[patch] Create secret for storing entitlement and artifactory token and remove it from param

Author: Bhautik Vala

src/mas/devops/tekton.py

@@ -843,17 +843,28 @@ def prepareAiServicePipelinesNamespace(
         logger.info(f"Storage class {storageClass} uses volumeBindingMode={volumeBindingMode}, skipping PVC bind wait")
 
 
-def prepareRestoreSecrets(dynClient: DynamicClient, namespace: str, restoreConfigs: dict = None):
+def prepareRestoreSecrets(
+    dynClient: DynamicClient,
+    namespace: str,
+    restoreConfigs: dict = None,
+    ibm_entitlement_key: str = None,
+    artifactory_token: str = None,
+    artifactory_username: str = None,
+):
     """
     Create or update secret required for MAS Restore pipeline.
 
-    Creates secret in the specified namespace:
+    Creates secrets in the specified namespace:
         - pipeline-restore-configs
+        - mas-devops-credentials (only when credentials are provided)
 
     Parameters:
         dynClient (DynamicClient): OpenShift Dynamic Client
         namespace (str): The namespace to create secrets in
         restoreConfigs (dict, optional): configuration data for restore. Defaults to None (empty secret).
+        ibm_entitlement_key (str, optional): IBM entitlement key for registry access. Defaults to None.
+        artifactory_token (str, optional): Artifactory token for dev catalog access. Defaults to None.
+        artifactory_username (str, optional): Artifactory username for dev catalog access. Defaults to None.
 
     Returns:
         None
@@ -880,6 +891,37 @@ def prepareRestoreSecrets(dynClient: DynamicClient, namespace: str, restoreConfi
         }
     secretsAPI.create(body=restoreConfigs, namespace=namespace)
 
+    # 2. Secret/mas-devops-credentials
+    # -------------------------------------------------------------------------
+    credentials_data = {}
+
+    if ibm_entitlement_key:
+        credentials_data["IBM_ENTITLEMENT_KEY"] = base64.b64encode(ibm_entitlement_key.encode()).decode()
+
+    if artifactory_token:
+        credentials_data["ARTIFACTORY_TOKEN"] = base64.b64encode(artifactory_token.encode()).decode()
+
+    if artifactory_username:
+        credentials_data["ARTIFACTORY_USERNAME"] = base64.b64encode(artifactory_username.encode()).decode()
+
+    if credentials_data:
+        try:
+            secretsAPI.delete(name="mas-devops-credentials", namespace=namespace)
+        except NotFoundError:
+            pass
+
+        secretsAPI.create(
+            body={
+                "apiVersion": "v1",
+                "kind": "Secret",
+                "type": "Opaque",
+                "metadata": {"name": "mas-devops-credentials"},
+                "data": credentials_data,
+            },
+            namespace=namespace,
+        )
+        logger.info(f"Created mas-devops-credentials secret in namespace {namespace}")
+
 
 def prepareInstallSecrets(
     dynClient: DynamicClient,
@@ -893,13 +935,17 @@ def prepareInstallSecrets(
     aiserviceConfig: str = None,
     db2LicenseFile: dict | None = None,
     facilitiesProperties: dict | None = None,
+    ibm_entitlement_key: str = None,
+    artifactory_token: str = None,
+    artifactory_username: str = None,
 ) -> None:
     """
     Create or update secrets required for MAS installation pipelines.
 
-    Creates secrets in the specified namespace: mas-devops-slack, pipeline-additional-configs,
-    pipeline-sls-entitlement, pipeline-certificates, pipeline-pod-templates, pipeline-aiservice-config,
-    pipeline-db2-license, and pipeline-facilities-properties.
+    Creates secrets in the specified namespace: mas-devops-slack, mas-devops-credentials,
+    pipeline-additional-configs, pipeline-sls-entitlement, pipeline-certificates,
+    pipeline-pod-templates, pipeline-aiservice-config, pipeline-db2-license, and
+    pipeline-facilities-properties.
 
     Parameters:
         dynClient (DynamicClient): OpenShift Dynamic Client
@@ -913,6 +959,9 @@ def prepareInstallSecrets(
         slack_channel (str, optional): Slack channel ID for notifications. Defaults to None.
         aiserviceConfig (str, optional): AI Service tenant config data. Defaults to None (empty secret).
         facilitiesProperties (dict, optional): Facilities properties file content. Defaults to None (empty secret).
+        ibm_entitlement_key (str, optional): IBM entitlement key for registry access. Defaults to None.
+        artifactory_token (str, optional): Artifactory token for dev catalog access. Defaults to None.
+        artifactory_username (str, optional): Artifactory username for dev catalog access. Defaults to None.
 
