfigMap +metadata: + name: ibm-spss-helm-install-config + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" +data: + cpd_product_version: "{{ .Values.cpd_product_version }}" + install_method: "helm" +--- # Helm-based installation for CPD 5.3.1+ {{- $_job_name_prefix := "install-spss-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 8fe2dea76..5a9acdfa7 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -25,6 +25,19 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" {{- else }} --- +# Persistent resource so ArgoCD has a stable non-hook object to track. +# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. +apiVersion: v1 +kind: ConfigMap +metadata: + name: ibm-wml-helm-install-config + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" +data: + cpd_product_version: "{{ .Values.cpd_product_version }}" + install_method: "helm" +--- # Helm-based installation for CPD 5.3.1+ {{- $_job_name_prefix := "install-wml-helm" }} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index a887d12b2..9161ffffb 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -56,6 +56,19 @@ spec: wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" {{- else }} --- +# Persistent resource so ArgoCD has a stable non-hook object to track. +# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. +apiVersion: v1 +kind: ConfigMap +metadata: + name: ibm-wsl-helm-install-config + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" +data: + cpd_product_version: "{{ .Values.cpd_product_version }}" + install_method: "helm" +--- # Helm-based installation for CPD 5.3.1+ # Installs WSL and all its dependencies (opensearch, ccs, datarefinery, ws-runtimes) # using IBM Helm charts. Each component requires a cluster-scoped chart (CRDs/ClusterRoles) From a2ddc425ebfcab4b87fe270f3646ee72ba4100a6 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 14 Aug 2026 17:11:47 +0530 Subject: [PATCH 069/103] fix: add ConfigMap to README Resources Created tables for Spark, WML, WSL CI verify_chart_readme_tables.py requires every resource kind in a chart to be documented in the README. The persistent ConfigMap added to the CPD 5.3.1 Helm branches was not yet listed. Fixes CI lint failure: 'resource kind not documented in README table: ConfigMap' --- instance-applications/120-ibm-spark/README.md | 7 ++++--- instance-applications/120-ibm-wml/README.md | 1 + instance-applications/120-ibm-wsl/README.md | 15 ++++++++------- 3 files changed, 13 insertions(+), 10 deletions(-) diff --git a/instance-applications/120-ibm-spark/README.md b/instance-applications/120-ibm-spark/README.md index 9798b6a59..2a3fab040 100644 --- a/instance-applications/120-ibm-spark/README.md +++ b/instance-applications/120-ibm-spark/README.md @@ -10,12 +10,13 @@ Spark extends jupyter notebooks features inside Watson Studio notebooks which ca | Resource Type | Resource Name | Namespace | Condition | Installed By | |--------------|---------------|-----------|-----------|--------------| -| `Subscription` | Spark operator subscription | CP4D instance namespace | Always | `application_admin_role` | -| `AnalyticsEngine` | Spark service CR | CP4D instance namespace | Always | `application_admin_role` | +| `Subscription` | Spark operator subscription | CP4D operators namespace | CPD < 5.3.1 | `application_admin_role` | +| `AnalyticsEngine` | Spark service CR | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | | `ServiceAccount` | Spark control-plane service account | CP4D instance namespace | When control-plane job is enabled | `application_admin_role` | | `ClusterRole` | Spark control-plane cluster roles | N/A (cluster-scoped) | When control-plane job is enabled | `application_admin_role` | | `ClusterRoleBinding` | Spark control-plane cluster role binding | N/A (cluster-scoped) | When control-plane job is enabled | `application_admin_role` | -| `Job` | Spark control-plane job | CP4D instance namespace | When control-plane job is enabled | `application_admin_role` | +| `ConfigMap` | Helm install state tracking | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | +| `Job` | Spark Helm install job | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | ## Configuration diff --git a/instance-applications/120-ibm-wml/README.md b/instance-applications/120-ibm-wml/README.md index cd572f96e..d309bc536 100644 --- a/instance-applications/120-ibm-wml/README.md +++ b/instance-applications/120-ibm-wml/README.md @@ -12,6 +12,7 @@ Deploys and configures the CP4D Service, Watson Machine Learning (WML) needed fo |--------------|---------------|-----------|-----------|--------------| | `Subscription` | WML operator subscription | CP4D operators namespace | CPD < 5.3.1 | `application_admin_role` | | `WmlBase` | Watson Machine Learning service CR | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `ConfigMap` | Helm install state tracking | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | | `Job` | Helm install job (ibm-redis-cp + wml) | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | ## Configuration diff --git a/instance-applications/120-ibm-wsl/README.md b/instance-applications/120-ibm-wsl/README.md index 953c16262..b5a0e9eb7 100644 --- a/instance-applications/120-ibm-wsl/README.md +++ b/instance-applications/120-ibm-wsl/README.md @@ -9,13 +9,14 @@ Deploys and configures the CP4D Service, Watson Studio Local (WSL) needed for `M | Resource Type | Resource Name | Namespace | Condition | Installed By | |--------------|---------------|-----------|-----------|--------------| -| `Subscription` | WSL operator subscription | CP4D instance namespace | Always | `application_admin_role` | -| `WS` | Watson Studio Local service CR | CP4D instance namespace | Always | `application_admin_role` | -| `ServiceAccount` | WSL post-verify service account | CP4D instance namespace | Always | `application_admin_role` | -| `Role` | WSL post-verify roles | CP4D instance namespace | Always | `application_admin_role` | -| `RoleBinding` | WSL post-verify role binding | CP4D instance namespace | Always | `application_admin_role` | -| `Secret` | WSL post-verify runtime secret | CP4D instance namespace | Always | `application_admin_role` | -| `Job` | WSL post-verify job | CP4D instance namespace | Always | `application_admin_role` | +| `Subscription` | WSL operator subscription | CP4D operators namespace | CPD < 5.3.1 | `application_admin_role` | +| `WS` | Watson Studio Local service CR | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `ServiceAccount` | WSL post-verify service account | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `Role` | WSL post-verify roles | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `RoleBinding` | WSL post-verify role binding | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `Secret` | WSL post-verify runtime secret | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `ConfigMap` | Helm install state tracking | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | +| `Job` | WSL Helm install job | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | ## Configuration From 9034589afc14ebe2b14efe8be3eb458057d8e51b Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 18 Aug 2026 13:29:34 +0530 Subject: [PATCH 070/103] fix: skip Cognos Analytics Application for CPD < 5.3.1 (Helm path only) --- .../templates/120-ibm-cognos-analytics-app.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index 2143a7188..6ceaf52db 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -1,4 +1,4 @@ -{{- if and (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} +{{- if and (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) (not (lt (semver "5.3.1" | (semver (.Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString)).Compare) 0)) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} --- # IBM Cognos Analytics Application From 37a359ffe3b35c31e64321dcc0f94e80d779f79e Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Wed, 19 Aug 2026 13:04:56 +0530 Subject: [PATCH 071/103] audit policy added for manage --- .../templates/07-postsync-setup-db2_Job.yaml | 51 ---- .../08-postsync-db2-audit-policy_Job.yaml | 226 ++++++++++++++++++ 2 files changed, 226 insertions(+), 51 deletions(-) create mode 100644 instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml diff --git a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml index 4b1286f36..0ac137de4 100644 --- a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml @@ -579,57 +579,6 @@ spec: oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "cd ${DB2_INSTANCE_HOME_PATH}/bin; ${CREATE_ROLES_SH_PATH} | tee /tmp/createroles.log" db2inst1 || exit $? fi - # Path to the audit policy setup script, on both this pod and on the db2u pod - AUDITPOLICY_SH_PATH="/tmp/auditpolicy.sh" - - echo "" - echo "================================================================================" - echo "Setting up DB2 audit policy for Manage" - echo "================================================================================" - - echo "" - echo "Create ${AUDITPOLICY_SH_PATH}" - echo "--------------------------------------------------------------------------------" - - # Generate the audit policy script to copy and run on the db2u pod - cat > ${AUDITPOLICY_SH_PATH} << EOF - #!/bin/bash - set -e - - echo "Creating audit policy USER_AUDIT (instance-level)" - db2 "CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATION STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL" || true - - echo "Connecting to database ${DB2_DBNAME}" - db2 connect to ${DB2_DBNAME} - if [ \$? != 0 ]; then - echo "Failed to connect to database!" - exit 1 - fi - - echo "Applying audit policy to MAXIMO_READ and MAXIMO_WRITE roles" - db2 "AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT" - - echo "Applying audit policy to db2inst1 user" - db2 "AUDIT USER db2inst1 USING POLICY USER_AUDIT" - - db2 connect reset - echo "Audit policy setup complete" - EOF - # IMPORTANT: Do not make any changes to the "EOF" line above (including its indentation) - - chmod +x ${AUDITPOLICY_SH_PATH} - - echo "" - echo "Copy ${AUDITPOLICY_SH_PATH} to ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0" - echo "--------------------------------------------------------------------------------" - oc cp ${AUDITPOLICY_SH_PATH} ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0:${AUDITPOLICY_SH_PATH} -c db2u || exit $? - - echo "" - echo "Executing ${AUDITPOLICY_SH_PATH} file on ${DB2_NAMESPACE}/c-${DB2_INSTANCE_NAME}-db2u-0" - echo "--------------------------------------------------------------------------------" - oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "${AUDITPOLICY_SH_PATH} | tee /tmp/auditpolicy.log" db2inst1 || exit $? - - fi # [[ "$MAS_APP_ID" == "manage" ]] if [[ "$MAS_APP_ID" == "facilities" ]]; then diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml new file mode 100644 index 000000000..d1c2183c3 --- /dev/null +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -0,0 +1,226 @@ +{{- if .Values.application_admin_role }} +{{- /* +Audit policy setup job for DB2. +Runs per-application audit policy commands on the db2u pod after the main +postsync setup job (sync-wave 129) has completed. + +Currently supported: manage +*/}} +{{- if .Values.should_execute }} + +{{- if not (contains "sdb" .Values.db2_instance_name) }} + +{{- $_job_name_prefix := "postsync-db2-audit-policy" }} + +{{- /* +Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. +*/}} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} + +{{- $_job_config_values := omit .Values "junitreporter" }} + +{{- /* +Increment this value whenever you make a change to an immutable field of the Job resource. +*/}} +{{- $_job_version := "v1" }} + +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} + +{{- $_job_cleanup_group := cat $_job_name_prefix .Values.db2_instance_name | sha1sum }} + +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ $_job_name }} + namespace: "{{ .Values.db2_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "130" + labels: + mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + template: +{{- if .Values.custom_labels }} + metadata: + labels: +{{ .Values.custom_labels | toYaml | indent 8 }} +{{- end }} + spec: + containers: + - name: run + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} + imagePullPolicy: IfNotPresent + + resources: + limits: + cpu: 200m + memory: 512Mi + requests: + cpu: 10m + memory: 64Mi + + env: + - name: MAS_APP_ID + value: {{ .Values.mas_application_id }} + - name: DB2_NAMESPACE + value: "{{ .Values.db2_namespace }}" + - name: DB2_INSTANCE_NAME + value: "{{ .Values.db2_instance_name }}" + - name: DB2_DBNAME + value: "{{ .Values.db2_dbname }}" + + command: + - /bin/sh + - -c + - | + + set -e + + DB2_POD="c-${DB2_INSTANCE_NAME}-db2u-0" + + # ============================================================ + # Audit policy: manage + # ============================================================ + if [ "$MAS_APP_ID" = "manage" ]; then + + echo "" + echo "================================================================================" + echo "Setting up DB2 audit policy for Manage" + echo "================================================================================" + + # ---------------------------------------------------------------- + # Connect to database + # ---------------------------------------------------------------- + echo "" + echo "Connecting to database ${DB2_DBNAME}" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc "db2 connect to ${DB2_DBNAME}" db2inst1 + + # ---------------------------------------------------------------- + # Create audit policy + # ---------------------------------------------------------------- + echo "" + echo "Creating audit policy USER_AUDIT" + echo "--------------------------------------------------------------------------------" + + if oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL"' db2inst1 + then + echo "Audit policy USER_AUDIT created successfully." + else + echo "Audit policy USER_AUDIT may already exist. Continuing." + fi + + # ---------------------------------------------------------------- + # Create MAXIMO_READ role + # ---------------------------------------------------------------- + echo "" + echo "Creating MAXIMO_READ role" + echo "--------------------------------------------------------------------------------" + + if oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "CREATE ROLE MAXIMO_READ"' db2inst1 + then + echo "Role MAXIMO_READ created successfully." + else + echo "Role MAXIMO_READ may already exist. Continuing." + fi + + # ---------------------------------------------------------------- + # Create MAXIMO_WRITE role + # ---------------------------------------------------------------- + echo "" + echo "Creating MAXIMO_WRITE role" + echo "--------------------------------------------------------------------------------" + + if oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "CREATE ROLE MAXIMO_WRITE"' db2inst1 + then + echo "Role MAXIMO_WRITE created successfully." + else + echo "Role MAXIMO_WRITE may already exist. Continuing." + fi + + # ---------------------------------------------------------------- + # Assign audit policy to MAXIMO_READ + # ---------------------------------------------------------------- + echo "" + echo "Applying USER_AUDIT to MAXIMO_READ" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT"' db2inst1 + + # ---------------------------------------------------------------- + # Assign audit policy to MAXIMO_WRITE + # ---------------------------------------------------------------- + echo "" + echo "Applying USER_AUDIT to MAXIMO_WRITE" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT"' db2inst1 + + # ---------------------------------------------------------------- + # Assign audit policy to db2inst1 + # ---------------------------------------------------------------- + echo "" + echo "Applying USER_AUDIT to db2inst1" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "AUDIT USER db2inst1 USING POLICY USER_AUDIT"' db2inst1 + + # ---------------------------------------------------------------- + # Verify audit policy assignments + # ---------------------------------------------------------------- + echo "" + echo "================================================================================" + echo "Verifying audit policy setup" + echo "================================================================================" + + echo "" + echo "Audit policy assignments:" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "SELECT AUDITPOLICYNAME, OBJECTTYPE, OBJECTNAME FROM SYSCAT.AUDITUSE WHERE AUDITPOLICYNAME='\''USER_AUDIT'\''"' db2inst1 + + echo "" + echo "Audit policy configuration:" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc 'db2 "SELECT AUDITPOLICYNAME, VALIDATESTATUS, EXECUTESTATUS, EXECUTEWITHDATA, ERRORTYPE FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='\''USER_AUDIT'\''"' db2inst1 + + # ---------------------------------------------------------------- + # Disconnect + # ---------------------------------------------------------------- + echo "" + echo "Disconnecting from database" + echo "--------------------------------------------------------------------------------" + + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ + su -lc "db2 connect reset" db2inst1 + + echo "" + echo "================================================================================" + echo "DB2 audit policy setup completed successfully for Manage" + echo "================================================================================" + + fi + + restartPolicy: Never + serviceAccountName: "postsync-sa-{{ .Values.db2_instance_name }}" + + backoffLimit: 4 + +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file From 67c58e7604546b0201f790045e7cf8f6d8052634 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Wed, 19 Aug 2026 14:26:13 +0530 Subject: [PATCH 072/103] update --- .../08-postsync-db2-audit-policy_Job.yaml | 135 ++++-------------- 1 file changed, 28 insertions(+), 107 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index d1c2183c3..53fb1e6d5 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -92,122 +92,43 @@ spec: echo "Setting up DB2 audit policy for Manage" echo "================================================================================" - # ---------------------------------------------------------------- - # Connect to database - # ---------------------------------------------------------------- - echo "" - echo "Connecting to database ${DB2_DBNAME}" - echo "--------------------------------------------------------------------------------" - - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc "db2 connect to ${DB2_DBNAME}" db2inst1 - - # ---------------------------------------------------------------- - # Create audit policy - # ---------------------------------------------------------------- - echo "" - echo "Creating audit policy USER_AUDIT" - echo "--------------------------------------------------------------------------------" - - if oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL"' db2inst1 - then - echo "Audit policy USER_AUDIT created successfully." - else - echo "Audit policy USER_AUDIT may already exist. Continuing." - fi - - # ---------------------------------------------------------------- - # Create MAXIMO_READ role - # ---------------------------------------------------------------- - echo "" - echo "Creating MAXIMO_READ role" - echo "--------------------------------------------------------------------------------" - - if oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "CREATE ROLE MAXIMO_READ"' db2inst1 - then - echo "Role MAXIMO_READ created successfully." - else - echo "Role MAXIMO_READ may already exist. Continuing." - fi - - # ---------------------------------------------------------------- - # Create MAXIMO_WRITE role - # ---------------------------------------------------------------- - echo "" - echo "Creating MAXIMO_WRITE role" - echo "--------------------------------------------------------------------------------" - - if oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "CREATE ROLE MAXIMO_WRITE"' db2inst1 - then - echo "Role MAXIMO_WRITE created successfully." - else - echo "Role MAXIMO_WRITE may already exist. Continuing." - fi - - # ---------------------------------------------------------------- - # Assign audit policy to MAXIMO_READ - # ---------------------------------------------------------------- - echo "" - echo "Applying USER_AUDIT to MAXIMO_READ" - echo "--------------------------------------------------------------------------------" - - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT"' db2inst1 - - # ---------------------------------------------------------------- - # Assign audit policy to MAXIMO_WRITE - # ---------------------------------------------------------------- - echo "" - echo "Applying USER_AUDIT to MAXIMO_WRITE" - echo "--------------------------------------------------------------------------------" + # All DB2 commands run in a single oc exec so the database + # connection established by 'db2 connect' is shared across + # every subsequent statement in the same session. + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- su -lc " + set -e - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT"' db2inst1 + echo 'Connecting to database ${DB2_DBNAME}' + db2 connect to ${DB2_DBNAME} - # ---------------------------------------------------------------- - # Assign audit policy to db2inst1 - # ---------------------------------------------------------------- - echo "" - echo "Applying USER_AUDIT to db2inst1" - echo "--------------------------------------------------------------------------------" + echo 'Creating audit policy USER_AUDIT (instance-level)' + db2 \"CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL\" || echo 'Audit policy USER_AUDIT already exists, continuing' - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "AUDIT USER db2inst1 USING POLICY USER_AUDIT"' db2inst1 + echo 'Creating MAXIMO_READ and MAXIMO_WRITE roles' + db2 \"CREATE ROLE MAXIMO_READ\" || echo 'Role MAXIMO_READ already exists, continuing' + db2 \"CREATE ROLE MAXIMO_WRITE\" || echo 'Role MAXIMO_WRITE already exists, continuing' - # ---------------------------------------------------------------- - # Verify audit policy assignments - # ---------------------------------------------------------------- - echo "" - echo "================================================================================" - echo "Verifying audit policy setup" - echo "================================================================================" + echo 'Applying USER_AUDIT policy to MAXIMO_READ and MAXIMO_WRITE roles' + db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" + db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" - echo "" - echo "Audit policy assignments:" - echo "--------------------------------------------------------------------------------" - - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "SELECT AUDITPOLICYNAME, OBJECTTYPE, OBJECTNAME FROM SYSCAT.AUDITUSE WHERE AUDITPOLICYNAME='\''USER_AUDIT'\''"' db2inst1 + echo 'Applying USER_AUDIT policy to db2inst1 user' + db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" - echo "" - echo "Audit policy configuration:" - echo "--------------------------------------------------------------------------------" + echo '' + echo '========================================' + echo 'Verifying audit policy setup' + echo '========================================' - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc 'db2 "SELECT AUDITPOLICYNAME, VALIDATESTATUS, EXECUTESTATUS, EXECUTEWITHDATA, ERRORTYPE FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='\''USER_AUDIT'\''"' db2inst1 + echo 'Users and roles assigned to USER_AUDIT:' + db2 \"SELECT * FROM SYSCAT.AUDITUSE WHERE AUDITPOLICYNAME='USER_AUDIT'\" - # ---------------------------------------------------------------- - # Disconnect - # ---------------------------------------------------------------- - echo "" - echo "Disconnecting from database" - echo "--------------------------------------------------------------------------------" + echo 'Audit policy categories for USER_AUDIT:' + db2 \"SELECT AUDITPOLICYNAME, VALIDATESTATUS, EXECUTESTATUS FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='USER_AUDIT'\" - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- \ - su -lc "db2 connect reset" db2inst1 + db2 connect reset + echo 'Audit policy setup complete' + " db2inst1 || exit $? echo "" echo "================================================================================" From cf2d0043f6fba22ca5bd3149a17d9259b35c6f7c Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 20 Aug 2026 14:28:46 +0530 Subject: [PATCH 073/103] fix: add CPD >= 5.3.1 version gate to Cognos Analytics CR template --- .../templates/01-ibm-cognos-analytics-cr.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index 6b826bd1e..fd78a34b1 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,3 +1,4 @@ +{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0) }} --- # Persistent resource so ArgoCD has a stable non-hook object to track. # Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. @@ -89,3 +90,4 @@ spec: restartPolicy: Never serviceAccountName: cpd-sa backoffLimit: 4 +{{- end }} From c016a0bc5830f57c6c53f3666424c22f7659d373 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 20 Aug 2026 15:03:49 +0530 Subject: [PATCH 074/103] fix: restore SPSS OLM subscriptions and missing params for CPD < 5.3.1 --- ...5-3-1-gitops-support-full-explanation.html | 401 ++++++++++++++++++ .../templates/00-ibm-spss_Subscription.yaml | 22 +- .../120-ibm-spss/values.yaml | 1 + .../templates/120-ibm-spss-app.yaml | 3 + 4 files changed, 426 insertions(+), 1 deletion(-) create mode 100644 .bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html diff --git a/.bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html b/.bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html new file mode 100644 index 000000000..f5c2ee083 --- /dev/null +++ b/.bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html @@ -0,0 +1,401 @@ + + + + + +MASCORE-15507 Explainer + + + +
+

MASCORE-15507: CPD 5.3.1 GitOps Support

+

Complete explanation of every change — what was done, why, and how it works

+
+
+ +
+ Background + OLM Bootstrap + RBAC + WML + WSL + Spark + Cognos + SPSS + Post-sync + Bugs Fixed + Test Results +
+ + +
+
+ 📋 +

Background — Why This Change Was Needed

+
+
+
+
The Problem
+

CPD (Cloud Pak for Data) 5.3.1 changed how services are installed. In CPD ≤ 5.3, services were installed via OLM (Operator Lifecycle Manager) — you create a Subscription resource and an operator CR, and the OLM machinery handles everything. In CPD 5.3.1+, IBM moved to Helm-based installation — you run helm install directly to deploy the operator and service CR.

+
+
+
What This Means for GitOps
+

Our GitOps templates were only generating OLM Subscription + CR resources. On CPD 5.3.1 clusters, those resources either don't apply (no OLM catalog for them) or the operators aren't available via OLM. We needed to add a second code path that runs Helm charts instead, gated behind a version check.

+
+

Version Gate Pattern Used Throughout

+
{{/* CPD < 5.3.1: use OLM (Subscription + CR) */}} +{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} +--- OLM Subscription resource here --- +{{- else }} +--- Helm install Job here --- +{{- end }}
+

This reads as: "if cpd_product_version < 5.3.1, use OLM; otherwise use Helm"

+
+
+ + +
+
+ 🔧 +

CPD 5.3.1 OLM Bootstrap

+ New Files +
+
+
+
Why
+

Even though services use Helm in 5.3.1, the CPD platform itself (zen, common services, etc.) still uses OLM. CPD 5.3.1 requires different catalog sources and a different olm-utils-cm ConfigMap (which tells CPD operators the correct component versions). Without this, the platform operators don't know which versions to reconcile.

+
+
+
+
instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml
instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml
+
Added olm-utils-cm ConfigMap + full release_components_meta for CPD 5.3.1
+
The olm-utils-cm ConfigMap is read by CPD operators to know component versions (case_version, csv_version, cr_version). Without it, operators fall back to wrong defaults. This is gated with {{- if eq .Values.cpd_product_version "5.3.1" }}.
+
+
+
instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml
+
Added 3 new CatalogSources for CPD 5.3.1: cpd-platform, opencloud-operators, ibm-zen-operator-catalog
+
These are pinned to specific digest-based image tags for CPD 5.3.1. Different from 5.3.0 — if you use the wrong catalog, operators install wrong versions or fail to find their CSVs.
+
+
+
+
+ + +
+
+ 🔐 +

RBAC — ClusterRole for cpd-sa

+ Security +
+
+
+
Why
+

The Helm install jobs run as the cpd-sa ServiceAccount. In Helm mode, the cluster-scoped charts install CRDs and ClusterRoles across the entire cluster (not just one namespace). cpd-sa only had namespace-scoped permissions before — it couldn't create CRDs or ClusterRoles. This caused every Helm install job to fail with Forbidden errors.

+
+
+
instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml
+
Added ClusterRole + ClusterRoleBinding for cpd-sa (gated on CPD ≥ 5.3.1)
+
Grants cpd-sa permission to: create/patch CRDs, create/patch ClusterRoles (with escalate), manage webhooks, and access CPD service API groups. The escalate verb is needed because the Helm charts grant permissions that cpd-sa doesn't initially hold.
+
+
+
+ + +
+
+ 🤖 +

Watson Machine Learning (WML)

+ Helm Path Added +
+
+
+
Why Helm for WML
+

WML on CPD 5.3.1 requires installing Redis as a dependency first (WML operator needs Redis CRDs to exist before it can be deployed), then installing the WML operator + CR via Helm charts.

+
+

Install Order (CPD 5.3.1+)

+
+
ibm-redis-cp-cluster-scoped (CRDs)
+ → +
ibm-redis-cp (operator)
+ → +
Poll rediscps.redis.ibm.com CRD
+ → +
wml-cluster-scoped (CRDs)
+ → +
Poll wmlbases.wml.cpd.ibm.com CRD
+ → +
wml (operator + CR)
+
+

Key Bug Fixed

+
+ 🐛 +
+
CRD poll typo: redicps → rediscps
+
The script polled for redicps.redis.ibm.com (missing 's') which never exists. The actual CRD is rediscps.redis.ibm.com. This caused the job to time out after 5 minutes every time.
+
+
+

Hashed Job Name Pattern

+
+
Why hashed names
+

ArgoCD Jobs have immutable spec.template. If we use a fixed name like install-wml-helm and the template changes, ArgoCD tries to patch the existing Job → fails with "field is immutable". By computing a hash from the template content + version string, each change produces a new unique job name, so ArgoCD creates a new Job instead of patching the old one.

+
+
{{- $_job_version := "v2" }} ← bump this to force new job +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} +→ produces: install-wml-helm-502535097
+
+
+ + +
+
+ 🔬 +

Watson Studio (WSL)

+ Helm Path Added +
+
+
+
Why WSL is Complex
+

WSL has 4 dependencies that must be installed in order before WSL itself can be installed. Each dependency needs its cluster-scoped chart (CRDs) before its namespace-scoped chart (operator+CR).

+
+

Install Order (CPD 5.3.1+)

+
+
1. opencontent-opensearch
+ → +
2. ccs (+ explicit CCS CR)
+ → +
3. datarefinery
+ → +
4. ws-runtimes
+ → +
5. ws (Watson Studio)
+
+
+
CCS CR created explicitly with non_olm_deploy: true
+
In Helm mode, the CCS namespace-scoped chart only deploys the operator, not the CR. The CR must be created manually with non_olm_deploy: true flag so the operator knows it's not running under OLM and proceeds to reconcile the CCS instance.
+
+
+
install_component() helper function
+
Reusable function that: (1) applies cluster-scoped chart via helm template | oc apply, (2) waits for CRDs, (3) runs helm upgrade --install for namespace-scoped chart. Makes the script DRY and readable.
+
+
+
+ + +
+
+ ⚡ +

Apache Spark (Analytics Engine)

+ Helm Path Added +
+
+
+
Changes
+

Gated OLM Subscription, AnalyticsEngine CR, and the control-plane verification job behind < 5.3.1. Added Helm install job for 5.3.1+ using analyticsengine-cluster-scoped + analyticsengine charts at version 12.1.0. Also added cpd_product_version to values.yaml and the instance-root app template — without this, the version gate Helm template would fail (no value to compare against).

+
+
+
+ + +
+
+ 📊 +

Cognos Analytics

+ New Chart + 3 Bugs Fixed +
+
+
+
Context
+

Cognos Analytics was previously bundled with the SPSS chart (they shared the same ArgoCD app template 120-ibm-spss-app.yaml). They were split into separate charts. In the split, the Chart.yaml was accidentally omitted from the Cognos chart.

+
+
+
+
Bug 1: Missing Chart.yaml
+
Helm requires Chart.yaml to treat a directory as a chart. Without it, helm dependency update fails with "Chart.yaml file is missing". Added Chart.yaml matching the pattern of all other charts in the repo.
+
+
+
Bug 2: Escaped quotes parse error in instance-root template
+
The 120-ibm-cognos-analytics-app.yaml used \"nfs-client\" inside a YAML literal block scalar (value: |). Inside a block scalar, backslash escapes are literal characters, not YAML escapes — causing Helm to fail with "unexpected \\ in operand". Fixed by using unescaped "nfs-client".
+
+
+
Bug 3: Wrong CRD poll name
+
The Helm install job polled for cognosanalytics.cognosanalytics.cpd.ibm.com but the cognos-analytics-cluster-scoped chart actually creates caservices.ca.cpd.ibm.com and caserviceinstances.ca.cpd.ibm.com. Fixed to poll caservices.ca.cpd.ibm.com.
+
+
+
+
+ + +
+
+ 📈 +

SPSS Modeler

+ Re-added + CPD 5.3.1 Support +
+
+
+
Context
+

SPSS was previously available only for CPD < 5.3.1 via OLM. For CPD 5.3.1+, IBM provides spss-cluster-scoped + spss Helm charts, but SPSS requires Canvasbase as a dependency (the SPSS operator tries to create a Canvasbase CR on startup).

+
+

Install Order (CPD 5.3.1+)

+
+
canvasbase-cluster-scoped (CRDs) v12.1.0
+ → +
Poll canvasbase.canvasbase.cpd.ibm.com
+ → +
canvasbase (operator+CR) v12.1.0
+ → +
Wait canvasbase Completed
+ → +
spss-cluster-scoped (CRDs) v12.1.0
+ → +
Poll spss.spssmodeler.cpd.ibm.com
+ → +
spss (operator+CR) v12.1.0
+
+

Bugs Found and Fixed During Testing

+
+ 🐛 +
+
Wrong chart names: spss-modeler-cluster-scoped / spss-modeler
+
Correct names in IBM Helm repo are spss-cluster-scoped and spss. Fixed by querying the IBM Helm index directly.
+
+
+
+ 🐛 +
+
Wrong chart versions: 13.0.4 (CPD 5.4.0) instead of 12.1.0 (CPD 5.3.1)
+
Initially used the latest version (13.0.4) which is for CPD 5.4.0. The CPD 5.3.1 release_components_meta specifies case_version: 12.1.0 for both canvasbase and spss. Using wrong version caused "CR version 13.0.4 does not match operator version 12.1.0" errors.
+
+
+
+ 🐛 +
+
Wrong CRD poll names
+
Polled for spssmodelerbases.spssmodeler.cpd.ibm.com (doesn't exist) → actual CRD is spss.spssmodeler.cpd.ibm.com. Polled for canvasbases.cpd.ibm.com → actual CRD is canvasbase.canvasbase.cpd.ibm.com. Both found by checking oc get crd | grep after the cluster-scoped chart ran.
+
+
+
+ 🐛 +
+
canvasbase CR version mismatch (13.0.4 vs 12.1.0)
+
The canvasbase Helm chart created the CR with version 12.1.0 but the operator was 13.0.4 (from the wrong chart version). Fixed by correcting chart version. Required manually patching the stuck CR and deleting/recreating the SPSS CR once canvasbase reached Completed.
+
+
+
+
+ + +
+
+ 🔄 +

Post-Sync Job (121-ibm-post-sync-job-cp4d-services)

+ Guard Added +
+
+
+
Why
+

The post-sync job patches CCS and OpenSearch CRs after they're deployed via OLM. In CPD 5.3.1 Helm mode, these CRs are managed by Helm — patching them via the post-sync job would break Helm's management of them. Added an early exit for CPD ≥ 5.3.1.

+
+
COMP_531=$(compare_versions ${CPD_PRODUCT_VERSION} 5.3.1) +if [[ ${COMP_531} -ge 0 ]]; then + echo "CPD >= 5.3.1 - skipping OLM post-sync patching" + exit 0 +fi
+
+
+ + +
+
+ 🐛 +

All Bugs Found & Fixed During Testing

+
+
+ + + + + + + + + + + + + +
FileBugFix
120-ibm-cognos-analytics-app.yamlEscaped quotes \" in block scalarRemoved backslash escapes
120-ibm-cognos-analytics/Missing Chart.yamlAdded Chart.yaml
02-ibm-wml-cr.yamlCRD poll: redicps → rediscpsFixed typo
01-ibm-cognos-analytics-cr.yamlCRD poll: wrong CRD namecaservices.ca.cpd.ibm.com
01-ibm-spss-cr.yamlChart names wrongspss-cluster-scoped / spss
01-ibm-spss-cr.yamlChart version 13.0.4 (CPD 5.4)12.1.0 (CPD 5.3.1)
01-ibm-spss-cr.yamlCRD poll: spssmodelerbasesspss.spssmodeler.cpd.ibm.com
01-ibm-spss-cr.yamlCRD poll: canvasbases.cpd.ibm.comcanvasbase.canvasbase.cpd.ibm.com
01-ibm-spss-cr.yamlMissing canvasbase dependencyAdded canvasbase install step before spss
01-ibm-cognos-analytics-cr.yamlChart version 29.1.8 (too new)29.1.0 (CPD 5.3.1 metadata)
02-ibm-wml-cr.yamlFixed job name (immutable field error)Added hashed job name pattern
+
+
+ + +
+
+ ✅ +