     Returns:
         None
@@ -959,6 +1008,40 @@ def prepareInstallSecrets(
         secretsAPI.create(body=mas_devops_secret, namespace=namespace)
         logger.info(f"Created mas-devops-slack secret with MAS_INSTANCE_ID={instance_id} in namespace {namespace}")
 
+    # 1. Secret/mas-devops-credentials
+    # -------------------------------------------------------------------------
+    # New secret holding registry credentials sourced from secret instead of pipeline params.
+    # Only created when at least one credential is provided — all keys are optional.
+    if instance_id:
+        credentials_data = {}
+
+        if ibm_entitlement_key:
+            credentials_data["IBM_ENTITLEMENT_KEY"] = base64.b64encode(ibm_entitlement_key.encode()).decode()
+
+        if artifactory_token:
+            credentials_data["ARTIFACTORY_TOKEN"] = base64.b64encode(artifactory_token.encode()).decode()
+
+        if artifactory_username:
+            credentials_data["ARTIFACTORY_USERNAME"] = base64.b64encode(artifactory_username.encode()).decode()
+
+        if credentials_data:
+            try:
+                secretsAPI.delete(name="mas-devops-credentials", namespace=namespace)
+            except NotFoundError:
+                pass
+
+            secretsAPI.create(
+                body={
+                    "apiVersion": "v1",
+                    "kind": "Secret",
+                    "type": "Opaque",
+                    "metadata": {"name": "mas-devops-credentials"},
+                    "data": credentials_data,
+                },
+                namespace=namespace,
+            )
+            logger.info(f"Created mas-devops-credentials secret in namespace {namespace}")
+
     # 1. Secret/pipeline-additional-configs
     # -------------------------------------------------------------------------
     # Must exist, but can be empty
@@ -1074,17 +1157,22 @@ def prepareUpdateSecrets(
     slack_token: str = None,
     slack_channel: str = None,
     db2LicenseFile: dict | None = None,
+    artifactory_token: str = None,
+    artifactory_username: str = None,
 ) -> None:
     """
     Create or update mas-devops-slack secret in mas-pipelines namespace for update pipeline.
 
     Creates the slack secret in mas-pipelines namespace if it exists and slack credentials are provided.
+    Also creates mas-devops-credentials secret if artifactory credentials are provided.
 
     Parameters:
         dynClient (DynamicClient): OpenShift Dynamic Client
         slack_token (str, optional): Slack bot token for notifications. Defaults to None.
         slack_channel (str, optional): Slack channel ID for notifications. Defaults to None.
         db2LicenseFile (dict, optional): Db2 license file content. Defaults to None (empty secret).
+        artifactory_token (str, optional): Artifactory token for dev catalog access. Defaults to None.
+        artifactory_username (str, optional): Artifactory username for dev catalog access. Defaults to None.
 
     Returns:
         None
@@ -1152,6 +1240,34 @@ def prepareUpdateSecrets(
     secretsAPI.create(body=mas_devops_secret, namespace=namespace)
     logger.info(f"Created mas-devops-slack secret in namespace {namespace}")
 
+    # Create mas-devops-credentials if artifactory credentials are provided
+    # Note: update pipeline does not use ibm_entitlement_key (skipped via skip_entitlement_key_flag)
+    credentials_data = {}
+
+    if artifactory_token:
+        credentials_data["ARTIFACTORY_TOKEN"] = base64.b64encode(artifactory_token.encode()).decode()
+
+    if artifactory_username:
+        credentials_data["ARTIFACTORY_USERNAME"] = base64.b64encode(artifactory_username.encode()).decode()
+
+    if credentials_data:
+        try:
+            secretsAPI.delete(name="mas-devops-credentials", namespace=namespace)
+        except NotFoundError:
+            pass
+
+        secretsAPI.create(
+            body={
+                "apiVersion": "v1",
+                "kind": "Secret",
+                "type": "Opaque",
+                "metadata": {"name": "mas-devops-credentials"},
+                "data": credentials_data,
+            },
+            namespace=namespace,
+        )
+        logger.info(f"Created mas-devops-credentials secret in namespace {namespace}")
+
 
 def testCLI() -> None:
     pass

src/mas/devops/templates/pipelinerun-aiservice-upgrade.yml.j2

@@ -22,27 +22,12 @@ spec:
     - name: aiservice_channel
       value: "{{ aiservice_channel }}"
 
-    # IBM Entitlement Key
-    # -------------------------------------------------------------------------
-    - name: ibm_entitlement_key
-      value: "{{ ibm_entitlement_key }}"
-
 {%- if skip_pre_check is defined and skip_pre_check != "" %}
     # Skip pre-check
     # -------------------------------------------------------------------------
     - name: skip_pre_check
       value: "{{ skip_pre_check }}"
 {%- endif %}
-{%- if artifactory_username is defined and artifactory_username != "" %}
-
-    # Enable development catalogs
-    # -------------------------------------------------------------------------
-    - name: artifactory_username
-      value: "{{ artifactory_username }}"
-    - name: artifactory_token
-      value: "{{ artifactory_token }}"
-{%- endif %}
-
   workspaces:
     # The generated configuration files
     # -------------------------------------------------------------------------

src/mas/devops/templates/pipelinerun-backup.yml.j2

@@ -74,16 +74,6 @@ spec:
       value: "{{ cert_manager_provider }}"
     {% endif %}
 