Test Results — noble8 cluster, CPD 5.3.1, inst02

+
+
+
wml.noble8.inst02✅ WmlBase/wml-cr — Completed 100%
+
wsl.noble8.inst02✅ Synced Healthy
+
spark.noble8.inst02✅ Synced Healthy
+
cognos.noble8.inst02✅ CAService/ca-addon-cr — Completed 100%
+
spss.noble8.inst02✅ canvasbase + spss — Completed 100%
+
+
+ +
+ + diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index 2602216e4..0e5fc2c69 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -12,8 +12,28 @@ metadata: {{ .Values.custom_labels | toYaml | indent 4 }} {{- end }} spec: + name: "ibm-cpd-spss" channel: "{{ .Values.spss_channel }}" - name: spss-modeler source: ibm-operator-catalog sourceNamespace: openshift-marketplace + installPlanApproval: {{ .Values.spss_install_plan | default "Automatic" | quote }} + +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: "ibm-cpd-canvasbase-operator-catalog-subscription" # needed only by spss + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "091" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + name: "ibm-cpd-canvasbase" + channel: "{{ .Values.canvasbase_channel }}" + source: ibm-operator-catalog + sourceNamespace: openshift-marketplace + installPlanApproval: {{ .Values.canvasbase_install_plan | default "Automatic" | quote }} {{- end }} diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml index b7c0618d7..b41375d99 100644 --- a/instance-applications/120-ibm-spss/values.yaml +++ b/instance-applications/120-ibm-spss/values.yaml @@ -4,5 +4,6 @@ cpd_service_block_storage_class: "" cpd_service_scale_config: "" cpd_service_storage_class: "" spss_channel: "" +spss_install_plan: "" spss_version: "" cpd_product_version: "" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index ed753aca9..738d3e86b 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -54,7 +54,10 @@ spec: cpd_service_scale_config: "{{ .Values.ibm_spss.cpd_service_scale_config }}" spss_version: "{{ .Values.ibm_spss.spss_version }}" spss_channel: "{{ .Values.ibm_spss.spss_channel }}" + spss_install_plan: "{{ .Values.ibm_spss.spss_install_plan }}" ccs_version: "{{ .Values.ibm_spss.ccs_version }}" + canvasbase_channel: "{{ .Values.ibm_spss.canvasbase_channel }}" + canvasbase_install_plan: "{{ .Values.ibm_spss.canvasbase_install_plan }}" {{- if .Values.custom_labels }} custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} {{- end }} From 7cebd4bc0060c60c87844484ce0a45ba715e692d Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 20 Aug 2026 20:13:15 +0530 Subject: [PATCH 075/103] fix: revert kind back to Spss for CPD < 5.3.1 OLM path --- .../120-ibm-spss/templates/01-ibm-spss-cr.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index e75bf0777..ab90517d4 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -1,7 +1,7 @@ {{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: spssmodeler.cpd.ibm.com/v1 -kind: SPSSModeler +kind: Spss metadata: name: "spssmodeler-cr" namespace: "{{ .Values.cpd_instance_namespace }}" From 768133a1d00499f57d90b2c97bdd50d0685d4cd7 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 20 Aug 2026 23:14:13 +0530 Subject: [PATCH 076/103] fix: read chart versions from olm-utils-cm, move SkipDryRunOnMissingResource to cluster-scoped MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three fixes across all 5 CPD >= 5.3.1 native ArgoCD Helm App templates: 1. Version lookup from olm-utils-cm - Replace all hardcoded targetRevision strings with values read at render time from the olm-utils-cm ConfigMap (deployed by wave 110). - Uses Helm lookup() with per-component fallback defaults so helm template dry-runs (where the cluster is not reachable) still work. - Components resolved: wml, ibm_redis_cp, analyticsengine, canvasbase, spss, opencontent_opensearch, ccs, datarefinery, ws_runtimes, ws, cognos_analytics 2. SkipDryRunOnMissingResource moved to cluster-scoped apps - Cluster-scoped charts install CRDs; ArgoCD needs to skip the dry-run for those apps on first deploy when the CRDs don't exist yet. - Namespace-scoped apps no longer carry this option — they run after the CRDs are established by the preceding cluster-scoped wave. 3. OLM Subscription files unchanged - Existing files gated < 5.3.1 are correct and intentional; no changes. --- .../120-ibm-cognos-analytics-app.yaml | 123 +++-- .../templates/120-ibm-spark-app.yaml | 118 ++++- .../templates/120-ibm-spss-app.yaml | 204 ++++++++ .../templates/120-ibm-wml-app.yaml | 204 +++++++- .../templates/120-ibm-wsl-app.yaml | 472 ++++++++++++++++++ 5 files changed, 1070 insertions(+), 51 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index 6ceaf52db..6299666f9 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -1,7 +1,65 @@ {{- if and (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) (not (lt (semver "5.3.1" | (semver (.Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString)).Compare) 0)) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +{{ $cpd_instance_ns := .Values.ibm_cp4d.cpd_instance_namespace }} +{{ $cpd_version := .Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString }} +{{- /* + Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). + Falls back to known-good defaults if the ConfigMap is not yet present + (e.g. during a helm template dry-run). +*/}} +{{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} +{{- $meta := dict }} +{{- if $olmUtils }} +{{- $meta = $olmUtils.data.release_components_meta | fromYaml }} +{{- end }} +{{- $cognosVersion := (index $meta "cognos_analytics" | default dict).case_version | default "29.1.0" }} +--- +# CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) +# Wave 119: cognos-analytics cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cognos-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "119" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: cognos-analytics-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $cognosVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true --- -# IBM Cognos Analytics Application +# Wave 120: cognos-analytics namespace-scoped (operator + CR) apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -27,57 +85,28 @@ spec: project: "{{ .Values.argo.projects.apps }}" destination: server: {{ .Values.cluster.url }} - namespace: {{ $cpd_operators_ns }} + namespace: {{ $cpd_instance_ns }} source: - repoURL: "{{ .Values.source.repo_url }}" - path: instance-applications/120-ibm-cognos-analytics - targetRevision: "{{ .Values.source.revision }}" - plugin: - name: {{ .Values.avp.name }} - env: - - name: {{ .Values.avp.values_varname }} - value: | - account_id: "{{ .Values.account.id }}" - region_id: "{{ .Values.region.id }}" - cluster_id: "{{ .Values.cluster.id }}" - instance_id: "{{ .Values.instance.id }}" - cli_image_repo: {{ .Values.cli_image_repo }} - cluster_admin_role: {{ .Values.cluster_admin_role }} - application_admin_role: {{ .Values.application_admin_role }} - sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" - sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" - cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" - cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" - cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" - cpd_service_storage_class: "{{ .Values.ibm_cp4d.cpd_service_storage_class | default "nfs-client" }}" - cpd_service_block_storage_class: "{{ .Values.ibm_cp4d.cpd_service_block_storage_class | default "nfs-client" }}" - cpd_service_scale_config: "{{ .Values.ibm_cp4d.cpd_service_scale_config | default "small" }}" - ccs_version: "{{ .Values.ibm_cp4d.ccs_version | default "12.1.0" }}" - {{- if .Values.custom_labels }} - custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} - {{- end }} - junitreporter: - reporter_name: "ibm-cognos-analytics-{{ .Values.instance.id }}" - cluster_id: "{{ .Values.cluster.id }}" - instance_id: "{{ .Values.instance.id }}" - devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" - devops_build_number: "{{ .Values.devops.build_number }}" - gitops_version: "{{ .Values.source.revision }}" - cli_image_repo: {{ .Values.cli_image_repo }} - - name: ARGOCD_APP_NAME - value: cpdcognosapp - {{- if not (empty .Values.avp.secret) }} - - name: AVP_SECRET - value: {{ .Values.avp.secret }} - {{- end }} + chart: cognos-analytics + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $cognosVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_cp4d.cpd_service_storage_class | default "nfs-client" }} + blockStorageClass: {{ .Values.ibm_cp4d.cpd_service_block_storage_class | default "nfs-client" }} + imagePullSecret: ibm-entitlement-key + cognos-analytics: + scaleConfig: {{ .Values.ibm_cp4d.cpd_service_scale_config | default "small" }} syncPolicy: automated: - {{- if .Values.auto_delete }} - prune: true - {{- end }} selfHeal: true retry: limit: 20 syncOptions: - - CreateNamespace=false + - CreateNamespace=true {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml index af0446795..832973259 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml @@ -1,7 +1,12 @@ {{- if and (not (empty .Values.ibm_spark)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +{{ $cpd_instance_ns := .Values.ibm_cp4d.cpd_instance_namespace }} +{{ $cpd_version := .Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString }} +{{ $is531 := not (lt (semver "5.3.1" | (semver $cpd_version).Compare) 0) }} +{{- if not $is531 }} --- -# IBM Maximo Operator Catalog +# CPD < 5.3.1 — OLM path +# IBM Spark Application apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -38,7 +43,7 @@ spec: path: instance-applications/120-ibm-spark targetRevision: "{{ .Values.source.revision }}" plugin: - name: {{ .Values.avp.name }} + name: {{ .Values.avp.name }} env: - name: {{ .Values.avp.values_varname }} value: | @@ -84,4 +89,113 @@ spec: syncOptions: - CreateNamespace=false - RespectIgnoreDifferences=true +{{- else }} +{{- /* + Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). + Falls back to known-good defaults if the ConfigMap is not yet present + (e.g. during a helm template dry-run). +*/}} +{{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} +{{- $meta := dict }} +{{- if $olmUtils }} +{{- $meta = $olmUtils.data.release_components_meta | fromYaml }} +{{- end }} +{{- $sparkVersion := (index $meta "analyticsengine" | default dict).case_version | default "12.1.0" }} +--- +# CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) +# Wave 119: analyticsengine cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spark-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "119" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: analyticsengine-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $sparkVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 120: analyticsengine namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spark.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "120" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: analyticsengine + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $sparkVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_spark.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_spark.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + analyticsengine: + scaleConfig: {{ .Values.ibm_spark.cpd_service_scale_config }} + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +{{- end }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index 738d3e86b..f28ff34df 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -1,6 +1,11 @@ {{- if and (not (empty .Values.ibm_spss)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +{{ $cpd_instance_ns := .Values.ibm_cp4d.cpd_instance_namespace }} +{{ $cpd_version := .Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString }} +{{ $is531 := not (lt (semver "5.3.1" | (semver $cpd_version).Compare) 0) }} +{{- if not $is531 }} --- +# CPD < 5.3.1 — OLM path # IBM SPSS Modeler Application apiVersion: argoproj.io/v1alpha1 kind: Application @@ -85,4 +90,203 @@ spec: limit: 20 syncOptions: - CreateNamespace=false +{{- else }} +{{- /* + Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). + Falls back to known-good defaults if the ConfigMap is not yet present + (e.g. during a helm template dry-run). +*/}} +{{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} +{{- $meta := dict }} +{{- if $olmUtils }} +{{- $meta = $olmUtils.data.release_components_meta | fromYaml }} +{{- end }} +{{- $canvasbaseVersion := (index $meta "canvasbase" | default dict).case_version | default "12.1.0" }} +{{- $spssVersion := (index $meta "spss" | default dict).case_version | default "12.1.0" }} +--- +# CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) +# Wave 119: canvasbase cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spss-canvasbase-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "119" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: canvasbase-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $canvasbaseVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 120: canvasbase namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spss-canvasbase.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "120" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: canvasbase + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $canvasbaseVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_spss.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_spss.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +--- +# Wave 121: SPSS cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spss-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "121" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: spss-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $spssVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 122: SPSS namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: spss.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "122" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: spss + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $spssVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_spss.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_spss.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + spss: + scaleConfig: {{ .Values.ibm_spss.cpd_service_scale_config }} + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +{{- end }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml index f5779542f..5a8374b89 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml @@ -1,7 +1,12 @@ {{- if and (not (empty .Values.ibm_wml)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +{{ $cpd_instance_ns := .Values.ibm_cp4d.cpd_instance_namespace }} +{{ $cpd_version := .Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString }} +{{ $is531 := not (lt (semver "5.3.1" | (semver $cpd_version).Compare) 0) }} +{{- if not $is531 }} --- -# IBM Maximo Operator Catalog +# CPD < 5.3.1 — OLM path +# IBM WML Application apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -38,7 +43,7 @@ spec: path: instance-applications/120-ibm-wml targetRevision: "{{ .Values.source.revision }}" plugin: - name: {{ .Values.avp.name }} + name: {{ .Values.avp.name }} env: - name: {{ .Values.avp.values_varname }} value: | @@ -82,4 +87,199 @@ spec: syncOptions: - CreateNamespace=false - RespectIgnoreDifferences=true +{{- else }} +{{- /* + Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). + Falls back to known-good defaults if the ConfigMap is not yet present + (e.g. during a helm template dry-run). +*/}} +{{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} +{{- $meta := dict }} +{{- if $olmUtils }} +{{- $meta = $olmUtils.data.release_components_meta | fromYaml }} +{{- end }} +{{- $redisVersion := (index $meta "ibm_redis_cp" | default dict).case_version | default "1.3.1" }} +{{- $wmlVersion := (index $meta "wml" | default dict).case_version | default "12.1.0" }} +--- +# CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) +# Wave 119: ibm-redis-cp cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wml-redis-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "119" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: ibm-redis-cp-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $redisVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 120: ibm-redis-cp namespace-scoped (operator) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wml-redis.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "120" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: ibm-redis-cp + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $redisVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false +--- +# Wave 121: WML cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wml-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "121" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: wml-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $wmlVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 122: WML namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wml.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "122" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: wml + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $wmlVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_wml.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_wml.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + wml: + scaleConfig: {{ .Values.ibm_wml.cpd_service_scale_config }} + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +{{- end }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index 43098f834..76d3bcf17 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -1,6 +1,11 @@ {{- if and (not (empty .Values.ibm_wsl)) (not (empty .Values.ibm_cp4d)) (.Values.cluster_admin_role) }} {{ $cpd_operators_ns := .Values.ibm_cp4d.cpd_operators_namespace }} +{{ $cpd_instance_ns := .Values.ibm_cp4d.cpd_instance_namespace }} +{{ $cpd_version := .Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString }} +{{ $is531 := not (lt (semver "5.3.1" | (semver $cpd_version).Compare) 0) }} +{{- if not $is531 }} --- +# CPD < 5.3.1 — OLM path # IBM Maximo Operator Catalog apiVersion: argoproj.io/v1alpha1 kind: Application @@ -85,4 +90,471 @@ spec: limit: 20 syncOptions: - CreateNamespace=false +{{- else }} +{{- /* + Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). + Falls back to known-good defaults if the ConfigMap is not yet present + (e.g. during a helm template dry-run). +*/}} +{{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} +{{- $meta := dict }} +{{- if $olmUtils }} +{{- $meta = $olmUtils.data.release_components_meta | fromYaml }} +{{- end }} +{{- $opensearchVersion := (index $meta "opencontent_opensearch" | default dict).case_version | default "1.2.0" }} +{{- $ccsVersion := (index $meta "ccs" | default dict).case_version | default "12.1.0" }} +{{- $datarefineryVersion := (index $meta "datarefinery" | default dict).case_version | default "12.1.0" }} +{{- $wsRuntimesVersion := (index $meta "ws_runtimes" | default dict).case_version | default "12.1.0" }} +{{- $wsVersion := (index $meta "ws" | default dict).case_version | default "12.1.0" }} +--- +# CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) +# Wave 115: opencontent-opensearch cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-opensearch-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "115" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: opencontent-opensearch-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $opensearchVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 116: opencontent-opensearch namespace-scoped (operator) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-opensearch.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "116" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: opencontent-opensearch + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $opensearchVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false +--- +# Wave 117: ccs cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-ccs-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "117" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: ccs-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $ccsVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 118: ccs namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-ccs.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "118" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: ccs + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $ccsVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_wsl.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_wsl.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + ccs: + scaleConfig: {{ .Values.ibm_wsl.cpd_service_scale_config }} + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +--- +# Wave 119: datarefinery cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-datarefinery-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "119" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: datarefinery-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $datarefineryVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 120: datarefinery namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-datarefinery.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "120" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: datarefinery + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $datarefineryVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_wsl.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_wsl.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +--- +# Wave 121: ws-runtimes cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-ws-runtimes-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "121" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: ws-runtimes-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $wsRuntimesVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 122: ws-runtimes namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-ws-runtimes.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "122" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: ws-runtimes + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $wsRuntimesVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_wsl.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_wsl.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +--- +# Wave 123: ws cluster-scoped (CRDs + ClusterRoles) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-cluster.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "123" + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + chart: ws-cluster-scoped + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $wsVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + imagePullSecret: ibm-entitlement-key + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - SkipDryRunOnMissingResource=true +--- +# Wave 124: ws namespace-scoped (operator + CR) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "124" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_instance_ns }} + source: + chart: ws + repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm + targetRevision: "{{ $wsVersion }}" + helm: + valuesObject: + global: + licenseAccept: true + releaseVersion: {{ $cpd_version }} + operatorNamespace: {{ $cpd_operators_ns }} + instanceNamespace: {{ $cpd_instance_ns }} + fileStorageClass: {{ .Values.ibm_wsl.cpd_service_storage_class }} + blockStorageClass: {{ .Values.ibm_wsl.cpd_service_block_storage_class }} + imagePullSecret: ibm-entitlement-key + ws: + scaleConfig: {{ .Values.ibm_wsl.cpd_service_scale_config }} + syncPolicy: + automated: + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true +{{- end }} {{- end }} From 34ea07b966ddcc6a60a1a786691358e9b8445651 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 20 Aug 2026 23:23:13 +0530 Subject: [PATCH 077/103] fix: expose chart versions as gitops config values for CPD >= 5.3.1 services MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously, Helm chart targetRevision values for WML, WSL, Spark, SPSS and Cognos Analytics were resolved only from olm-utils-cm (cluster lookup) or hardcoded defaults. This meant operators could not pin or override versions through the gitops config repo — any CPD version >= 5.3.1 would always get the 5.3.1 chart versions baked into the ConfigMap at install time. Resolution priority is now (highest first): 1. Explicit gitops config value (e.g. ibm_wml.wml_chart_version) 2. olm-utils-cm ConfigMap lookup (auto, from wave 110-ibm-cp4d) 3. Hardcoded default (dry-run safety net only) New optional values added to each service values.yaml: WML: wml_chart_version, redis_chart_version Spark: spark_chart_version SPSS: spss_chart_version, canvasbase_chart_version WSL: ws_chart_version, ccs_chart_version, datarefinery_chart_version, ws_runtimes_chart_version, opensearch_chart_version Cognos: cognos_chart_version (under ibm_cp4d) All values default to empty string so existing deployments are unaffected — the olm-utils-cm lookup continues to provide the version automatically when no explicit value is set. --- instance-applications/120-ibm-spark/values.yaml | 3 +++ instance-applications/120-ibm-spss/values.yaml | 4 ++++ instance-applications/120-ibm-wml/values.yaml | 4 ++++ instance-applications/120-ibm-wsl/values.yaml | 7 +++++++ .../templates/120-ibm-cognos-analytics-app.yaml | 9 +++++---- .../templates/120-ibm-spark-app.yaml | 9 +++++---- .../templates/120-ibm-spss-app.yaml | 11 ++++++----- .../templates/120-ibm-wml-app.yaml | 11 ++++++----- .../templates/120-ibm-wsl-app.yaml | 17 +++++++++-------- 9 files changed, 49 insertions(+), 26 deletions(-) diff --git a/instance-applications/120-ibm-spark/values.yaml b/instance-applications/120-ibm-spark/values.yaml index 25e5c803b..87a73f348 100644 --- a/instance-applications/120-ibm-spark/values.yaml +++ b/instance-applications/120-ibm-spark/values.yaml @@ -6,3 +6,6 @@ cpd_service_storage_class: "" spark_channel: "" spark_version: "" cpd_product_version: "" +# Optional: pin Helm chart version for CPD >= 5.3.1 native install. +# When empty, version is read from olm-utils-cm (deployed by wave 110). +spark_chart_version: "" diff --git a/instance-applications/120-ibm-spss/values.yaml b/instance-applications/120-ibm-spss/values.yaml index b41375d99..49245cfa5 100644 --- a/instance-applications/120-ibm-spss/values.yaml +++ b/instance-applications/120-ibm-spss/values.yaml @@ -7,3 +7,7 @@ spss_channel: "" spss_install_plan: "" spss_version: "" cpd_product_version: "" +# Optional: pin Helm chart versions for CPD >= 5.3.1 native install. +# When empty, versions are read from olm-utils-cm (deployed by wave 110). +spss_chart_version: "" +canvasbase_chart_version: "" diff --git a/instance-applications/120-ibm-wml/values.yaml b/instance-applications/120-ibm-wml/values.yaml index 56dedaab2..1cae71e22 100644 --- a/instance-applications/120-ibm-wml/values.yaml +++ b/instance-applications/120-ibm-wml/values.yaml @@ -6,3 +6,7 @@ cpd_service_storage_class: "" wml_channel: "" wml_version: "" cpd_product_version: "" +# Optional: pin Helm chart versions for CPD >= 5.3.1 native install. +# When empty, versions are read from olm-utils-cm (deployed by wave 110). +wml_chart_version: "" +redis_chart_version: "" diff --git a/instance-applications/120-ibm-wsl/values.yaml b/instance-applications/120-ibm-wsl/values.yaml index 9f5bfb988..2f1f33bb7 100644 --- a/instance-applications/120-ibm-wsl/values.yaml +++ b/instance-applications/120-ibm-wsl/values.yaml @@ -7,3 +7,10 @@ wsl_channel: "" ccs_version: "" datarefinery_version: "" ws_runtimes_version: "" +# Optional: pin Helm chart versions for CPD >= 5.3.1 native install. +# When empty, versions are read from olm-utils-cm (deployed by wave 110). +ws_chart_version: "" +ccs_chart_version: "" +datarefinery_chart_version: "" +ws_runtimes_chart_version: "" +opensearch_chart_version: "" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index 6299666f9..0a3ff9675 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -3,16 +3,17 @@ {{ $cpd_instance_ns := .Values.ibm_cp4d.cpd_instance_namespace }} {{ $cpd_version := .Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString }} {{- /* - Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). - Falls back to known-good defaults if the ConfigMap is not yet present - (e.g. during a helm template dry-run). + Chart version resolution (highest priority first): + 1. Explicit gitops config value (ibm_cp4d.cognos_chart_version) + 2. olm-utils-cm ConfigMap lookup (deployed by wave 110-ibm-cp4d) + 3. Hardcoded default (safety net for helm template dry-runs) */}} {{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} {{- $meta := dict }} {{- if $olmUtils }} {{- $meta = $olmUtils.data.release_components_meta | fromYaml }} {{- end }} -{{- $cognosVersion := (index $meta "cognos_analytics" | default dict).case_version | default "29.1.0" }} +{{- $cognosVersion := .Values.ibm_cp4d.cognos_chart_version | default ((index $meta "cognos_analytics" | default dict).case_version | default "29.1.0") }} --- # CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) # Wave 119: cognos-analytics cluster-scoped (CRDs + ClusterRoles) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml index 832973259..40204e5da 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml @@ -91,16 +91,17 @@ spec: - RespectIgnoreDifferences=true {{- else }} {{- /* - Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). - Falls back to known-good defaults if the ConfigMap is not yet present - (e.g. during a helm template dry-run). + Chart version resolution (highest priority first): + 1. Explicit gitops config value (e.g. ibm_spark.spark_chart_version) + 2. olm-utils-cm ConfigMap lookup (deployed by wave 110-ibm-cp4d) + 3. Hardcoded default (safety net for helm template dry-runs) */}} {{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} {{- $meta := dict }} {{- if $olmUtils }} {{- $meta = $olmUtils.data.release_components_meta | fromYaml }} {{- end }} -{{- $sparkVersion := (index $meta "analyticsengine" | default dict).case_version | default "12.1.0" }} +{{- $sparkVersion := .Values.ibm_spark.spark_chart_version | default ((index $meta "analyticsengine" | default dict).case_version | default "12.1.0") }} --- # CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) # Wave 119: analyticsengine cluster-scoped (CRDs + ClusterRoles) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index f28ff34df..43a108b31 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -92,17 +92,18 @@ spec: - CreateNamespace=false {{- else }} {{- /* - Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). - Falls back to known-good defaults if the ConfigMap is not yet present - (e.g. during a helm template dry-run). + Chart version resolution (highest priority first): + 1. Explicit gitops config value (e.g. ibm_spss.spss_chart_version) + 2. olm-utils-cm ConfigMap lookup (deployed by wave 110-ibm-cp4d) + 3. Hardcoded default (safety net for helm template dry-runs) */}} {{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} {{- $meta := dict }} {{- if $olmUtils }} {{- $meta = $olmUtils.data.release_components_meta | fromYaml }} {{- end }} -{{- $canvasbaseVersion := (index $meta "canvasbase" | default dict).case_version | default "12.1.0" }} -{{- $spssVersion := (index $meta "spss" | default dict).case_version | default "12.1.0" }} +{{- $canvasbaseVersion := .Values.ibm_spss.canvasbase_chart_version | default ((index $meta "canvasbase" | default dict).case_version | default "12.1.0") }} +{{- $spssVersion := .Values.ibm_spss.spss_chart_version | default ((index $meta "spss" | default dict).case_version | default "12.1.0") }} --- # CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) # Wave 119: canvasbase cluster-scoped (CRDs + ClusterRoles) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml index 5a8374b89..bbaaa771e 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml @@ -89,17 +89,18 @@ spec: - RespectIgnoreDifferences=true {{- else }} {{- /* - Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). - Falls back to known-good defaults if the ConfigMap is not yet present - (e.g. during a helm template dry-run). + Chart version resolution (highest priority first): + 1. Explicit gitops config value (e.g. ibm_wml.wml_chart_version) + 2. olm-utils-cm ConfigMap lookup (deployed by wave 110-ibm-cp4d) + 3. Hardcoded default (safety net for helm template dry-runs) */}} {{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} {{- $meta := dict }} {{- if $olmUtils }} {{- $meta = $olmUtils.data.release_components_meta | fromYaml }} {{- end }} -{{- $redisVersion := (index $meta "ibm_redis_cp" | default dict).case_version | default "1.3.1" }} -{{- $wmlVersion := (index $meta "wml" | default dict).case_version | default "12.1.0" }} +{{- $redisVersion := .Values.ibm_wml.redis_chart_version | default ((index $meta "ibm_redis_cp" | default dict).case_version | default "1.3.1") }} +{{- $wmlVersion := .Values.ibm_wml.wml_chart_version | default ((index $meta "wml" | default dict).case_version | default "12.1.0") }} --- # CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) # Wave 119: ibm-redis-cp cluster-scoped (CRDs + ClusterRoles) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index 76d3bcf17..dc91e476e 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -92,20 +92,21 @@ spec: - CreateNamespace=false {{- else }} {{- /* - Read chart versions from olm-utils-cm (created by 110-ibm-cp4d). - Falls back to known-good defaults if the ConfigMap is not yet present - (e.g. during a helm template dry-run). + Chart version resolution (highest priority first): + 1. Explicit gitops config value (e.g. ibm_wsl.ws_chart_version) + 2. olm-utils-cm ConfigMap lookup (deployed by wave 110-ibm-cp4d) + 3. Hardcoded default (safety net for helm template dry-runs) */}} {{- $olmUtils := lookup "v1" "ConfigMap" $cpd_instance_ns "olm-utils-cm" }} {{- $meta := dict }} {{- if $olmUtils }} {{- $meta = $olmUtils.data.release_components_meta | fromYaml }} {{- end }} -{{- $opensearchVersion := (index $meta "opencontent_opensearch" | default dict).case_version | default "1.2.0" }} -{{- $ccsVersion := (index $meta "ccs" | default dict).case_version | default "12.1.0" }} -{{- $datarefineryVersion := (index $meta "datarefinery" | default dict).case_version | default "12.1.0" }} -{{- $wsRuntimesVersion := (index $meta "ws_runtimes" | default dict).case_version | default "12.1.0" }} -{{- $wsVersion := (index $meta "ws" | default dict).case_version | default "12.1.0" }} +{{- $opensearchVersion := .Values.ibm_wsl.opensearch_chart_version | default ((index $meta "opencontent_opensearch" | default dict).case_version | default "1.2.0") }} +{{- $ccsVersion := .Values.ibm_wsl.ccs_chart_version | default ((index $meta "ccs" | default dict).case_version | default "12.1.0") }} +{{- $datarefineryVersion := .Values.ibm_wsl.datarefinery_chart_version | default ((index $meta "datarefinery" | default dict).case_version | default "12.1.0") }} +{{- $wsRuntimesVersion := .Values.ibm_wsl.ws_runtimes_chart_version | default ((index $meta "ws_runtimes" | default dict).case_version | default "12.1.0") }} +{{- $wsVersion := .Values.ibm_wsl.ws_chart_version | default ((index $meta "ws" | default dict).case_version | default "12.1.0") }} --- # CPD >= 5.3.1 — native ArgoCD Helm Apps (no K8s Jobs) # Wave 115: opencontent-opensearch cluster-scoped (CRDs + ClusterRoles) From 6d2e644e2c8888fc005dfda40f738d96d74273cb Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 21 Aug 2026 00:43:22 +0530 Subject: [PATCH 078/103] fix: remove dead cpd-sa Helm ClusterRole now that K8s Jobs are replaced MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The cpd-sa-helm-cluster-role-{instance_id} ClusterRole and its ClusterRoleBinding were created to give the cpd-sa ServiceAccount cluster-level permissions (CRD management, escalate on ClusterRoles, SCC use) so it could run 'helm install' for the CPD 5.3.1+ service charts inside a K8s Job pod. Those Helm Job pods are now gone — all CPD >= 5.3.1 service installs are handled by native ArgoCD Applications which run as ArgoCD itself (already has cluster admin). cpd-sa is no longer used for Helm installs. Leaving this ClusterRole in place: - Creates an over-privileged escalate-capable ClusterRole with no consumer - Violates least-privilege (escalate + CRD delete + SCC use granted unnecessarily) - Was flagged by rbinns as a PR blocker ClusterRole and ClusterRoleBinding removed. The cpd-sa ServiceAccount and its existing namespace-scoped Role (admin RoleBinding to the instance namespace) are unaffected. --- .../templates/02-ibm-cp4d_rbac.yaml | 140 ------------------ 1 file changed, 140 deletions(-) diff --git a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml index 4c9e7cff5..de6530309 100644 --- a/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml +++ b/instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml @@ -1527,143 +1527,3 @@ roleRef: kind: ClusterRole name: admin -{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0) }} ---- -# For CPD 5.3.1+, cpd-sa needs cluster-level permissions to apply CRDs and -# ClusterRoles from the Helm cluster-scoped charts during service installation. -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: "cpd-sa-helm-cluster-role-{{ .Values.instance_id }}" - annotations: - argocd.argoproj.io/sync-wave: "084" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -rules: - # CRD management (needed to apply cluster-scoped Helm charts) - - verbs: - - get - - list - - create - - update - - patch - - delete - apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - # ClusterRole/Binding management with escalate (allows granting permissions not yet held) - - verbs: - - get - - list - - create - - update - - patch - - delete - - bind - - escalate - apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - # Namespaced roles/rolebindings (needed by Helm namespace-scoped charts) - - verbs: - - get - - list - - create - - update - - patch - - delete - - watch - apiGroups: - - rbac.authorization.k8s.io - resources: - - roles - - rolebindings - # Namespace/node read - - verbs: - - get - - list - apiGroups: - - "" - resources: - - namespaces - - nodes - # OpenShift infra - - verbs: - - get - - list - apiGroups: - - config.openshift.io - resources: - - clusterversions - - infrastructures - # SCCs - - verbs: - - use - apiGroups: - - security.openshift.io - resources: - - securitycontextconstraints - resourceNames: - - anyuid - - restricted - - nonroot - - privileged - # CPD service API groups (needed to grant these permissions in cluster-scoped ClusterRoles) - - verbs: - - get - - list - - create - - update - - patch - - delete - - watch - apiGroups: - - ae.cpd.ibm.com - - wml.cpd.ibm.com - - spssmodeler.cpd.ibm.com - - ws.cpd.ibm.com - - ccs.cpd.ibm.com - - opensearch.cloudpackopen.ibm.com - - datarefinery.cpd.ibm.com - - wsruntimes.cpd.ibm.com - resources: - - "*" - # Webhook configs (needed by some Helm charts) - - verbs: - - get - - list - - create - - update - - patch - - delete - apiGroups: - - admissionregistration.k8s.io - resources: - - mutatingwebhookconfigurations - - validatingwebhookconfigurations - ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: "cpd-sa-helm-cluster-rb-{{ .Values.instance_id }}" - annotations: - argocd.argoproj.io/sync-wave: "085" -{{- if .Values.custom_labels }} - labels: -{{ .Values.custom_labels | toYaml | indent 4 }} -{{- end }} -subjects: - - kind: ServiceAccount - name: cpd-sa - namespace: "{{ .Values.cpd_operators_namespace }}" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: "cpd-sa-helm-cluster-role-{{ .Values.instance_id }}" -{{- end }} From 5d8bf0f9c36aedba250f41cc007727b60e29d58f Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 21 Aug 2026 00:54:51 +0530 Subject: [PATCH 079/103] fix: remove remaining Helm Job blocks from instance chart templates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The {{- else }} branches containing batch/v1 Job objects (the old helm-install shell-script approach) and their stub ConfigMap anchors were still present in the >= 5.3.1 paths of these instance chart templates. These are now unreachable dead code — the root-app ibm-mas-instance-root never creates an ArgoCD Application pointing at these instance charts for CPD >= 5.3.1. Removed from: - 120-ibm-wml/templates/02-ibm-wml-cr.yaml - 120-ibm-spark/templates/01-ibm-spark-cr.yaml - 120-ibm-spss/templates/01-ibm-spss-cr.yaml - 120-ibm-wsl/templates/01-ibm-wsl-cr.yaml - 120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml Each file now contains only the OLM path gated behind {{- if lt ... 5.3.1 }} — rendering nothing for CPD >= 5.3.1. --- .../templates/01-ibm-cognos-analytics-cr.yaml | 95 +------ .../templates/01-ibm-spark-cr.yaml | 91 ------- .../templates/01-ibm-spss-cr.yaml | 131 ---------- .../120-ibm-wml/templates/02-ibm-wml-cr.yaml | 123 --------- .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 235 ------------------ 5 files changed, 2 insertions(+), 673 deletions(-) diff --git a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml index fd78a34b1..a230633ee 100644 --- a/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml +++ b/instance-applications/120-ibm-cognos-analytics/templates/01-ibm-cognos-analytics-cr.yaml @@ -1,93 +1,2 @@ -{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0) }} ---- -# Persistent resource so ArgoCD has a stable non-hook object to track. -# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. -apiVersion: v1 -kind: ConfigMap -metadata: - name: ibm-cognos-helm-install-config - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -data: - cpd_product_version: "{{ .Values.cpd_product_version }}" - install_method: "helm" ---- -# Helm-based installation for CPD 5.3.1+ -# Cognos Analytics is an optional analytics and reporting service -{{- $_job_name_prefix := "install-cognos-helm" }} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} -{{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v3" }} -{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} -{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} -{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $_job_name }} - namespace: "{{ .Values.cpd_operators_namespace }}" - labels: - mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed -spec: - template: - spec: - containers: - - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} - command: - - /bin/sh - - -c - - | - set -e - helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm - helm repo update - - echo "Installing cognos-analytics cluster-scoped chart (CRDs + ClusterRoles)..." - helm template cognos-analytics-cluster ibm-charts/cognos-analytics-cluster-scoped \ - --version 29.1.0 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Waiting for caservices.ca.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd caservices.ca.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - echo "Installing cognos-analytics namespace-scoped chart (operator + CR)..." - helm upgrade --install cognos-analytics ibm-charts/cognos-analytics \ - --version 29.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --set cognosanalytics.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 60m - restartPolicy: Never - serviceAccountName: cpd-sa - backoffLimit: 4 -{{- end }} +# CPD >= 5.3.1 Cognos Analytics is deployed via native ArgoCD Helm Application +# defined in root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml diff --git a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml index b7a6a913b..dd1fab53b 100644 --- a/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml +++ b/instance-applications/120-ibm-spark/templates/01-ibm-spark-cr.yaml @@ -23,95 +23,4 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.spark_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" -{{- else }} ---- -# Persistent resource so ArgoCD has a stable non-hook object to track. -# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. -apiVersion: v1 -kind: ConfigMap -metadata: - name: ibm-spark-helm-install-config - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -data: - cpd_product_version: "{{ .Values.cpd_product_version }}" - install_method: "helm" ---- -# Helm-based installation for CPD 5.3.1+ -{{- $_job_name_prefix := "install-spark-helm" }} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} -{{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v1" }} -{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} -{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} -{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $_job_name }} - namespace: "{{ .Values.cpd_operators_namespace }}" - labels: - mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed -spec: - template: - spec: - containers: - - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} - command: - - /bin/sh - - -c - - | - set -e - helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm - helm repo update - - echo "Installing analyticsengine cluster-scoped chart (CRDs + ClusterRoles)..." - helm template analyticsengine-cluster ibm-charts/analyticsengine-cluster-scoped \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Waiting for analyticsengines.ae.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd analyticsengines.ae.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - echo "Installing analyticsengine namespace-scoped chart (operator + CR)..." - helm upgrade --install analyticsengine ibm-charts/analyticsengine \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --set analyticsengine.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 60m - restartPolicy: Never - serviceAccountName: cpd-sa - backoffLimit: 4 {{- end }} diff --git a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml index ab90517d4..310a6f214 100644 --- a/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml +++ b/instance-applications/120-ibm-spss/templates/01-ibm-spss-cr.yaml @@ -23,135 +23,4 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.spss_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" -{{- else }} ---- -# Persistent resource so ArgoCD has a stable non-hook object to track. -# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. -apiVersion: v1 -kind: ConfigMap -metadata: - name: ibm-spss-helm-install-config - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -data: - cpd_product_version: "{{ .Values.cpd_product_version }}" - install_method: "helm" ---- -# Helm-based installation for CPD 5.3.1+ -{{- $_job_name_prefix := "install-spss-helm" }} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} -{{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v6" }} -{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} -{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} -{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $_job_name }} - namespace: "{{ .Values.cpd_operators_namespace }}" - labels: - mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed -spec: - template: - spec: - containers: - - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} - command: - - /bin/sh - - -c - - | - set -e - helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm - helm repo update - - echo "Installing canvasbase cluster-scoped chart (CRDs + ClusterRoles)..." - helm template canvasbase-cluster ibm-charts/canvasbase-cluster-scoped \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Waiting for canvasbase.canvasbase.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "Canvasbase CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd canvasbase.canvasbase.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "Canvasbase CRD established." - break - fi - sleep 10 - done - - echo "Installing canvasbase namespace-scoped chart (operator + CR)..." - helm upgrade --install canvasbase ibm-charts/canvasbase \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --wait --timeout 60m - - echo "Installing spss cluster-scoped chart (CRDs + ClusterRoles)..." - helm template spss-cluster ibm-charts/spss-cluster-scoped \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Waiting for spss.spssmodeler.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd spss.spssmodeler.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - echo "Installing spss namespace-scoped chart (operator + CR)..." - helm upgrade --install spss ibm-charts/spss \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --set spss.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 60m - restartPolicy: Never - serviceAccountName: cpd-sa - backoffLimit: 4 {{- end }} diff --git a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml index 5a9acdfa7..1a544536d 100644 --- a/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml +++ b/instance-applications/120-ibm-wml/templates/02-ibm-wml-cr.yaml @@ -23,127 +23,4 @@ spec: scaleConfig: "{{ .Values.cpd_service_scale_config }}" version: "{{ .Values.wml_version }}" ccs_operand_version: "{{ .Values.ccs_version }}" -{{- else }} ---- -# Persistent resource so ArgoCD has a stable non-hook object to track. -# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. -apiVersion: v1 -kind: ConfigMap -metadata: - name: ibm-wml-helm-install-config - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -data: - cpd_product_version: "{{ .Values.cpd_product_version }}" - install_method: "helm" ---- -# Helm-based installation for CPD 5.3.1+ -{{- $_job_name_prefix := "install-wml-helm" }} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} -{{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v2" }} -{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} -{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $_job_name }} - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "092" - argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed - -spec: - template: - spec: - containers: - - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} - command: - - /bin/sh - - -c - - | - set -e - helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm - helm repo update - - echo "Installing ibm-redis-cp cluster-scoped chart (CRDs + ClusterRoles)..." - helm template ibm-redis-cp-cluster ibm-charts/ibm-redis-cp-cluster-scoped \ - --version 1.3.1 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Installing ibm-redis-cp namespace-scoped chart (operator)..." - helm upgrade --install ibm-redis-cp ibm-charts/ibm-redis-cp \ - --version 1.3.1 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key - - echo "Waiting for rediscps.redis.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "Rediscp CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd rediscps.redis.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "Rediscp CRD established." - break - fi - sleep 10 - done - - echo "Installing wml cluster-scoped chart (CRDs + ClusterRoles)..." - helm template wml-cluster ibm-charts/wml-cluster-scoped \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_operators_namespace }} \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.imagePullSecret=ibm-entitlement-key | oc apply -f - - - echo "Waiting for wmlbases.wml.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd wmlbases.wml.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - echo "Installing wml namespace-scoped chart (operator + CR)..." - helm upgrade --install wml ibm-charts/wml \ - --version 12.1.0 \ - --namespace {{ .Values.cpd_instance_namespace }} \ - --create-namespace \ - --set global.licenseAccept=true \ - --set global.releaseVersion={{ .Values.cpd_product_version }} \ - --set global.operatorNamespace={{ .Values.cpd_operators_namespace }} \ - --set global.instanceNamespace={{ .Values.cpd_instance_namespace }} \ - --set global.fileStorageClass={{ .Values.cpd_service_storage_class }} \ - --set global.blockStorageClass={{ .Values.cpd_service_block_storage_class }} \ - --set global.imagePullSecret=ibm-entitlement-key \ - --set wml.scaleConfig={{ .Values.cpd_service_scale_config }} \ - --wait --timeout 60m - restartPolicy: Never - serviceAccountName: cpd-sa - backoffLimit: 4 {{- end }} diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 9161ffffb..48c093f93 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -54,239 +54,4 @@ spec: ccs_operand_version: "{{ .Values.ccs_version }}" datarefinery_operand_version: "{{ .Values.datarefinery_version }}" wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" -{{- else }} ---- -# Persistent resource so ArgoCD has a stable non-hook object to track. -# Without this the app shows OutOfSync/Progressing after the Hook Job deletes itself. -apiVersion: v1 -kind: ConfigMap -metadata: - name: ibm-wsl-helm-install-config - namespace: "{{ .Values.cpd_operators_namespace }}" - annotations: - argocd.argoproj.io/sync-wave: "091" -data: - cpd_product_version: "{{ .Values.cpd_product_version }}" - install_method: "helm" ---- -# Helm-based installation for CPD 5.3.1+ -# Installs WSL and all its dependencies (opensearch, ccs, datarefinery, ws-runtimes) -# using IBM Helm charts. Each component requires a cluster-scoped chart (CRDs/ClusterRoles) -# followed by a namespace-scoped chart (Operator + CR). -{{- $_job_name_prefix := "install-wsl-helm" }} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} -{{- $_job_config_values := omit .Values "junitreporter" }} -{{- $_job_version := "v1" }} -{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} -{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} -{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $_job_name }} - namespace: "{{ .Values.cpd_operators_namespace }}" - labels: - mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} - annotations: - argocd.argoproj.io/sync-wave: "091" - argocd.argoproj.io/hook: Sync - argocd.argoproj.io/hook-delete-policy: HookSucceeded,HookFailed -spec: - template: - spec: - containers: - - name: helm-install - image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} - command: - - /bin/sh - - -c - - | - set -e - - HELM_REPO=ibm-charts - HELM_REPO_URL=https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm - OPERATORS_NS={{ .Values.cpd_operators_namespace }} - INSTANCE_NS={{ .Values.cpd_instance_namespace }} - FILE_SC={{ .Values.cpd_service_storage_class }} - BLOCK_SC={{ .Values.cpd_service_block_storage_class }} - SCALE={{ .Values.cpd_service_scale_config }} - CPD_VERSION={{ .Values.cpd_product_version }} - PULL_SECRET=ibm-entitlement-key - - echo "================================================================" - echo "Adding IBM Helm repository" - echo "================================================================" - helm repo add ${HELM_REPO} ${HELM_REPO_URL} || true - helm repo update - - # Shared values file used by all components - printf 'global:\n licenseAccept: true\n releaseVersion: %s\n operatorNamespace: %s\n instanceNamespace: %s\n fileStorageClass: %s\n blockStorageClass: %s\n imagePullSecret: %s\n imagePullPrefix: cp.icr.io\n' \ - "${CPD_VERSION}" "${OPERATORS_NS}" "${INSTANCE_NS}" "${FILE_SC}" "${BLOCK_SC}" "${PULL_SECRET}" \ - > /tmp/cpd-global-values.yaml - - install_component() { - local NAME=$1 - local CHART=$2 - local CLUSTER_CHART=$3 - local VERSION=$4 - local EXTRA_VALUES=$5 - - echo "================================================================" - echo "Installing ${NAME} (version ${VERSION})" - echo "================================================================" - - # 1. Cluster-scoped chart (CRDs, ClusterRoles) - echo " [${NAME}] Installing cluster-scoped chart..." - helm template ${NAME}-cluster ${HELM_REPO}/${CLUSTER_CHART} \ - --version ${VERSION} \ - -f /tmp/cpd-global-values.yaml \ - --namespace ${OPERATORS_NS} | oc apply -f - - - # Wait for all CRDs from the cluster-scoped chart to be established - # before running the namespace-scoped chart that depends on them. - echo " [${NAME}] Waiting for CRDs to be established..." - sleep 5 - oc wait crd --all --for=condition=Established --timeout=120s 2>/dev/null || true - - # 2. Namespace-scoped chart (Operator + CR) - echo " [${NAME}] Installing namespace-scoped chart..." - helm upgrade --install ${NAME} ${HELM_REPO}/${CHART} \ - --version ${VERSION} \ - -f /tmp/cpd-global-values.yaml \ - ${EXTRA_VALUES} \ - --namespace ${INSTANCE_NS} \ - --create-namespace \ - --wait --timeout 60m - } - - # ---------------------------------------------------------------- - # Step 1: OpenSearch (dependency) - # ---------------------------------------------------------------- - install_component \ - "opencontent-opensearch" \ - "opencontent-opensearch" \ - "opencontent-opensearch-cluster-scoped" \ - "1.2.0" - - echo "Waiting for clusters.opensearch.cloudpackopen.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 300 ]; then - echo "CRD not established after 5 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd clusters.opensearch.cloudpackopen.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - # ---------------------------------------------------------------- - # Step 2: CCS - Common Core Services (dependency) - # ---------------------------------------------------------------- - install_component \ - "ccs" \ - "ccs" \ - "ccs-cluster-scoped" \ - "12.1.0" \ - "--set ccs.scaleConfig=${SCALE}" - - # In CPD 5.3.1 Helm mode the namespace-scoped chart only deploys the - # operator; the CCS CR must be created explicitly with non_olm_deploy=true - # so the operator reconciles the actual CCS instance. - echo "Creating ccs-cr (non_olm_deploy=true) if not already present..." - printf 'apiVersion: ccs.cpd.ibm.com/v1beta1\nkind: CCS\nmetadata:\n name: ccs-cr\n namespace: %s\nspec:\n license:\n accept: true\n license: Standard\n imagePullSecret: %s\n fileStorageClass: %s\n blockStorageClass: %s\n scaleConfig: %s\n non_olm_deploy: true\n' \ - "${INSTANCE_NS}" "${PULL_SECRET}" "${FILE_SC}" "${BLOCK_SC}" "${SCALE}" \ - > /tmp/ccs-cr.yaml - oc apply -f /tmp/ccs-cr.yaml - - # Wait for CCS CR to reach Completed status - echo "Waiting for CCS CR to be ready..." - wait_period=0 - while true; do - wait_period=$((wait_period+30)) - if [ $wait_period -gt 3600 ]; then - echo "CCS CR not ready after 60 minutes. Exiting." - exit 1 - fi - CCS_STATUS=$(oc get ccs ccs-cr -n ${INSTANCE_NS} \ - -o jsonpath='{.status.ccsStatus}' \ - --ignore-not-found 2>/dev/null) - if [ "${CCS_STATUS}" = "Completed" ]; then - echo "CCS CR is ready." - break - fi - echo " CCS status: '${CCS_STATUS:-not found}' - waiting 30s..." - sleep 30 - done - - # ---------------------------------------------------------------- - # Step 3: DataRefinery (dependency) - # ---------------------------------------------------------------- - install_component \ - "datarefinery" \ - "datarefinery" \ - "datarefinery-cluster-scoped" \ - "12.1.0" - - echo "Waiting for datarefinery.datarefinery.cpd.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 1200 ]; then - echo "CRD not established after 20 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd datarefinery.datarefinery.cpd.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - # ---------------------------------------------------------------- - # Step 4: WS Runtimes (dependency) - # ---------------------------------------------------------------- - install_component \ - "ws-runtimes" \ - "ws-runtimes" \ - "ws-runtimes-cluster-scoped" \ - "12.1.0" - - echo "Waiting for runtimeassemblies.runtimes.ibm.com CRD to be established..." - wait_period=0 - while true; do - wait_period=$((wait_period+10)) - if [ $wait_period -gt 1200 ]; then - echo "CRD not established after 20 minutes. Exiting." - exit 1 - fi - STATUS=$(oc get crd runtimeassemblies.runtimes.ibm.com -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' --ignore-not-found 2>/dev/null) - if [ "$STATUS" = "True" ]; then - echo "CRD established." - break - fi - sleep 10 - done - - # ---------------------------------------------------------------- - # Step 5: Watson Studio (main component) - # ---------------------------------------------------------------- - install_component \ - "wsl" \ - "ws" \ - "ws-cluster-scoped" \ - "12.1.0" \ - "--set ws.scaleConfig=${SCALE}" - - echo "================================================================" - echo "WSL installation complete" - echo "================================================================" - restartPolicy: Never - serviceAccountName: cpd-sa - backoffLimit: 4 {{- end }} From 4271b8f16e9742bde5539334f564c723fffbd881 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 21 Aug 2026 01:56:15 +0530 Subject: [PATCH 080/103] feat(wml): add post-verify job for CPD >= 5.3.1 For CPD >= 5.3.1 the native ArgoCD Helm App (wave 122) installs the WML Helm chart but there is no mechanism to confirm the WmlBase CR reaches Completed status and to surface WML credentials to AWS Secrets Manager. This commit adds: - instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml A Job (gated >= 5.3.1) that polls WmlBase wml-cr until wmlStatus=Completed, then writes url/username/password to SM path ///wml-cp4d. RBAC (SA, Role, RoleBinding) is scoped to cpd_operators_namespace and cpd_instance_namespace following the WSL post-verify pattern. - root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml Wave-123 ArgoCD Application (wml-post-verify..) using the AVP plugin to inject SM credentials into the post-verify Job. Renders only for CPD >= 5.3.1 (inside the existing $is531 block). - instance-applications/120-ibm-wml/values.yaml Added account_id, region_id, cluster_id, instance_id, sm_aws_access_key_id, sm_aws_secret_access_key, cli_image_repo keys consumed by the post-verify job. --- .../templates/03-ibm-wml-post-verify.yaml | 331 ++++++++++++++++++ instance-applications/120-ibm-wml/values.yaml | 8 + .../templates/120-ibm-wml-app.yaml | 88 +++++ 3 files changed, 427 insertions(+) create mode 100644 instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml diff --git a/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml b/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml new file mode 100644 index 000000000..42a627a25 --- /dev/null +++ b/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml @@ -0,0 +1,331 @@ +{{- if not (lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0) }} +{{- /* +Meaningful prefix for the job resource name. Must be under 52 chars in length to leave room for the 11 chars reserved for '-' and $_job_hash. +*/}} +{{- $_job_name_prefix := "cpd-wml-post-verify" }} + +{{- /* +Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. +Included in $_job_hash (see below). +*/}} +{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} + +{{- /* +A dict of values that influence the behaviour of the job in some way. +Any changes to values in this dict will trigger a rerun of the job. +Since jobs must be idemopotent, it's generally safe to pass in values here that are not +strictly necessary (i.e. including some values that don't actually influence job behaviour). +We may want to refine this further though for jobs that can take a long time to complete. +Included in $_job_hash (see below). +*/}} +{{- $_job_config_values := omit .Values "junitreporter" }} + +{{- /* +Increment this value whenever you make a change to an immutable field of the Job resource. +E.g. passing in a new environment variable. +Included in $_job_hash (see below). +*/}} +{{- $_job_version := "v1" }} + +{{- /* +10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest +This is to ensure ArgoCD will create a new job resource intead of attempting (and failing) to update an +immutable field of any existing Job resource. +*/}} +{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} + +{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash )}} + + +{{- /* +Set as the value for the mas.ibm.com/job-cleanup-group label on the Job resource. + +When the auto_delete flag is not set on the root application, a CronJob in the cluster uses this label +to identify old Job resources that should be pruned on behalf of ArgoCD. + +Any Job resources in the same namespace that have the mas.ibm.com/job-cleanup-group with this value +will be considered to belong to the same cleanup group. All but the most recent (i.e. with the latest "creation_timestamp") +Jobs will be automatically deleted. + +$_job_cleanup_group can usually just be based on $_job_name_prefix. There are some special cases +where multiple Jobs are created in our templates using a Helm loop. In those cases, additional descriminators +must be added to $_job_cleanup_group. + +By convention, we sha1sum this value to guarantee we never exceed the 63 char limit regardless of which discriminators +are required here. + +*/}} +{{- $_job_cleanup_group := cat $_job_name_prefix | sha1sum }} + +--- +kind: ServiceAccount +apiVersion: v1 +metadata: + name: wml-postverify-sa + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} + +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: wml-postverify-role-{{ .Values.instance_id }} + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +rules: + - verbs: + - get + - list + apiGroups: + - '' + resources: + - secrets + +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: wml-postverify-rb-{{ .Values.instance_id }} + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "093" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +subjects: + - kind: ServiceAccount + name: wml-postverify-sa + namespace: "{{ .Values.cpd_operators_namespace }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: wml-postverify-role-{{ .Values.instance_id }} + +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: wml-postverify-role-instance-{{ .Values.instance_id }} + namespace: "{{ .Values.cpd_instance_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "092" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +rules: + - verbs: + - get + - list + apiGroups: + - '' + resources: + - secrets + - verbs: + - get + - list + apiGroups: + - zen.cpd.ibm.com + resources: + - zenservices + - verbs: + - get + apiGroups: + - wml.cpd.ibm.com + resources: + - wmlbases + +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: wml-postverify-rb-instance-{{ .Values.instance_id }} + namespace: "{{ .Values.cpd_instance_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "093" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +subjects: + - kind: ServiceAccount + name: wml-postverify-sa + namespace: "{{ .Values.cpd_operators_namespace }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: wml-postverify-role-instance-{{ .Values.instance_id }} + + +--- +kind: Secret +apiVersion: v1 +metadata: + name: aws + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "093" +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +stringData: + aws_access_key_id: {{ .Values.sm_aws_access_key_id }} + aws_secret_access_key: {{ .Values.sm_aws_secret_access_key }} +type: Opaque + +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ $_job_name }} + namespace: "{{ .Values.cpd_operators_namespace }}" + annotations: + argocd.argoproj.io/sync-wave: "094" + labels: + mas.ibm.com/job-cleanup-group: {{ $_job_cleanup_group }} +{{- if .Values.custom_labels }} +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + template: +{{- if .Values.custom_labels }} + metadata: + labels: +{{ .Values.custom_labels | toYaml | indent 8 }} +{{- end }} + spec: + containers: + - name: run + image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} + imagePullPolicy: IfNotPresent + resources: + limits: + cpu: 200m + memory: 512Mi + requests: + cpu: 10m + memory: 64Mi + env: + - name: CPD_INSTANCE_NAMESPACE + value: {{ .Values.cpd_instance_namespace }} + - name: ACCOUNT_ID + value: {{ .Values.account_id }} + - name: REGION_ID + value: {{ .Values.region_id }} + - name: CLUSTER_ID + value: {{ .Values.cluster_id }} + - name: INSTANCE_ID + value: {{ .Values.instance_id }} + # Hard-coded for now: + - name: AVP_TYPE + value: "aws" + volumeMounts: + - name: aws + mountPath: /etc/mas/creds/aws + command: + - /bin/sh + - -c + - | + + set -e + echo + echo "================================================================================" + echo "WML Post-Verify: Waiting for WmlBase CR to reach Completed status" + echo "================================================================================" + + POLL_INTERVAL=30 + MAX_WAIT=3600 # 60 minutes + + elapsed=0 + while true; do + STATUS=$(oc get wmlbase wml-cr -n ${CPD_INSTANCE_NAMESPACE} --ignore-not-found \ + -o jsonpath='{.status.wmlStatus}' 2>/dev/null || true) + echo " WmlBase wml-cr status: '${STATUS}' (${elapsed}s elapsed)" + + if [[ "${STATUS}" == "Completed" ]]; then + echo " WmlBase is Completed." + break + fi + + if [[ ${elapsed} -ge ${MAX_WAIT} ]]; then + echo " ERROR: Timed out after ${MAX_WAIT}s waiting for WmlBase to reach Completed." + exit 1 + fi + + sleep ${POLL_INTERVAL} + elapsed=$((elapsed + POLL_INTERVAL)) + done + + echo + echo "================================================================================" + echo "WML Post-Verify: Writing WML credentials to Secrets Manager" + echo "================================================================================" + + echo "Lookup Cloud Pak for Data admin username" + USERNAME=$(oc get secret ibm-iam-bindinfo-platform-auth-idp-credentials -n ${CPD_INSTANCE_NAMESPACE} --ignore-not-found -o json | jq -r '.data.admin_username' | base64 -d) + + if [[ -z ${USERNAME} ]]; then + export CPD_ADMIN_USERNAME="admin" + export SECRET_NAME="admin-user-details" + export ADMIN_PASSWORD_PROPERTY="initial_admin_password" + else + export CPD_ADMIN_USERNAME="cpadmin" + export SECRET_NAME="ibm-iam-bindinfo-platform-auth-idp-credentials" + export ADMIN_PASSWORD_PROPERTY="admin_password" + fi + + echo "Lookup Cloud Pak for Data admin password" + CPD_ADMIN_PASSWORD=$(oc get secret $SECRET_NAME -n ${CPD_INSTANCE_NAMESPACE} -o json | jq -r ".data.${ADMIN_PASSWORD_PROPERTY}" | base64 -d) + + echo "Lookup Cloud Pak for Data admin url" + URL=$(oc get ZenService lite-cr -o jsonpath="{.status.url}{'\n'}" -n ${CPD_INSTANCE_NAMESPACE}) + + if [[ -z ${URL} || -z ${CPD_ADMIN_USERNAME} || -z ${CPD_ADMIN_PASSWORD} ]]; then + echo "CPD admin username/password/url details are missing, please check your Cloud Pak For Data instance health!" + exit 1 + fi + + CPD_ADMIN_URL="https://${URL}" + + echo + echo "================================================================================" + echo "Debug Cloud Pak for Data Admin details" + echo "================================================================================" + echo "- CP4D Dashboard ......................... ${CPD_ADMIN_URL}" + echo "- CP4D Admin Username .................... ${CPD_ADMIN_USERNAME}" + echo "- CP4D Admin Password .................... ${CPD_ADMIN_PASSWORD:0:2}" + + source /mascli/functions/gitops_utils + SM_AWS_ACCESS_KEY_ID=$(cat /etc/mas/creds/aws/aws_access_key_id) + SM_AWS_SECRET_ACCESS_KEY=$(cat /etc/mas/creds/aws/aws_secret_access_key) + export SM_AWS_REGION=${REGION_ID} + sm_login + + SECRET_NAME_WML=${ACCOUNT_ID}/${CLUSTER_ID}/${INSTANCE_ID}/wml-cp4d + TAGS="[{\"Key\": \"source\", \"Value\": \"cpd-wml-post-verify\"}, {\"Key\": \"account\", \"Value\": \"${ACCOUNT_ID}\"}, {\"Key\": \"cluster\", \"Value\": \"${CLUSTER_ID}\"}]" + sm_update_secret $SECRET_NAME_WML "{\"url\": \"$CPD_ADMIN_URL\", \"username\": \"$CPD_ADMIN_USERNAME\", \"password\": \"$CPD_ADMIN_PASSWORD\" }" "${TAGS}" + + echo "Done" + + restartPolicy: Never + serviceAccountName: wml-postverify-sa + volumes: + - name: aws + secret: + secretName: aws + defaultMode: 420 + optional: false + backoffLimit: 4 +{{- end }} diff --git a/instance-applications/120-ibm-wml/values.yaml b/instance-applications/120-ibm-wml/values.yaml index 1cae71e22..cf97cc949 100644 --- a/instance-applications/120-ibm-wml/values.yaml +++ b/instance-applications/120-ibm-wml/values.yaml @@ -10,3 +10,11 @@ cpd_product_version: "" # When empty, versions are read from olm-utils-cm (deployed by wave 110). wml_chart_version: "" redis_chart_version: "" +# Post-verify job (CPD >= 5.3.1 only) — AWS Secrets Manager credentials +account_id: "" +region_id: "" +cluster_id: "" +instance_id: "" +sm_aws_access_key_id: "" +sm_aws_secret_access_key: "" +cli_image_repo: "" diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml index bbaaa771e..c7a18393e 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml @@ -282,5 +282,93 @@ spec: limit: 20 syncOptions: - CreateNamespace=true +--- +# Wave 123: WML post-verify (polls WmlBase CR to Completed, writes wml-cp4d secret to SM) +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wml-post-verify.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "123" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + ignoreDifferences: + - group: '*' + kind: ServiceAccount + jsonPointers: + - /imagePullSecrets + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + repoURL: "{{ .Values.source.repo_url }}" + path: instance-applications/120-ibm-wml + targetRevision: "{{ .Values.source.revision }}" + plugin: + name: {{ .Values.avp.name }} + env: + - name: {{ .Values.avp.values_varname }} + value: | + account_id: "{{ .Values.account.id }}" + region_id: "{{ .Values.region.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + cli_image_repo: {{ .Values.cli_image_repo }} + cluster_admin_role: {{ .Values.cluster_admin_role }} + application_admin_role: {{ .Values.application_admin_role }} + sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" + sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" + cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" + cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" + cpd_service_storage_class: "{{ .Values.ibm_wml.cpd_service_storage_class }}" + cpd_service_block_storage_class: "{{ .Values.ibm_wml.cpd_service_block_storage_class }}" + cpd_service_scale_config: "{{ .Values.ibm_wml.cpd_service_scale_config }}" + wml_channel: "{{ .Values.ibm_wml.wml_channel }}" + wml_version: "{{ .Values.ibm_wml.wml_version }}" + wml_install_plan: "{{ .Values.ibm_wml.wml_install_plan }}" + {{- if .Values.custom_labels }} + custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} + {{- end }} + junitreporter: + reporter_name: "ibm-wml-{{ .Values.instance.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" + devops_build_number: "{{ .Values.devops.build_number }}" + gitops_version: "{{ .Values.source.revision }}" + cli_image_repo: {{ .Values.cli_image_repo }} + - name: ARGOCD_APP_NAME + value: cpdwmlpostverify + {{- if not (empty .Values.avp.secret) }} + - name: AVP_SECRET + value: {{ .Values.avp.secret }} + {{- end }} + syncPolicy: + automated: + {{- if .Values.auto_delete }} + prune: true + {{- end }} + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=false + - RespectIgnoreDifferences=true {{- end }} {{- end }} From 381f26c49bc0ad559d44862355ea7f150ba8f81b Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 21 Aug 2026 02:24:47 +0530 Subject: [PATCH 081/103] fix(cognos): ignoreDifferences for CAService operator-mutated fields The cognos-analytics Helm chart renders a CAService CR. The operator immediately mutates spec.license (adding license: Enterprise) and adds spec.enableInstanaMetricCollection: false. ArgoCD sees these as drift and keeps the app OutOfSync. Add ignoreDifferences for both fields plus ServiceAccount/imagePullSecrets (standard pattern across all service apps). Add RespectIgnoreDifferences to syncOptions so ArgoCD applies the exclusions during sync. --- .../templates/120-ibm-cognos-analytics-app.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index 0a3ff9675..df8963b6b 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -83,6 +83,16 @@ metadata: finalizers: - resources-finalizer.argocd.argoproj.io spec: + ignoreDifferences: + - group: ca.cpd.ibm.com + kind: CAService + jsonPointers: + - /spec/license/license + - /spec/enableInstanaMetricCollection + - group: '*' + kind: ServiceAccount + jsonPointers: + - /imagePullSecrets project: "{{ .Values.argo.projects.apps }}" destination: server: {{ .Values.cluster.url }} @@ -110,4 +120,5 @@ spec: limit: 20 syncOptions: - CreateNamespace=true + - RespectIgnoreDifferences=true {{- end }} From c2f7ac35ab09bbfb9c0c47a2949a5503f91c4a80 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 10:51:27 +0530 Subject: [PATCH 082/103] error handling checks added --- .../08-postsync-db2-audit-policy_Job.yaml | 30 ++++++++++++------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index 53fb1e6d5..e11628658 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -22,7 +22,7 @@ Use the build/bin/set-cli-image-digest.sh script to update this value across all {{- /* Increment this value whenever you make a change to an immutable field of the Job resource. */}} -{{- $_job_version := "v1" }} +{{- $_job_version := "v3" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} @@ -101,19 +101,29 @@ spec: echo 'Connecting to database ${DB2_DBNAME}' db2 connect to ${DB2_DBNAME} - echo 'Creating audit policy USER_AUDIT (instance-level)' - db2 \"CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL\" || echo 'Audit policy USER_AUDIT already exists, continuing' - - echo 'Creating MAXIMO_READ and MAXIMO_WRITE roles' - db2 \"CREATE ROLE MAXIMO_READ\" || echo 'Role MAXIMO_READ already exists, continuing' - db2 \"CREATE ROLE MAXIMO_WRITE\" || echo 'Role MAXIMO_WRITE already exists, continuing' + echo 'Checking if USER_AUDIT policy already exists' + POLICY_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='USER_AUDIT'\" | tr -d ' ') + if [ \"\$POLICY_EXISTS\" -eq \"0\" ]; then + echo 'Creating USER_AUDIT policy...' + db2 \"CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL\" + echo 'USER_AUDIT policy created successfully' + else + echo 'USER_AUDIT policy already exists, skipping' + fi echo 'Applying USER_AUDIT policy to MAXIMO_READ and MAXIMO_WRITE roles' - db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" - db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" + ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_READ'\" | tr -d ' ') + ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_WRITE'\" | tr -d ' ') + if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then + db2 \"AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to MAXIMO roles, skipping' + echo 'Audit policy USER_AUDIT applied to MAXIMO_READ and MAXIMO_WRITE' + else + echo 'MAXIMO roles not found, skipping role audit policy assignment' + fi echo 'Applying USER_AUDIT policy to db2inst1 user' - db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" + db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to db2inst1, skipping' + echo 'Audit policy USER_AUDIT applied to db2inst1' echo '' echo '========================================' From 25264425b2b0ec4a7dfcad93f771549ea8c48eda Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 13:13:30 +0530 Subject: [PATCH 083/103] add audit for facilities --- .../08-postsync-db2-audit-policy_Job.yaml | 148 ++++++++++-------- 1 file changed, 85 insertions(+), 63 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index e11628658..8e4b65d76 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -4,25 +4,42 @@ Audit policy setup job for DB2. Runs per-application audit policy commands on the db2u pod after the main postsync setup job (sync-wave 129) has completed. -Currently supported: manage +Common to all applications: + - Create USER_AUDIT policy if not exists + - AUDIT USER db2inst1 USING POLICY USER_AUDIT + +Per-application role audit (only if roles already exist): + - manage : AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT + - facilities: AUDIT ROLE TRIRIGA_READ, ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT */}} {{- if .Values.should_execute }} {{- if not (contains "sdb" .Values.db2_instance_name) }} -{{- $_job_name_prefix := "postsync-db2-audit-policy" }} +{{- /* +Meaningful prefix for the job resource name. Must be under 52 chars in length to leave room for the 11 chars reserved for '-' and $_job_hash. +*/}} +{{- $_job_name_prefix := "postsync-audit-policy" }} {{- /* Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. +Included in $_job_hash (see below). */}} {{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- /* +A dict of values that influence the behaviour of the job in some way. +Any changes to values in this dict will trigger a rerun of the job. +Included in $_job_hash (see below). +*/}} {{- $_job_config_values := omit .Values "junitreporter" }} {{- /* Increment this value whenever you make a change to an immutable field of the Job resource. +E.g. passing in a new environment variable. +Included in $_job_hash (see below). */}} -{{- $_job_version := "v3" }} +{{- $_job_version := "v1" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} @@ -54,7 +71,6 @@ spec: - name: run image: {{ .Values.cli_image_repo | default "quay.io/ibmmas/cli" }}@{{ $_cli_image_digest }} imagePullPolicy: IfNotPresent - resources: limits: cpu: 200m @@ -62,17 +78,15 @@ spec: requests: cpu: 10m memory: 64Mi - env: - - name: MAS_APP_ID - value: {{ .Values.mas_application_id }} - name: DB2_NAMESPACE value: "{{ .Values.db2_namespace }}" - name: DB2_INSTANCE_NAME value: "{{ .Values.db2_instance_name }}" - name: DB2_DBNAME value: "{{ .Values.db2_dbname }}" - + - name: MAS_APP_ID + value: "{{ .Values.mas_application_id }}" command: - /bin/sh - -c @@ -82,76 +96,84 @@ spec: DB2_POD="c-${DB2_INSTANCE_NAME}-db2u-0" - # ============================================================ - # Audit policy: manage - # ============================================================ - if [ "$MAS_APP_ID" = "manage" ]; then - - echo "" - echo "================================================================================" - echo "Setting up DB2 audit policy for Manage" - echo "================================================================================" - - # All DB2 commands run in a single oc exec so the database - # connection established by 'db2 connect' is shared across - # every subsequent statement in the same session. - oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- su -lc " - set -e - - echo 'Connecting to database ${DB2_DBNAME}' - db2 connect to ${DB2_DBNAME} - - echo 'Checking if USER_AUDIT policy already exists' - POLICY_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='USER_AUDIT'\" | tr -d ' ') - if [ \"\$POLICY_EXISTS\" -eq \"0\" ]; then - echo 'Creating USER_AUDIT policy...' - db2 \"CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL\" - echo 'USER_AUDIT policy created successfully' - else - echo 'USER_AUDIT policy already exists, skipping' - fi - - echo 'Applying USER_AUDIT policy to MAXIMO_READ and MAXIMO_WRITE roles' + echo "" + echo "================================================================================" + echo "DB2 Audit Policy Setup" + echo "================================================================================" + echo "DB2_NAMESPACE ....................... ${DB2_NAMESPACE}" + echo "DB2_INSTANCE_NAME ................... ${DB2_INSTANCE_NAME}" + echo "DB2_DBNAME .......................... ${DB2_DBNAME}" + echo "MAS_APP_ID .......................... ${MAS_APP_ID}" + + # All DB2 commands run in a single oc exec so the database + # connection established by 'db2 connect' is shared across + # every subsequent statement in the same session. + oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- su -lc " + set -e + + echo 'Connecting to database ${DB2_DBNAME}' + db2 connect to ${DB2_DBNAME} + + # ---------------------------------------------------------------- + # Create USER_AUDIT policy if it does not already exist (common) + # ---------------------------------------------------------------- + echo 'Checking USER_AUDIT policy...' + POLICY_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='USER_AUDIT'\" | tr -d ' ') + if [ \"\$POLICY_EXISTS\" -eq \"0\" ]; then + echo 'Creating USER_AUDIT policy...' + db2 \"CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL\" + echo 'USER_AUDIT policy created successfully' + else + echo 'USER_AUDIT policy already exists, skipping' + fi + + # ---------------------------------------------------------------- + # Per-application role audit (manage and facilities only) + # ---------------------------------------------------------------- + if [ \"${MAS_APP_ID}\" = \"manage\" ]; then + echo 'Applying USER_AUDIT policy to MAXIMO_READ and MAXIMO_WRITE roles...' ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_READ'\" | tr -d ' ') ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then db2 \"AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to MAXIMO roles, skipping' echo 'Audit policy USER_AUDIT applied to MAXIMO_READ and MAXIMO_WRITE' else - echo 'MAXIMO roles not found, skipping role audit policy assignment' + echo 'MAXIMO_READ/MAXIMO_WRITE roles not found, skipping role audit policy assignment' fi + fi - echo 'Applying USER_AUDIT policy to db2inst1 user' - db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to db2inst1, skipping' - echo 'Audit policy USER_AUDIT applied to db2inst1' - - echo '' - echo '========================================' - echo 'Verifying audit policy setup' - echo '========================================' - - echo 'Users and roles assigned to USER_AUDIT:' - db2 \"SELECT * FROM SYSCAT.AUDITUSE WHERE AUDITPOLICYNAME='USER_AUDIT'\" - - echo 'Audit policy categories for USER_AUDIT:' - db2 \"SELECT AUDITPOLICYNAME, VALIDATESTATUS, EXECUTESTATUS FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='USER_AUDIT'\" + if [ \"${MAS_APP_ID}\" = \"facilities\" ]; then + echo 'Applying USER_AUDIT policy to TRIRIGA_READ and TRIRIGA_WRITE roles...' + ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_READ'\" | tr -d ' ') + ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_WRITE'\" | tr -d ' ') + if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then + db2 \"AUDIT ROLE TRIRIGA_READ, ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to TRIRIGA roles, skipping' + echo 'Audit policy USER_AUDIT applied to TRIRIGA_READ and TRIRIGA_WRITE' + else + echo 'TRIRIGA_READ/TRIRIGA_WRITE roles not found, skipping role audit policy assignment' + fi + fi - db2 connect reset - echo 'Audit policy setup complete' - " db2inst1 || exit $? + # ---------------------------------------------------------------- + # Assign USER_AUDIT policy to db2inst1 user (common) + # ---------------------------------------------------------------- + echo 'Applying USER_AUDIT policy to db2inst1 user...' + db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to db2inst1, skipping' + echo 'Audit policy USER_AUDIT applied to db2inst1' - echo "" - echo "================================================================================" - echo "DB2 audit policy setup completed successfully for Manage" - echo "================================================================================" + db2 connect reset + echo 'Audit policy setup complete' + " db2inst1 || exit $? - fi + echo "" + echo "================================================================================" + echo "DB2 audit policy setup completed successfully" + echo "================================================================================" restartPolicy: Never serviceAccountName: "postsync-sa-{{ .Values.db2_instance_name }}" - backoffLimit: 4 {{- end }} {{- end }} -{{- end }} \ No newline at end of file +{{- end }} From 2cc40b2c4b7a7ced2032d4738a5c0a1d53740ea8 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 13:48:24 +0530 Subject: [PATCH 084/103] update echo --- .../08-postsync-db2-audit-policy_Job.yaml | 137 +++++++++++++----- 1 file changed, 100 insertions(+), 37 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index 8e4b65d76..20880ef90 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -98,12 +98,15 @@ spec: echo "" echo "================================================================================" - echo "DB2 Audit Policy Setup" + echo " DB2 AUDIT POLICY SETUP" echo "================================================================================" - echo "DB2_NAMESPACE ....................... ${DB2_NAMESPACE}" - echo "DB2_INSTANCE_NAME ................... ${DB2_INSTANCE_NAME}" - echo "DB2_DBNAME .......................... ${DB2_DBNAME}" - echo "MAS_APP_ID .......................... ${MAS_APP_ID}" + echo "" + echo "Configuration" + echo "--------------------------------------------------------------------------------" + echo "DB2 Namespace : ${DB2_NAMESPACE}" + echo "DB2 Instance : ${DB2_INSTANCE_NAME}" + echo "Database : ${DB2_DBNAME}" + echo "MAS Application : ${MAS_APP_ID}" # All DB2 commands run in a single oc exec so the database # connection established by 'db2 connect' is shared across @@ -111,63 +114,123 @@ spec: oc exec -n "${DB2_NAMESPACE}" "${DB2_POD}" -- su -lc " set -e - echo 'Connecting to database ${DB2_DBNAME}' + echo '' + echo '--------------------------------------------------------------------------------' + echo '[1/4] Database Connection' + echo '--------------------------------------------------------------------------------' + echo \"Connecting to database '${DB2_DBNAME}'...\" db2 connect to ${DB2_DBNAME} - - # ---------------------------------------------------------------- - # Create USER_AUDIT policy if it does not already exist (common) - # ---------------------------------------------------------------- - echo 'Checking USER_AUDIT policy...' + echo '[OK] Database connection successful.' + + echo '' + echo '--------------------------------------------------------------------------------' + echo '[2/4] USER_AUDIT Policy' + echo '--------------------------------------------------------------------------------' + echo \"Checking whether audit policy 'USER_AUDIT' exists...\" + echo '' POLICY_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITPOLICIES WHERE AUDITPOLICYNAME='USER_AUDIT'\" | tr -d ' ') if [ \"\$POLICY_EXISTS\" -eq \"0\" ]; then - echo 'Creating USER_AUDIT policy...' + echo \"[CREATE] USER_AUDIT policy does not exist - creating...\" db2 \"CREATE AUDIT POLICY USER_AUDIT CATEGORIES VALIDATE STATUS BOTH, EXECUTE WITHOUT DATA STATUS BOTH ERROR TYPE NORMAL\" - echo 'USER_AUDIT policy created successfully' + echo '[OK] USER_AUDIT policy created.' else - echo 'USER_AUDIT policy already exists, skipping' + echo '[SKIP] USER_AUDIT policy already exists.' + echo ' No changes required.' fi - # ---------------------------------------------------------------- - # Per-application role audit (manage and facilities only) - # ---------------------------------------------------------------- + echo '' + echo '--------------------------------------------------------------------------------' + echo '[3/4] USER_AUDIT Role Assignments' + echo '--------------------------------------------------------------------------------' + echo 'Checking USER_AUDIT assignment to roles:' + echo '' if [ \"${MAS_APP_ID}\" = \"manage\" ]; then - echo 'Applying USER_AUDIT policy to MAXIMO_READ and MAXIMO_WRITE roles...' ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_READ'\" | tr -d ' ') ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then - db2 \"AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to MAXIMO roles, skipping' - echo 'Audit policy USER_AUDIT applied to MAXIMO_READ and MAXIMO_WRITE' + ROLE_READ_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='MAXIMO_READ'\" | tr -d ' ') + echo ' - MAXIMO_READ' + if [ \"\$ROLE_READ_AUDIT_EXISTS\" -eq \"0\" ]; then + db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" + echo ' [OK] USER_AUDIT assigned.' + else + echo ' [SKIP] Already assigned.' + fi + ROLE_WRITE_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='MAXIMO_WRITE'\" | tr -d ' ') + echo ' - MAXIMO_WRITE' + if [ \"\$ROLE_WRITE_AUDIT_EXISTS\" -eq \"0\" ]; then + db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" + echo ' [OK] USER_AUDIT assigned.' + else + echo ' [SKIP] Already assigned.' + fi else - echo 'MAXIMO_READ/MAXIMO_WRITE roles not found, skipping role audit policy assignment' + echo ' [SKIP] MAXIMO_READ/MAXIMO_WRITE roles not found - skipping role audit.' fi - fi - - if [ \"${MAS_APP_ID}\" = \"facilities\" ]; then - echo 'Applying USER_AUDIT policy to TRIRIGA_READ and TRIRIGA_WRITE roles...' + ROLE_LABEL='MAXIMO_READ, MAXIMO_WRITE' + elif [ \"${MAS_APP_ID}\" = \"facilities\" ]; then ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_READ'\" | tr -d ' ') ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then - db2 \"AUDIT ROLE TRIRIGA_READ, ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to TRIRIGA roles, skipping' - echo 'Audit policy USER_AUDIT applied to TRIRIGA_READ and TRIRIGA_WRITE' + ROLE_READ_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='TRIRIGA_READ'\" | tr -d ' ') + echo ' - TRIRIGA_READ' + if [ \"\$ROLE_READ_AUDIT_EXISTS\" -eq \"0\" ]; then + db2 \"AUDIT ROLE TRIRIGA_READ USING POLICY USER_AUDIT\" + echo ' [OK] USER_AUDIT assigned.' + else + echo ' [SKIP] Already assigned.' + fi + ROLE_WRITE_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='TRIRIGA_WRITE'\" | tr -d ' ') + echo ' - TRIRIGA_WRITE' + if [ \"\$ROLE_WRITE_AUDIT_EXISTS\" -eq \"0\" ]; then + db2 \"AUDIT ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" + echo ' [OK] USER_AUDIT assigned.' + else + echo ' [SKIP] Already assigned.' + fi else - echo 'TRIRIGA_READ/TRIRIGA_WRITE roles not found, skipping role audit policy assignment' + echo ' [SKIP] TRIRIGA_READ/TRIRIGA_WRITE roles not found - skipping role audit.' fi + ROLE_LABEL='TRIRIGA_READ, TRIRIGA_WRITE' + else + ROLE_LABEL='N/A' + echo ' [SKIP] No role audit configured for this application.' fi - - # ---------------------------------------------------------------- - # Assign USER_AUDIT policy to db2inst1 user (common) - # ---------------------------------------------------------------- - echo 'Applying USER_AUDIT policy to db2inst1 user...' - db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" || echo 'Audit policy already applied to db2inst1, skipping' - echo 'Audit policy USER_AUDIT applied to db2inst1' + echo '' + echo '[OK] USER_AUDIT role assignments verified.' + + echo '' + echo '--------------------------------------------------------------------------------' + echo '[4/4] USER_AUDIT User Assignment' + echo '--------------------------------------------------------------------------------' + echo 'Checking USER_AUDIT assignment to user:' + echo '' + USER_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='U' AND OBJECTNAME='DB2INST1'\" | tr -d ' ') + echo ' - DB2INST1' + if [ \"\$USER_AUDIT_EXISTS\" -eq \"0\" ]; then + db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" + echo ' [OK] USER_AUDIT assigned.' + else + echo ' [SKIP] Already assigned.' + fi + echo '' + echo '[OK] USER_AUDIT user assignment verified.' db2 connect reset - echo 'Audit policy setup complete' + + echo '' + echo '--------------------------------------------------------------------------------' + echo ' AUDIT CONFIGURATION SUMMARY' + echo '--------------------------------------------------------------------------------' + echo \"Audit Policy : USER_AUDIT\" + echo \"Roles : \${ROLE_LABEL}\" + echo \"User : DB2INST1\" + echo '' " db2inst1 || exit $? echo "" echo "================================================================================" - echo "DB2 audit policy setup completed successfully" + echo " DB2 AUDIT POLICY SETUP COMPLETE" echo "================================================================================" restartPolicy: Never From 55ebc10b3fe2968056ebe92e716485388a9c25b5 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 14:07:20 +0530 Subject: [PATCH 085/103] Update 08-postsync-db2-audit-policy_Job.yaml --- .../08-postsync-db2-audit-policy_Job.yaml | 52 ++++++------------- 1 file changed, 16 insertions(+), 36 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index 20880ef90..2ae56c38b 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -39,7 +39,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v1" }} +{{- $_job_version := "v2" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} @@ -148,22 +148,14 @@ spec: ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_READ'\" | tr -d ' ') ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then - ROLE_READ_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='MAXIMO_READ'\" | tr -d ' ') echo ' - MAXIMO_READ' - if [ \"\$ROLE_READ_AUDIT_EXISTS\" -eq \"0\" ]; then - db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" - echo ' [OK] USER_AUDIT assigned.' - else - echo ' [SKIP] Already assigned.' - fi - ROLE_WRITE_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='MAXIMO_WRITE'\" | tr -d ' ') + db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" \ + && echo ' [OK] USER_AUDIT assigned.' \ + || echo ' [SKIP] Already assigned.' echo ' - MAXIMO_WRITE' - if [ \"\$ROLE_WRITE_AUDIT_EXISTS\" -eq \"0\" ]; then - db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" - echo ' [OK] USER_AUDIT assigned.' - else - echo ' [SKIP] Already assigned.' - fi + db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" \ + && echo ' [OK] USER_AUDIT assigned.' \ + || echo ' [SKIP] Already assigned.' else echo ' [SKIP] MAXIMO_READ/MAXIMO_WRITE roles not found - skipping role audit.' fi @@ -172,22 +164,14 @@ spec: ROLE_READ_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_READ'\" | tr -d ' ') ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then - ROLE_READ_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='TRIRIGA_READ'\" | tr -d ' ') echo ' - TRIRIGA_READ' - if [ \"\$ROLE_READ_AUDIT_EXISTS\" -eq \"0\" ]; then - db2 \"AUDIT ROLE TRIRIGA_READ USING POLICY USER_AUDIT\" - echo ' [OK] USER_AUDIT assigned.' - else - echo ' [SKIP] Already assigned.' - fi - ROLE_WRITE_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='R' AND OBJECTNAME='TRIRIGA_WRITE'\" | tr -d ' ') + db2 \"AUDIT ROLE TRIRIGA_READ USING POLICY USER_AUDIT\" \ + && echo ' [OK] USER_AUDIT assigned.' \ + || echo ' [SKIP] Already assigned.' echo ' - TRIRIGA_WRITE' - if [ \"\$ROLE_WRITE_AUDIT_EXISTS\" -eq \"0\" ]; then - db2 \"AUDIT ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" - echo ' [OK] USER_AUDIT assigned.' - else - echo ' [SKIP] Already assigned.' - fi + db2 \"AUDIT ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" \ + && echo ' [OK] USER_AUDIT assigned.' \ + || echo ' [SKIP] Already assigned.' else echo ' [SKIP] TRIRIGA_READ/TRIRIGA_WRITE roles not found - skipping role audit.' fi @@ -205,14 +189,10 @@ spec: echo '--------------------------------------------------------------------------------' echo 'Checking USER_AUDIT assignment to user:' echo '' - USER_AUDIT_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.AUDITUSE WHERE OBJECTTYPE='U' AND OBJECTNAME='DB2INST1'\" | tr -d ' ') echo ' - DB2INST1' - if [ \"\$USER_AUDIT_EXISTS\" -eq \"0\" ]; then - db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" - echo ' [OK] USER_AUDIT assigned.' - else - echo ' [SKIP] Already assigned.' - fi + db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" \ + && echo ' [OK] USER_AUDIT assigned.' \ + || echo ' [SKIP] Already assigned.' echo '' echo '[OK] USER_AUDIT user assignment verified.' From bfa61f19629248efa3c377f4708bad8afdcefcc0 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 14:32:29 +0530 Subject: [PATCH 086/103] update echo --- .../templates/08-postsync-db2-audit-policy_Job.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index 2ae56c38b..8041221ba 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -149,11 +149,11 @@ spec: ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='MAXIMO_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then echo ' - MAXIMO_READ' - db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" \ + db2 \"AUDIT ROLE MAXIMO_READ USING POLICY USER_AUDIT\" >/dev/null 2>&1 \ && echo ' [OK] USER_AUDIT assigned.' \ || echo ' [SKIP] Already assigned.' echo ' - MAXIMO_WRITE' - db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" \ + db2 \"AUDIT ROLE MAXIMO_WRITE USING POLICY USER_AUDIT\" >/dev/null 2>&1 \ && echo ' [OK] USER_AUDIT assigned.' \ || echo ' [SKIP] Already assigned.' else @@ -165,11 +165,11 @@ spec: ROLE_WRITE_EXISTS=\$(db2 -x \"SELECT COUNT(*) FROM SYSCAT.ROLES WHERE ROLENAME='TRIRIGA_WRITE'\" | tr -d ' ') if [ \"\$ROLE_READ_EXISTS\" -gt \"0\" ] && [ \"\$ROLE_WRITE_EXISTS\" -gt \"0\" ]; then echo ' - TRIRIGA_READ' - db2 \"AUDIT ROLE TRIRIGA_READ USING POLICY USER_AUDIT\" \ + db2 \"AUDIT ROLE TRIRIGA_READ USING POLICY USER_AUDIT\" >/dev/null 2>&1 \ && echo ' [OK] USER_AUDIT assigned.' \ || echo ' [SKIP] Already assigned.' echo ' - TRIRIGA_WRITE' - db2 \"AUDIT ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" \ + db2 \"AUDIT ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT\" >/dev/null 2>&1 \ && echo ' [OK] USER_AUDIT assigned.' \ || echo ' [SKIP] Already assigned.' else @@ -190,7 +190,7 @@ spec: echo 'Checking USER_AUDIT assignment to user:' echo '' echo ' - DB2INST1' - db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" \ + db2 \"AUDIT USER db2inst1 USING POLICY USER_AUDIT\" >/dev/null 2>&1 \ && echo ' [OK] USER_AUDIT assigned.' \ || echo ' [SKIP] Already assigned.' echo '' From 9902ef5862a721117da329c5a9b7fb48691ae3f8 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 15:36:05 +0530 Subject: [PATCH 087/103] Update 08-postsync-db2-audit-policy_Job.yaml --- .../08-postsync-db2-audit-policy_Job.yaml | 20 +++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index 8041221ba..de72a17cc 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -4,14 +4,18 @@ Audit policy setup job for DB2. Runs per-application audit policy commands on the db2u pod after the main postsync setup job (sync-wave 129) has completed. -Common to all applications: - - Create USER_AUDIT policy if not exists - - AUDIT USER db2inst1 USING POLICY USER_AUDIT - -Per-application role audit (only if roles already exist): +Only executed for applications that use DB2 audit policy: - manage : AUDIT ROLE MAXIMO_READ, ROLE MAXIMO_WRITE USING POLICY USER_AUDIT - facilities: AUDIT ROLE TRIRIGA_READ, ROLE TRIRIGA_WRITE USING POLICY USER_AUDIT + - monitor : no role audit - db2inst1 user audit only + - iot : no role audit - db2inst1 user audit only + +Common to all supported applications: + - Create USER_AUDIT policy if not exists + - AUDIT USER db2inst1 USING POLICY USER_AUDIT */}} +{{- $supported_apps := list "manage" "facilities" "monitor" "iot" }} +{{- if has .Values.mas_application_id $supported_apps }} {{- if .Values.should_execute }} {{- if not (contains "sdb" .Values.db2_instance_name) }} @@ -176,9 +180,12 @@ spec: echo ' [SKIP] TRIRIGA_READ/TRIRIGA_WRITE roles not found - skipping role audit.' fi ROLE_LABEL='TRIRIGA_READ, TRIRIGA_WRITE' + elif [ \"${MAS_APP_ID}\" = \"monitor\" ] || [ \"${MAS_APP_ID}\" = \"iot\" ]; then + ROLE_LABEL='N/A - user audit only' + echo ' [SKIP] No role audit required for ${MAS_APP_ID} - db2inst1 user audit only.' else ROLE_LABEL='N/A' - echo ' [SKIP] No role audit configured for this application.' + echo ' [SKIP] No role audit configured for ${MAS_APP_ID}.' fi echo '' echo '[OK] USER_AUDIT role assignments verified.' @@ -220,3 +227,4 @@ spec: {{- end }} {{- end }} {{- end }} +{{- end }} From 85e83d88eac971958aebf7787b51a54edffb2189 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 16:52:55 +0530 Subject: [PATCH 088/103] update job version --- .../templates/07-postsync-setup-db2_Job.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml index 0ac137de4..923e19a3c 100644 --- a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml @@ -35,7 +35,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v23" }} +{{- $_job_version := "v22" }} {{- /* 10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest This is to ensure ArgoCD will create a new job resource intead of attempting (and failing) to update an @@ -578,7 +578,6 @@ spec: echo "--------------------------------------------------------------------------------" oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "cd ${DB2_INSTANCE_HOME_PATH}/bin; ${CREATE_ROLES_SH_PATH} | tee /tmp/createroles.log" db2inst1 || exit $? fi - fi # [[ "$MAS_APP_ID" == "manage" ]] if [[ "$MAS_APP_ID" == "facilities" ]]; then From 7cd9f0f9e296687a2172f176bba6db2a201610ed Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 16:53:51 +0530 Subject: [PATCH 089/103] Update 07-postsync-setup-db2_Job.yaml --- .../templates/07-postsync-setup-db2_Job.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml index 923e19a3c..cdd1e763f 100644 --- a/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/07-postsync-setup-db2_Job.yaml @@ -578,6 +578,8 @@ spec: echo "--------------------------------------------------------------------------------" oc exec -n ${DB2_NAMESPACE} c-${DB2_INSTANCE_NAME}-db2u-0 -- su -lc "cd ${DB2_INSTANCE_HOME_PATH}/bin; ${CREATE_ROLES_SH_PATH} | tee /tmp/createroles.log" db2inst1 || exit $? fi + + fi # [[ "$MAS_APP_ID" == "manage" ]] if [[ "$MAS_APP_ID" == "facilities" ]]; then From ce62fcecee9401c6e329880f0e46b943d7a31c67 Mon Sep 17 00:00:00 2001 From: Drashti-Malviya Date: Fri, 21 Aug 2026 17:50:29 +0530 Subject: [PATCH 090/103] readme updated --- .../120-ibm-db2u-database/README.md | 42 +++++++++++++++++++ .../08-postsync-db2-audit-policy_Job.yaml | 4 +- 2 files changed, 44 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-db2u-database/README.md b/instance-applications/120-ibm-db2u-database/README.md index 5ec429989..71bce775e 100644 --- a/instance-applications/120-ibm-db2u-database/README.md +++ b/instance-applications/120-ibm-db2u-database/README.md @@ -28,6 +28,7 @@ Contains a job that runs last (`05-postsync-setup-db2_Job.yaml`). This registers | `Secret` | Post-sync DB2 generated secret | DB2 application namespace | Always | `application_admin_role` | | `NetworkPolicy` | HADR network policy | DB2 application namespace | When HADR is enabled | `application_admin_role` | | `Job` | Pre/post-sync DB2 setup jobs | DB2 application namespace | Always | `application_admin_role` | +| `Job` | DB2 audit policy setup job | DB2 application namespace | When `mas_application_id` is `manage`, `facilities`, `monitor`, or `iot` | `application_admin_role` | ## Configuration @@ -203,6 +204,47 @@ Both can use port 50001 without conflict since they are separate AWS NLB resourc The NLB is created independently for each instance (e.g. facilities, manage) using the instance-specific selector. +## DB2 Audit Policy + +### When It Is Applied + +The audit policy Job ([`08-postsync-db2-audit-policy_Job.yaml`](templates/08-postsync-db2-audit-policy_Job.yaml)) runs at sync-wave `130` (after the main DB2 setup job at wave `129`) and is **only created** when all of the following conditions are met: + +1. `application_admin_role: true` +2. `mas_application_id` is one of: `manage`, `facilities`, `monitor`, `iot` +3. `should_execute: true` +4. `db2_instance_name` does not contain `sdb` (shared instances are excluded) + +For any other `mas_application_id` (e.g. `health`, `visualinspection`, `predict`), no Job resource is rendered. + +### What Gets Audited per Application + +The job creates a single `USER_AUDIT` policy (idempotent — skipped if already exists) and assigns it to roles and/or users depending on the application: + +| Application | Audit Policy | Roles Audited | User Audited | +|---|---|---|---| +| `manage` | `USER_AUDIT` | `MAXIMO_READ`, `MAXIMO_WRITE` (only if roles exist) | `db2inst1` | +| `facilities` | `USER_AUDIT` | `TRIRIGA_READ`, `TRIRIGA_WRITE` (only if roles exist) | `db2inst1` | +| `monitor` | `USER_AUDIT` | None | `db2inst1` | +| `iot` | `USER_AUDIT` | None | `db2inst1` | + +### Audit Policy Definition + +```sql +CREATE AUDIT POLICY USER_AUDIT + CATEGORIES VALIDATE STATUS BOTH, + EXECUTE WITHOUT DATA STATUS BOTH + ERROR TYPE NORMAL +``` + +### Execution Steps + +1. **Connect** to the database (`db2 connect to `) +2. **Create** `USER_AUDIT` policy if it does not already exist +3. **Assign policy to roles** — per-app role audit (skipped if roles do not yet exist) +4. **Assign policy to user** — `AUDIT USER db2inst1 USING POLICY USER_AUDIT` (all 4 apps) +5. **Disconnect** (`db2 connect reset`) + ### Validation If `private_nlb.enabled: true` and either `subnet_ids` or `allowed_cidrs` is diff --git a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml index de72a17cc..5820e21f8 100644 --- a/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml +++ b/instance-applications/120-ibm-db2u-database/templates/08-postsync-db2-audit-policy_Job.yaml @@ -29,7 +29,7 @@ Meaningful prefix for the job resource name. Must be under 52 chars in length to Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. Included in $_job_hash (see below). */}} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_cli_image_digest := "sha256:db6dba0d58592a1bbed459bbe8285316c36d0d8c0bf8b39e1d0f910b3400f441" }} {{- /* A dict of values that influence the behaviour of the job in some way. @@ -43,7 +43,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v2" }} +{{- $_job_version := "v23" }} {{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} {{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} From 4ece441a3701cc46c8ca56856d493c016881923a Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Fri, 21 Aug 2026 21:40:22 +0530 Subject: [PATCH 091/103] fix(wsl): move ws-cluster-scoped to wave 119 to install WS CRD before SPSS (wave 122) SPSS operator at wave 122 tries to create a WS dependency CR of kind ws.cpd.ibm.com/v1beta1.WS. If ws-cluster-scoped runs at wave 123 (after SPSS), the CRD doesn't exist yet and SPSS fails with: 'Failed to find exact match for ws.cpd.ibm.com/v1beta1.WS' Move ws-cluster-scoped from wave 123 to wave 119 so it runs alongside the other cluster-scoped CRD installs, well before SPSS at wave 122. --- .../ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index dc91e476e..81690db70 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -478,7 +478,7 @@ metadata: {{- end }} instance: '{{ .Values.instance.id }}' annotations: - argocd.argoproj.io/sync-wave: "123" + argocd.argoproj.io/sync-wave: "119" finalizers: - resources-finalizer.argocd.argoproj.io spec: From d3b138d32576780a3aa352021e1cec21ad75d96a Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Sat, 22 Aug 2026 00:10:05 +0530 Subject: [PATCH 092/103] fix(spss): move spss app from wave 122 to 125 (after WSL operator at 124) SPSS operator creates a WS CR and waits for Watson Studio as a dependency. The WSL operator (ws chart) deploys at wave 124, so SPSS namespace-scoped app must be at wave 125 or later to avoid a race condition where SPSS tries to create a WS CR before the WS operator is running. Also update wave comment from 123 to 119 on wsl-cluster section (cosmetic). --- .../ibm-mas-instance-root/templates/120-ibm-spss-app.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index 43a108b31..180128949 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -239,7 +239,9 @@ spec: - CreateNamespace=false - SkipDryRunOnMissingResource=true --- -# Wave 122: SPSS namespace-scoped (operator + CR) +# Wave 125: SPSS namespace-scoped (operator + CR) +# Must run AFTER WSL at wave 124 — SPSS operator creates a WS CR and waits for it, +# so the WSL operator must already be running when SPSS reconciles. apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -254,7 +256,7 @@ metadata: {{- end }} instance: '{{ .Values.instance.id }}' annotations: - argocd.argoproj.io/sync-wave: "122" + argocd.argoproj.io/sync-wave: "125" {{- if and .Values.notifications .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} From 63f87548da058cdfa0e3f711f3b4891613cdcd4a Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Sat, 22 Aug 2026 15:06:49 +0530 Subject: [PATCH 093/103] feat(wsl): add wsl-post-verify AVP app at wave 126 for CPD >= 5.3.1 The instance-applications/120-ibm-wsl post-verify job (cpd-wsl-post-verify) was only deployed via the CPD < 5.3.1 AVP app path. For CPD >= 5.3.1 the native Helm apps are used for the WS operator/CR, but the post-verify job still needs to run to write the wsl-cp4d and wsl-project-id secrets to AWS SM. Without these secrets, inst02-watsonstudio-system AVP render fails. Wave 126 ensures it runs after wsl (124) and spss (125). --- .../templates/120-ibm-wsl-app.yaml | 87 +++++++++++++++++++ 1 file changed, 87 insertions(+) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index 81690db70..8c5047ace 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -557,5 +557,92 @@ spec: limit: 20 syncOptions: - CreateNamespace=true +--- +# Wave 126: WSL post-verify (polls WS CR to Completed, writes wsl-cp4d secret to AWS SM) +# Must run AFTER wsl (wave 124) and spss (wave 125). +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: wsl-post-verify.{{ .Values.cluster.id }}.{{ .Values.instance.id }} + namespace: {{ .Values.argo.namespace }} + labels: + environment: '{{ .Values.account.id }}' + region: '{{ .Values.region.id }}' + cluster: '{{ .Values.cluster.id }}' + {{- if .Values.argo.instance }} + argocd.argoproj.io/instance: '{{ .Values.argo.instance }}' + {{- end }} + instance: '{{ .Values.instance.id }}' + annotations: + argocd.argoproj.io/sync-wave: "126" + {{- if and .Values.notifications .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-failed.workspace1: {{ .Values.notifications.slack_channel_id }} + notifications.argoproj.io/subscribe.on-sync-succeeded.workspace1: {{ .Values.notifications.slack_channel_id }} + {{- end }} + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + ignoreDifferences: + - group: '*' + kind: ServiceAccount + jsonPointers: + - /imagePullSecrets + project: "{{ .Values.argo.projects.apps }}" + destination: + server: {{ .Values.cluster.url }} + namespace: {{ $cpd_operators_ns }} + source: + repoURL: "{{ .Values.source.repo_url }}" + path: instance-applications/120-ibm-wsl + targetRevision: "{{ .Values.source.revision }}" + plugin: + name: {{ .Values.avp.name }} + env: + - name: {{ .Values.avp.values_varname }} + value: | + account_id: "{{ .Values.account.id }}" + region_id: "{{ .Values.region.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + cli_image_repo: {{ .Values.cli_image_repo }} + cluster_admin_role: {{ .Values.cluster_admin_role }} + application_admin_role: {{ .Values.application_admin_role }} + sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" + sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" + cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" + cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" + cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" + cpd_service_storage_class: "{{ .Values.ibm_wsl.cpd_service_storage_class }}" + cpd_service_block_storage_class: "{{ .Values.ibm_wsl.cpd_service_block_storage_class }}" + cpd_service_scale_config: "{{ .Values.ibm_wsl.cpd_service_scale_config }}" + wsl_channel: "{{ .Values.ibm_wsl.wsl_channel }}" + wsl_version: "{{ .Values.ibm_wsl.wsl_version }}" + {{- if .Values.custom_labels }} + custom_labels: {{ .Values.custom_labels | toYaml | nindent 14 }} + {{- end }} + junitreporter: + reporter_name: "ibm-wsl-{{ .Values.instance.id }}" + cluster_id: "{{ .Values.cluster.id }}" + instance_id: "{{ .Values.instance.id }}" + devops_mongo_uri: "{{ .Values.devops.mongo_uri }}" + devops_build_number: "{{ .Values.devops.build_number }}" + gitops_version: "{{ .Values.source.revision }}" + cli_image_repo: {{ .Values.cli_image_repo }} + - name: ARGOCD_APP_NAME + value: cpdwslpostverify + {{- if not (empty .Values.avp.secret) }} + - name: AVP_SECRET + value: {{ .Values.avp.secret }} + {{- end }} + syncPolicy: + automated: + {{- if .Values.auto_delete }} + prune: true + {{- end }} + selfHeal: true + retry: + limit: 20 + syncOptions: + - CreateNamespace=true {{- end }} {{- end }} From 049ff760f15c91b760733187143a728cb83b42ac Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Mon, 24 Aug 2026 10:04:20 +0530 Subject: [PATCH 094/103] dummy commit for cpd 5.3.1 --- ...5-3-1-gitops-support-full-explanation.html | 401 ------------------ 1 file changed, 401 deletions(-) delete mode 100644 .bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html diff --git a/.bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html b/.bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html deleted file mode 100644 index f5c2ee083..000000000 --- a/.bob/artifacts/mascore-15507-cpd-5-3-1-gitops-support-full-explanation.html +++ /dev/null @@ -1,401 +0,0 @@ - - - - - -MASCORE-15507 Explainer - - - -
-

MASCORE-15507: CPD 5.3.1 GitOps Support

-

Complete explanation of every change — what was done, why, and how it works

-
-
- -
- Background - OLM Bootstrap - RBAC - WML - WSL - Spark - Cognos - SPSS - Post-sync - Bugs Fixed - Test Results -
- - -
-
- 📋 -

Background — Why This Change Was Needed

-
-
-
-
The Problem
-

CPD (Cloud Pak for Data) 5.3.1 changed how services are installed. In CPD ≤ 5.3, services were installed via OLM (Operator Lifecycle Manager) — you create a Subscription resource and an operator CR, and the OLM machinery handles everything. In CPD 5.3.1+, IBM moved to Helm-based installation — you run helm install directly to deploy the operator and service CR.

-
-
-
What This Means for GitOps
-

Our GitOps templates were only generating OLM Subscription + CR resources. On CPD 5.3.1 clusters, those resources either don't apply (no OLM catalog for them) or the operators aren't available via OLM. We needed to add a second code path that runs Helm charts instead, gated behind a version check.

-
-

Version Gate Pattern Used Throughout

-
{{/* CPD < 5.3.1: use OLM (Subscription + CR) */}} -{{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | toString)).Compare) 0 }} ---- OLM Subscription resource here --- -{{- else }} ---- Helm install Job here --- -{{- end }}
-

This reads as: "if cpd_product_version < 5.3.1, use OLM; otherwise use Helm"

-
-
- - -
-
- 🔧 -

CPD 5.3.1 OLM Bootstrap

- New Files -
-
-
-
Why
-

Even though services use Helm in 5.3.1, the CPD platform itself (zen, common services, etc.) still uses OLM. CPD 5.3.1 requires different catalog sources and a different olm-utils-cm ConfigMap (which tells CPD operators the correct component versions). Without this, the platform operators don't know which versions to reconcile.

-
-
-
-
instance-applications/101-ibm-sync-jobs-cp4d/templates/00-ibm-cp4d-olm-531.yaml
instance-applications/110-ibm-cp4d/templates/00-ibm-cp4d-olm-531.yaml
-
Added olm-utils-cm ConfigMap + full release_components_meta for CPD 5.3.1
-
The olm-utils-cm ConfigMap is read by CPD operators to know component versions (case_version, csv_version, cr_version). Without it, operators fall back to wrong defaults. This is gated with {{- if eq .Values.cpd_product_version "5.3.1" }}.
-
-
-
instance-applications/101-ibm-sync-jobs-cp4d/templates/01-ibm-cp4d-CatalogSources.yaml
-
Added 3 new CatalogSources for CPD 5.3.1: cpd-platform, opencloud-operators, ibm-zen-operator-catalog
-
These are pinned to specific digest-based image tags for CPD 5.3.1. Different from 5.3.0 — if you use the wrong catalog, operators install wrong versions or fail to find their CSVs.
-
-
-
-
- - -
-
- 🔐 -

RBAC — ClusterRole for cpd-sa

- Security -
-
-
-
Why
-

The Helm install jobs run as the cpd-sa ServiceAccount. In Helm mode, the cluster-scoped charts install CRDs and ClusterRoles across the entire cluster (not just one namespace). cpd-sa only had namespace-scoped permissions before — it couldn't create CRDs or ClusterRoles. This caused every Helm install job to fail with Forbidden errors.

-
-
-
instance-applications/110-ibm-cp4d/templates/02-ibm-cp4d_rbac.yaml
-
Added ClusterRole + ClusterRoleBinding for cpd-sa (gated on CPD ≥ 5.3.1)
-
Grants cpd-sa permission to: create/patch CRDs, create/patch ClusterRoles (with escalate), manage webhooks, and access CPD service API groups. The escalate verb is needed because the Helm charts grant permissions that cpd-sa doesn't initially hold.
-
-
-
- - -
-
- 🤖 -

Watson Machine Learning (WML)

- Helm Path Added -
-
-
-
Why Helm for WML
-

WML on CPD 5.3.1 requires installing Redis as a dependency first (WML operator needs Redis CRDs to exist before it can be deployed), then installing the WML operator + CR via Helm charts.

-
-

Install Order (CPD 5.3.1+)

-
-
ibm-redis-cp-cluster-scoped (CRDs)
- → -
ibm-redis-cp (operator)
- → -
Poll rediscps.redis.ibm.com CRD
- → -
wml-cluster-scoped (CRDs)
- → -
Poll wmlbases.wml.cpd.ibm.com CRD
- → -
wml (operator + CR)
-
-

Key Bug Fixed

-
- 🐛 -
-
CRD poll typo: redicps → rediscps
-
The script polled for redicps.redis.ibm.com (missing 's') which never exists. The actual CRD is rediscps.redis.ibm.com. This caused the job to time out after 5 minutes every time.
-
-
-

Hashed Job Name Pattern

-
-
Why hashed names
-

ArgoCD Jobs have immutable spec.template. If we use a fixed name like install-wml-helm and the template changes, ArgoCD tries to patch the existing Job → fails with "field is immutable". By computing a hash from the template content + version string, each change produces a new unique job name, so ArgoCD creates a new Job instead of patching the old one.

-
-
{{- $_job_version := "v2" }} ← bump this to force new job -{{- $_job_hash := print ($_job_config_values | toYaml) $_cli_image_digest $_job_version | adler32sum }} -{{- $_job_name := join "-" (list $_job_name_prefix $_job_hash) }} -→ produces: install-wml-helm-502535097
-
-
- - -
-
- 🔬 -

Watson Studio (WSL)

- Helm Path Added -
-
-
-
Why WSL is Complex
-

WSL has 4 dependencies that must be installed in order before WSL itself can be installed. Each dependency needs its cluster-scoped chart (CRDs) before its namespace-scoped chart (operator+CR).

-
-

Install Order (CPD 5.3.1+)

-
-
1. opencontent-opensearch
- → -
2. ccs (+ explicit CCS CR)
- → -
3. datarefinery
- → -
4. ws-runtimes
- → -
5. ws (Watson Studio)
-
-
-
CCS CR created explicitly with non_olm_deploy: true
-
In Helm mode, the CCS namespace-scoped chart only deploys the operator, not the CR. The CR must be created manually with non_olm_deploy: true flag so the operator knows it's not running under OLM and proceeds to reconcile the CCS instance.
-
-
-
install_component() helper function
-
Reusable function that: (1) applies cluster-scoped chart via helm template | oc apply, (2) waits for CRDs, (3) runs helm upgrade --install for namespace-scoped chart. Makes the script DRY and readable.
-
-
-
- - -
-
- ⚡ -

Apache Spark (Analytics Engine)

- Helm Path Added -
-
-
-
Changes
-

Gated OLM Subscription, AnalyticsEngine CR, and the control-plane verification job behind < 5.3.1. Added Helm install job for 5.3.1+ using analyticsengine-cluster-scoped + analyticsengine charts at version 12.1.0. Also added cpd_product_version to values.yaml and the instance-root app template — without this, the version gate Helm template would fail (no value to compare against).

-
-
-
- - -
-
- 📊 -

Cognos Analytics

- New Chart - 3 Bugs Fixed -
-
-
-
Context
-

Cognos Analytics was previously bundled with the SPSS chart (they shared the same ArgoCD app template 120-ibm-spss-app.yaml). They were split into separate charts. In the split, the Chart.yaml was accidentally omitted from the Cognos chart.

-
-
-
-
Bug 1: Missing Chart.yaml
-
Helm requires Chart.yaml to treat a directory as a chart. Without it, helm dependency update fails with "Chart.yaml file is missing". Added Chart.yaml matching the pattern of all other charts in the repo.
-
-
-
Bug 2: Escaped quotes parse error in instance-root template
-
The 120-ibm-cognos-analytics-app.yaml used \"nfs-client\" inside a YAML literal block scalar (value: |). Inside a block scalar, backslash escapes are literal characters, not YAML escapes — causing Helm to fail with "unexpected \\ in operand". Fixed by using unescaped "nfs-client".
-
-
-
Bug 3: Wrong CRD poll name
-
The Helm install job polled for cognosanalytics.cognosanalytics.cpd.ibm.com but the cognos-analytics-cluster-scoped chart actually creates caservices.ca.cpd.ibm.com and caserviceinstances.ca.cpd.ibm.com. Fixed to poll caservices.ca.cpd.ibm.com.
-
-
-
-
- - -
-
- 📈 -

SPSS Modeler

- Re-added + CPD 5.3.1 Support -
-
-
-
Context
-

SPSS was previously available only for CPD < 5.3.1 via OLM. For CPD 5.3.1+, IBM provides spss-cluster-scoped + spss Helm charts, but SPSS requires Canvasbase as a dependency (the SPSS operator tries to create a Canvasbase CR on startup).

-
-

Install Order (CPD 5.3.1+)

-
-
canvasbase-cluster-scoped (CRDs) v12.1.0
- → -
Poll canvasbase.canvasbase.cpd.ibm.com
- → -
canvasbase (operator+CR) v12.1.0
- → -
Wait canvasbase Completed
- → -
spss-cluster-scoped (CRDs) v12.1.0
- → -
Poll spss.spssmodeler.cpd.ibm.com
- → -
spss (operator+CR) v12.1.0
-
-

Bugs Found and Fixed During Testing

-
- 🐛 -
-
Wrong chart names: spss-modeler-cluster-scoped / spss-modeler
-
Correct names in IBM Helm repo are spss-cluster-scoped and spss. Fixed by querying the IBM Helm index directly.
-
-
-
- 🐛 -
-
Wrong chart versions: 13.0.4 (CPD 5.4.0) instead of 12.1.0 (CPD 5.3.1)
-
Initially used the latest version (13.0.4) which is for CPD 5.4.0. The CPD 5.3.1 release_components_meta specifies case_version: 12.1.0 for both canvasbase and spss. Using wrong version caused "CR version 13.0.4 does not match operator version 12.1.0" errors.
-
-
-
- 🐛 -
-
Wrong CRD poll names
-
Polled for spssmodelerbases.spssmodeler.cpd.ibm.com (doesn't exist) → actual CRD is spss.spssmodeler.cpd.ibm.com. Polled for canvasbases.cpd.ibm.com → actual CRD is canvasbase.canvasbase.cpd.ibm.com. Both found by checking oc get crd | grep after the cluster-scoped chart ran.
-
-
-
- 🐛 -
-
canvasbase CR version mismatch (13.0.4 vs 12.1.0)
-
The canvasbase Helm chart created the CR with version 12.1.0 but the operator was 13.0.4 (from the wrong chart version). Fixed by correcting chart version. Required manually patching the stuck CR and deleting/recreating the SPSS CR once canvasbase reached Completed.
-
-
-
-
- - -
-
- 🔄 -

Post-Sync Job (121-ibm-post-sync-job-cp4d-services)

- Guard Added -
-
-
-
Why
-

The post-sync job patches CCS and OpenSearch CRs after they're deployed via OLM. In CPD 5.3.1 Helm mode, these CRs are managed by Helm — patching them via the post-sync job would break Helm's management of them. Added an early exit for CPD ≥ 5.3.1.

-
-
COMP_531=$(compare_versions ${CPD_PRODUCT_VERSION} 5.3.1) -if [[ ${COMP_531} -ge 0 ]]; then - echo "CPD >= 5.3.1 - skipping OLM post-sync patching" - exit 0 -fi
-
-
- - -
-
- 🐛 -

All Bugs Found & Fixed During Testing

-
-
- - - - - - - - - - - - - -
FileBugFix
120-ibm-cognos-analytics-app.yamlEscaped quotes \" in block scalarRemoved backslash escapes
120-ibm-cognos-analytics/Missing Chart.yamlAdded Chart.yaml
02-ibm-wml-cr.yamlCRD poll: redicps → rediscpsFixed typo
01-ibm-cognos-analytics-cr.yamlCRD poll: wrong CRD namecaservices.ca.cpd.ibm.com
01-ibm-spss-cr.yamlChart names wrongspss-cluster-scoped / spss
01-ibm-spss-cr.yamlChart version 13.0.4 (CPD 5.4)12.1.0 (CPD 5.3.1)
01-ibm-spss-cr.yamlCRD poll: spssmodelerbasesspss.spssmodeler.cpd.ibm.com
01-ibm-spss-cr.yamlCRD poll: canvasbases.cpd.ibm.comcanvasbase.canvasbase.cpd.ibm.com
01-ibm-spss-cr.yamlMissing canvasbase dependencyAdded canvasbase install step before spss
01-ibm-cognos-analytics-cr.yamlChart version 29.1.8 (too new)29.1.0 (CPD 5.3.1 metadata)
02-ibm-wml-cr.yamlFixed job name (immutable field error)Added hashed job name pattern
-
-
- - -
-
- ✅ -

Test Results — noble8 cluster, CPD 5.3.1, inst02

-
-
-
wml.noble8.inst02✅ WmlBase/wml-cr — Completed 100%
-
wsl.noble8.inst02✅ Synced Healthy
-
spark.noble8.inst02✅ Synced Healthy
-
cognos.noble8.inst02✅ CAService/ca-addon-cr — Completed 100%
-
spss.noble8.inst02✅ canvasbase + spss — Completed 100%
-
-
- -
- - From d64803a57bfbfdc2afa29857340626478ac660d8 Mon Sep 17 00:00:00 2001 From: Vijeya Nidhi B Date: Mon, 24 Aug 2026 15:14:16 +0530 Subject: [PATCH 095/103] fix: mascore-12697 --- .../templates/05-postsync-add-label_Job.yaml | 60 +++++++++++++++++-- 1 file changed, 55 insertions(+), 5 deletions(-) diff --git a/instance-applications/130-ibm-mas-suite/templates/05-postsync-add-label_Job.yaml b/instance-applications/130-ibm-mas-suite/templates/05-postsync-add-label_Job.yaml index af693d235..38d5e11fe 100644 --- a/instance-applications/130-ibm-mas-suite/templates/05-postsync-add-label_Job.yaml +++ b/instance-applications/130-ibm-mas-suite/templates/05-postsync-add-label_Job.yaml @@ -25,7 +25,7 @@ Increment this value whenever you make a change to an immutable field of the Job E.g. passing in a new environment variable. Included in $_job_hash (see below). */}} -{{- $_job_version := "v3" }} +{{- $_job_version := "v4" }} {{- /* 10 char hash appended to the job name taking into account $_job_config_values, $_job_version and $_cli_image_digest @@ -186,6 +186,8 @@ spec: env: - name: SUITE_NAMESPACE value: mas-{{ .Values.instance_id }}-core + - name: INSTANCE_ID + value: {{ .Values.instance_id }} command: - /bin/sh - -c @@ -203,7 +205,7 @@ spec: while true; do wait_period=$(($wait_period+60)) if [ $wait_period -gt 3600 ]; then - echo "Suite Routes is not ready after 20 minutes of waiting. exiting..." + echo "Suite Routes is not ready after 60 minutes of waiting. exiting..." exit 1 else sleep 60 @@ -222,15 +224,63 @@ spec: fi done + # Get expected domain from Suite CR + echo + echo "Validating routes match expected domain from Suite CR..." + EXPECTED_DOMAIN=$(oc get Suite/${INSTANCE_ID} -n ${SUITE_NAMESPACE} -o jsonpath='{.spec.domain}') + echo "Expected domain: ${EXPECTED_DOMAIN}" + + # Wait for routes to match expected domain + # This ensures routes have been recreated after a domain change + wait_period=0 + while true; do + wait_period=$(($wait_period+30)) + if [ $wait_period -gt 1800 ]; then + echo "Routes do not match expected domain after 30 minutes. Exiting..." + echo "This may indicate the Suite operator has not finished recreating routes." + exit 1 + fi + + # Get all route hosts + ROUTE_HOSTS=$(oc get routes -n ${SUITE_NAMESPACE} -o jsonpath='{range .items[*]}{.spec.host}{"\n"}{end}') + + # Check if any routes exist + if [ -z "$ROUTE_HOSTS" ]; then + echo "No routes found yet, waiting..." + sleep 30 + continue + fi + + # Check if all routes contain expected domain + MISMATCHED=$(echo "$ROUTE_HOSTS" | grep -v "$EXPECTED_DOMAIN" || true) + if [ -z "$MISMATCHED" ]; then + echo "All routes match expected domain: ${EXPECTED_DOMAIN}" + break + else + echo "Some routes do not match expected domain yet:" + echo "$MISMATCHED" + echo "Waiting for routes to be recreated with correct domain..." + sleep 30 + fi + done + export routes=$(oc get routes -n ${SUITE_NAMESPACE} -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') - echo "Add label to routes updated ${routes}" + echo + echo "Adding type=external label to routes: ${routes}" for route in $routes; do echo "Adding label to route - ${route}" - oc patch route/${route} -p '{"metadata":{"labels":{"type":"external"}}}' + oc patch route/${route} -p '{"metadata":{"labels":{"type":"external"}}}' || { + echo "Warning: Failed to patch route ${route}, will retry..." + sleep 5 + oc patch route/${route} -p '{"metadata":{"labels":{"type":"external"}}}' + } done + + echo + echo "Successfully added type=external label to all routes" restartPolicy: Never serviceAccountName: "mas-route-sa" backoffLimit: 4 -{{- end }} +{{- end }} \ No newline at end of file From f64cbba0c00518e5379378a4bd8441e4d30effba Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Wed, 26 Aug 2026 11:47:56 +0530 Subject: [PATCH 096/103] fix: restore SPSS README, remove commented-out template lines from WSL files --- instance-applications/120-ibm-spss/README.md | 62 +++++++++++++++++++ .../templates/00-ibm-wsl_Subscription.yaml | 20 ------ .../120-ibm-wsl/templates/01-ibm-wsl-cr.yaml | 29 --------- 3 files changed, 62 insertions(+), 49 deletions(-) create mode 100644 instance-applications/120-ibm-spss/README.md diff --git a/instance-applications/120-ibm-spss/README.md b/instance-applications/120-ibm-spss/README.md new file mode 100644 index 000000000..094e3e453 --- /dev/null +++ b/instance-applications/120-ibm-spss/README.md @@ -0,0 +1,62 @@ +SPSS Modeler +=============================================================================== +Deploys and configures the CP4D Service, SPSS Modeler. + + + + +[SPSS Modeler](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.8.x?topic=modeler-installing) optional dependency for [Predict](https://www.ibm.com/docs/en/mas-cd/mhmpmh-and-p-u/continuous-delivery) + +## Resources Created + +| Resource Type | Resource Name | Namespace | Condition | Installed By | +|--------------|---------------|-----------|-----------|--------------| +| `Subscription` | SPSS operator subscriptions | CP4D instance namespace | Always | `application_admin_role` | +| `Spss` | SPSS service CR | CP4D instance namespace | Always | `application_admin_role` | + +## Configuration + +This chart accepts the following configuration values in the ArgoCD Application values: + +```yaml +ibm_spss: + ccs_version: string (secret reference) + cpd_service_block_storage_class: string + cpd_service_scale_config: string + cpd_service_storage_class: string + spss_channel: string (secret reference) + spss_version: string (secret reference) + spss_install_plan: string + canvasbase_channel: string (secret reference) + canvasbase_install_plan: string +``` + +**Note**: Values marked with "(secret reference)" should use the format `` to reference secrets stored in the Secrets Vault. + +## Base Instance Values + +This chart inherits common instance configuration values. The most frequently used base values are: + +```yaml +account: + id: string # Account identifier + name: string # Account name + +region: + id: string # Region identifier + name: string # Region name + +cluster: + id: string # Cluster identifier + name: string # Cluster name + +instance: + id: string # MAS instance identifier + +sm: # Secrets Manager configuration + aws_secret_region: string + aws_access_key_id: string (secret reference) + aws_secret_access_key: string (secret reference) +``` + +For complete documentation of all base instance values including optional fields like `custom_labels`, `argocluster_instance`, `application_admin_service_account`, `mas_wipe_mongo_data`, `allow_list`, `additional_vpn`, `application_configuration`, `use_postdelete_hooks`, `additional_resources`, `extensions`, `enhanced_dr`, and `cli_image_repo`, see the [Instance Base Values Reference](../../docs/reference/instance-base-values.md). diff --git a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml index f207bbaae..485e9ab89 100644 --- a/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml +++ b/instance-applications/120-ibm-wsl/templates/00-ibm-wsl_Subscription.yaml @@ -1,23 +1,3 @@ -# --- -# apiVersion: operators.coreos.com/v1alpha1 -# kind: Subscription -# metadata: -# name: ibm-cpd-ws-operator -# namespace: "{{ .Values.cpd_operators_namespace }}" -# annotations: -# argocd.argoproj.io/sync-wave: "090" -# {{- if .Values.custom_labels }} -# labels: -# {{ .Values.custom_labels | toYaml | indent 4 }} -# {{- end }} -# spec: -# name: ibm-cpd-wsl -# channel: "{{ .Values.wsl_channel }}" -# source: ibm-operator-catalog -# sourceNamespace: openshift-marketplace -# installPlanApproval: {{ .Values.wsl_install_plan | default "Automatic" | quote }} - - {{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: operators.coreos.com/v1alpha1 diff --git a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml index 48c093f93..1a83e5322 100644 --- a/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml +++ b/instance-applications/120-ibm-wsl/templates/01-ibm-wsl-cr.yaml @@ -1,32 +1,3 @@ -# --- -# apiVersion: ws.cpd.ibm.com/v1beta1 -# kind: WS -# metadata: -# name: "ws-cr" -# namespace: "{{ .Values.cpd_instance_namespace }}" -# annotations: -# argocd.argoproj.io/sync-wave: "091" -# argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -# {{- if .Values.custom_labels }} -# labels: -# {{ .Values.custom_labels | toYaml | indent 4 }} -# {{- end }} -# spec: -# imagePullSecret: ibm-entitlement-key -# ignoreForMaintenance: false -# license: -# accept: true -# license: Standard -# scaleConfig: "{{ .Values.cpd_service_scale_config }}" -# fileStorageClass: "{{ .Values.cpd_service_storage_class }}" -# blockStorageClass: "{{ .Values.cpd_service_block_storage_class }}" -# version: "{{ .Values.wsl_version }}" -# ccs_operand_version: "{{ .Values.ccs_version }}" -# datarefinery_operand_version: "{{ .Values.datarefinery_version }}" -# wsrt_operand_version: "{{ .Values.ws_runtimes_version }}" - - - {{- if lt (semver "5.3.1" | (semver (.Values.cpd_product_version | default "0.0.0" | toString)).Compare) 0 }} --- apiVersion: ws.cpd.ibm.com/v1beta1 From 2b379713eb21f7e6ff0a69e5e571d7d00c52dbee Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Wed, 26 Aug 2026 12:45:20 +0530 Subject: [PATCH 097/103] fix: set CreateNamespace=false on all CPD service apps - namespaces created at waves 085/110 --- .../templates/120-ibm-cognos-analytics-app.yaml | 2 +- .../templates/120-ibm-spark-app.yaml | 2 +- .../templates/120-ibm-spss-app.yaml | 4 ++-- .../templates/120-ibm-wml-app.yaml | 2 +- .../templates/120-ibm-wsl-app.yaml | 10 +++++----- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml index df8963b6b..881c8f5ce 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-cognos-analytics-app.yaml @@ -119,6 +119,6 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false - RespectIgnoreDifferences=true {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml index 40204e5da..e854a27ab 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spark-app.yaml @@ -197,6 +197,6 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false {{- end }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml index 180128949..f3f2af81f 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-spss-app.yaml @@ -193,7 +193,7 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false --- # Wave 121: SPSS cluster-scoped (CRDs + ClusterRoles) apiVersion: argoproj.io/v1alpha1 @@ -290,6 +290,6 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false {{- end }} {{- end }} diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml index c7a18393e..baeccba21 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml @@ -281,7 +281,7 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false --- # Wave 123: WML post-verify (polls WmlBase CR to Completed, writes wml-cp4d secret to SM) apiVersion: argoproj.io/v1alpha1 diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml index 8c5047ace..89979275e 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wsl-app.yaml @@ -283,7 +283,7 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false --- # Wave 119: datarefinery cluster-scoped (CRDs + ClusterRoles) apiVersion: argoproj.io/v1alpha1 @@ -372,7 +372,7 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false --- # Wave 121: ws-runtimes cluster-scoped (CRDs + ClusterRoles) apiVersion: argoproj.io/v1alpha1 @@ -461,7 +461,7 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false --- # Wave 123: ws cluster-scoped (CRDs + ClusterRoles) apiVersion: argoproj.io/v1alpha1 @@ -556,7 +556,7 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false --- # Wave 126: WSL post-verify (polls WS CR to Completed, writes wsl-cp4d secret to AWS SM) # Must run AFTER wsl (wave 124) and spss (wave 125). @@ -643,6 +643,6 @@ spec: retry: limit: 20 syncOptions: - - CreateNamespace=true + - CreateNamespace=false {{- end }} {{- end }} From 21f23db252e27d132a191322c32e33c936bede61 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 27 Aug 2026 11:08:21 +0530 Subject: [PATCH 098/103] fix(spss): revert subscription name and sync-wave to match main --- .../120-ibm-spss/templates/00-ibm-spss_Subscription.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml index 0e5fc2c69..183a60725 100644 --- a/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml +++ b/instance-applications/120-ibm-spss/templates/00-ibm-spss_Subscription.yaml @@ -3,10 +3,10 @@ apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: - name: spss-modeler-subscription + name: "cpd-spss-operator" namespace: "{{ .Values.cpd_operators_namespace }}" annotations: - argocd.argoproj.io/sync-wave: "092" + argocd.argoproj.io/sync-wave: "091" {{- if .Values.custom_labels }} labels: {{ .Values.custom_labels | toYaml | indent 4 }} From ac389a086074ccbdf78889daeadd3234dcd9e796 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 27 Aug 2026 11:43:08 +0530 Subject: [PATCH 099/103] fix: update README tables to match template resource kinds --- instance-applications/120-ibm-spark/README.md | 1 - instance-applications/120-ibm-wml/README.md | 5 ++++- instance-applications/120-ibm-wsl/README.md | 1 - 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/instance-applications/120-ibm-spark/README.md b/instance-applications/120-ibm-spark/README.md index 2a3fab040..68de7b646 100644 --- a/instance-applications/120-ibm-spark/README.md +++ b/instance-applications/120-ibm-spark/README.md @@ -15,7 +15,6 @@ Spark extends jupyter notebooks features inside Watson Studio notebooks which ca | `ServiceAccount` | Spark control-plane service account | CP4D instance namespace | When control-plane job is enabled | `application_admin_role` | | `ClusterRole` | Spark control-plane cluster roles | N/A (cluster-scoped) | When control-plane job is enabled | `application_admin_role` | | `ClusterRoleBinding` | Spark control-plane cluster role binding | N/A (cluster-scoped) | When control-plane job is enabled | `application_admin_role` | -| `ConfigMap` | Helm install state tracking | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | | `Job` | Spark Helm install job | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | ## Configuration diff --git a/instance-applications/120-ibm-wml/README.md b/instance-applications/120-ibm-wml/README.md index d309bc536..f87f7582f 100644 --- a/instance-applications/120-ibm-wml/README.md +++ b/instance-applications/120-ibm-wml/README.md @@ -12,8 +12,11 @@ Deploys and configures the CP4D Service, Watson Machine Learning (WML) needed fo |--------------|---------------|-----------|-----------|--------------| | `Subscription` | WML operator subscription | CP4D operators namespace | CPD < 5.3.1 | `application_admin_role` | | `WmlBase` | Watson Machine Learning service CR | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | -| `ConfigMap` | Helm install state tracking | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | | `Job` | Helm install job (ibm-redis-cp + wml) | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | +| `Role` | WML post-verify roles | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `RoleBinding` | WML post-verify role binding | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `Secret` | WML post-verify runtime secret | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | +| `ServiceAccount` | WML post-verify service account | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | ## Configuration diff --git a/instance-applications/120-ibm-wsl/README.md b/instance-applications/120-ibm-wsl/README.md index b5a0e9eb7..0afcd2576 100644 --- a/instance-applications/120-ibm-wsl/README.md +++ b/instance-applications/120-ibm-wsl/README.md @@ -15,7 +15,6 @@ Deploys and configures the CP4D Service, Watson Studio Local (WSL) needed for `M | `Role` | WSL post-verify roles | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | | `RoleBinding` | WSL post-verify role binding | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | | `Secret` | WSL post-verify runtime secret | CP4D instance namespace | CPD < 5.3.1 | `application_admin_role` | -| `ConfigMap` | Helm install state tracking | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | | `Job` | WSL Helm install job | CP4D operators namespace | CPD >= 5.3.1 | `application_admin_role` | ## Configuration From 2e2cd9b4cc89d97b81644778dbb702aaaea1a44e Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Thu, 27 Aug 2026 11:46:11 +0530 Subject: [PATCH 100/103] fix: update cli image digest in wml post-verify template --- .../120-ibm-wml/templates/03-ibm-wml-post-verify.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml b/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml index 42a627a25..fdfea7673 100644 --- a/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml +++ b/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml @@ -8,7 +8,7 @@ Meaningful prefix for the job resource name. Must be under 52 chars in length to Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. Included in $_job_hash (see below). */}} -{{- $_cli_image_digest := "sha256:887cc3059a04601241687711df0c03d662931e6719121eec0eb0490001b2c8b9" }} +{{- $_cli_image_digest := "sha256:db6dba0d58592a1bbed459bbe8285316c36d0d8c0bf8b39e1d0f910b3400f441" }} {{- /* A dict of values that influence the behaviour of the job in some way. From 14c37fbf7881b3a20e531d3aa9259c60db451182 Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 1 Sep 2026 18:05:36 +0530 Subject: [PATCH 101/103] fix: update cli image digest to sha256:1c5701a across all templates --- .../120-ibm-wml/templates/03-ibm-wml-post-verify.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml b/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml index fdfea7673..9fcf5263d 100644 --- a/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml +++ b/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml @@ -8,7 +8,7 @@ Meaningful prefix for the job resource name. Must be under 52 chars in length to Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. Included in $_job_hash (see below). */}} -{{- $_cli_image_digest := "sha256:db6dba0d58592a1bbed459bbe8285316c36d0d8c0bf8b39e1d0f910b3400f441" }} +{{- $_cli_image_digest := "sha256:1c5701a24c9796e02b33036f56babbe74032831e1db733ce9228a46dce4a870b" }} {{- /* A dict of values that influence the behaviour of the job in some way. From b851e4c46b85654811dd58b8c94405d79520413f Mon Sep 17 00:00:00 2001 From: Sakshi Singhroha Date: Tue, 15 Sep 2026 11:30:04 +0530 Subject: [PATCH 102/103] feat(wml): use dedicated operatorNamespace per instance for CPD >= 5.3.1 For CPD >= 5.3.1, derive operatorNamespace as ibm-cpd-{instance_id}-operators instead of the shared cpd_operators_namespace. This ensures each instance has its own isolated operator namespace, preventing resource name collisions caused by IBM chart hardcoded names (ibm-cpd-wml-operator-serviceaccount, etc.). Applies to: wml-redis-cluster, wml-redis, wml-cluster, wml, wml-post-verify apps. CPD < 5.3.1 (OLM path) is unchanged. Validated by MASCORE-17865 spike testing: - Spike 1: shared operatorNamespace causes name collision - NOT viable - Spike 2: dedicated operatorNamespace per instance - fully isolated and proven --- .../templates/120-ibm-wml-app.yaml | 24 ++++++++++++------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml index baeccba21..8151e9db8 100644 --- a/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/120-ibm-wml-app.yaml @@ -3,6 +3,12 @@ {{ $cpd_instance_ns := .Values.ibm_cp4d.cpd_instance_namespace }} {{ $cpd_version := .Values.ibm_cp4d.cpd_product_version | default "0.0.0" | toString }} {{ $is531 := not (lt (semver "5.3.1" | (semver $cpd_version).Compare) 0) }} +{{- /* + For CPD >= 5.3.1, each instance must have a dedicated operator namespace to avoid + resource name collisions (IBM chart uses hardcoded names like ibm-cpd-wml-operator-serviceaccount). + We derive it from the instance ID so it is always unique per instance on the cluster. +*/}} +{{ $cpd_wml_operators_ns := ternary (printf "ibm-cpd-%s-operators" .Values.instance.id) $cpd_operators_ns $is531 }} {{- if not $is531 }} --- # CPD < 5.3.1 — OLM path @@ -125,7 +131,7 @@ spec: project: "{{ .Values.argo.projects.apps }}" destination: server: {{ .Values.cluster.url }} - namespace: {{ $cpd_operators_ns }} + namespace: {{ $cpd_wml_operators_ns }} source: chart: ibm-redis-cp-cluster-scoped repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm @@ -134,7 +140,7 @@ spec: valuesObject: global: licenseAccept: true - operatorNamespace: {{ $cpd_operators_ns }} + operatorNamespace: {{ $cpd_wml_operators_ns }} instanceNamespace: {{ $cpd_instance_ns }} imagePullSecret: ibm-entitlement-key syncPolicy: @@ -168,7 +174,7 @@ spec: project: "{{ .Values.argo.projects.apps }}" destination: server: {{ .Values.cluster.url }} - namespace: {{ $cpd_operators_ns }} + namespace: {{ $cpd_wml_operators_ns }} source: chart: ibm-redis-cp repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm @@ -177,7 +183,7 @@ spec: valuesObject: global: licenseAccept: true - operatorNamespace: {{ $cpd_operators_ns }} + operatorNamespace: {{ $cpd_wml_operators_ns }} instanceNamespace: {{ $cpd_instance_ns }} imagePullSecret: ibm-entitlement-key syncPolicy: @@ -210,7 +216,7 @@ spec: project: "{{ .Values.argo.projects.apps }}" destination: server: {{ .Values.cluster.url }} - namespace: {{ $cpd_operators_ns }} + namespace: {{ $cpd_wml_operators_ns }} source: chart: wml-cluster-scoped repoURL: https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm @@ -220,7 +226,7 @@ spec: global: licenseAccept: true releaseVersion: {{ $cpd_version }} - operatorNamespace: {{ $cpd_operators_ns }} + operatorNamespace: {{ $cpd_wml_operators_ns }} instanceNamespace: {{ $cpd_instance_ns }} imagePullSecret: ibm-entitlement-key syncPolicy: @@ -268,7 +274,7 @@ spec: global: licenseAccept: true releaseVersion: {{ $cpd_version }} - operatorNamespace: {{ $cpd_operators_ns }} + operatorNamespace: {{ $cpd_wml_operators_ns }} instanceNamespace: {{ $cpd_instance_ns }} fileStorageClass: {{ .Values.ibm_wml.cpd_service_storage_class }} blockStorageClass: {{ .Values.ibm_wml.cpd_service_block_storage_class }} @@ -314,7 +320,7 @@ spec: project: "{{ .Values.argo.projects.apps }}" destination: server: {{ .Values.cluster.url }} - namespace: {{ $cpd_operators_ns }} + namespace: {{ $cpd_wml_operators_ns }} source: repoURL: "{{ .Values.source.repo_url }}" path: instance-applications/120-ibm-wml @@ -333,7 +339,7 @@ spec: application_admin_role: {{ .Values.application_admin_role }} sm_aws_access_key_id: "{{ .Values.sm.aws_access_key_id }}" sm_aws_secret_access_key: "{{ .Values.sm.aws_secret_access_key }}" - cpd_operators_namespace: "{{ .Values.ibm_cp4d.cpd_operators_namespace }}" + cpd_operators_namespace: "{{ $cpd_wml_operators_ns }}" cpd_instance_namespace: "{{ .Values.ibm_cp4d.cpd_instance_namespace }}" cpd_product_version: "{{ .Values.ibm_cp4d.cpd_product_version }}" cpd_service_storage_class: "{{ .Values.ibm_wml.cpd_service_storage_class }}" From 8fc060484ae01017a358d5f244eecab0ee26be8f Mon Sep 17 00:00:00 2001 From: Sakshi-Singhroha1 Date: Mon, 5 Oct 2026 16:48:45 +0530 Subject: [PATCH 103/103] Updated CLi image digest --- .../120-ibm-wml/templates/03-ibm-wml-post-verify.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml b/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml index 9fcf5263d..2d9820119 100644 --- a/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml +++ b/instance-applications/120-ibm-wml/templates/03-ibm-wml-post-verify.yaml @@ -8,7 +8,7 @@ Meaningful prefix for the job resource name. Must be under 52 chars in length to Use the build/bin/set-cli-image-digest.sh script to update this value across all charts. Included in $_job_hash (see below). */}} -{{- $_cli_image_digest := "sha256:1c5701a24c9796e02b33036f56babbe74032831e1db733ce9228a46dce4a870b" }} +{{- $_cli_image_digest := "sha256:020f1925421de13beaf439aa09181209875ed3791824bcaaf1daaf910c725266" }} {{- /* A dict of values that influence the behaviour of the job in some way.