-    # Development Build Support
-    {% if artifactory_username is defined and artifactory_username != "" %}
-    - name: artifactory_username
-      value: "{{ artifactory_username }}"
-    {% endif %}
-    {% if artifactory_token is defined and artifactory_token != "" %}
-    - name: artifactory_token
-      value: "{{ artifactory_token }}"
-    {% endif %}
-
     # Upload Configuration
     {% if upload_backup is defined and upload_backup != "" %}
     - name: upload_backup

src/mas/devops/templates/pipelinerun-install.yml.j2

@@ -19,10 +19,6 @@ spec:
     pipeline: "0"
 
   params:
-    # IBM Entitlement Key
-    # -------------------------------------------------------------------------
-    - name: ibm_entitlement_key
-      value: "{{ ibm_entitlement_key }}"
 {%- if skip_pre_check is defined and skip_pre_check != "" %}
 
     # Pipeline config
@@ -44,15 +40,6 @@ spec:
     - name: ocp_ingress_tls_secret_name
       value: "{{ ocp_ingress_tls_secret_name }}"
 {%- endif %}
-{%- if artifactory_username is defined and artifactory_username != "" %}
-
-    # Enable development catalogs
-    # -------------------------------------------------------------------------
-    - name: artifactory_username
-      value: "{{ artifactory_username }}"
-    - name: artifactory_token
-      value: "{{ artifactory_token }}"
-{%- endif %}
 {%- if ibmcloud_apikey is defined and ibmcloud_resourcegroup != "" %}
 
     # IBM Cloud

src/mas/devops/templates/pipelinerun-restore.yml.j2

@@ -99,10 +99,6 @@ spec:
     - name: dro_contact_lastname
       value: "{{ dro_contact_lastname }}"
     {% endif %}
-    {% if ibm_entitlement_key is defined and ibm_entitlement_key != "" %}
-    - name: ibm_entitlement_key
-      value: "{{ ibm_entitlement_key }}"
-    {% endif %}
     {% if dro_namespace is defined and dro_namespace != "" %}
     - name: dro_namespace
       value: "{{ dro_namespace }}"
@@ -148,16 +144,6 @@ spec:
       value: "{{ cert_manager_provider }}"
     {% endif %}
 
-    # Development Build Support
-    {% if artifactory_username is defined and artifactory_username != "" %}
-    - name: artifactory_username
-      value: "{{ artifactory_username }}"
-    {% endif %}
-    {% if artifactory_token is defined and artifactory_token != "" %}
-    - name: artifactory_token
-      value: "{{ artifactory_token }}"
-    {% endif %}
-
     # Download Configuration
     {% if backup_archive_name is defined and backup_archive_name != "" %}
     - name: backup_archive_name

src/mas/devops/templates/pipelinerun-update.yml.j2

@@ -28,19 +28,6 @@ spec:
     - name: mas_catalog_version
       value: "{{ mas_catalog_version }}"
 
-{%- if ibm_entitlement_key is defined and ibm_entitlement_key != "" %}
-    # TODO: What even uses this, nothing in the update pipeline should be using this
-    - name: ibm_entitlement_key
-      value: "{{ ibm_entitlement_key }}"
-{%- endif %}
-{%- if artifactory_username is defined and artifactory_username != "" %}
-    # Enable development catalogs
-    # -------------------------------------------------------------------------
-    - name: artifactory_username
-      value: "{{ artifactory_username }}"
-    - name: artifactory_token
-      value: "{{ artifactory_token }}"
-{%- endif %}
 {%- if skip_pre_check is defined and skip_pre_check != "" %}
     # Skip pre-check
     # -------------------------------------------------------------------------

src/mas/devops/templates/pipelinerun-upgrade.yml.j2

@@ -30,26 +30,12 @@ spec:
     - name: mas_channel
       value: "{{ mas_channel }}"
 
-    # IBM Entitlement Key
-    # -------------------------------------------------------------------------
-    - name: ibm_entitlement_key
-      value: "{{ ibm_entitlement_key }}"
-
 {%- if skip_pre_check is defined and skip_pre_check != "" %}
     # Skip pre-check
     # -------------------------------------------------------------------------
     - name: skip_pre_check
       value: "{{ skip_pre_check }}"
 {%- endif %}
-{%- if artifactory_username is defined and artifactory_username != "" %}
-
-    # Enable development catalogs
-    # -------------------------------------------------------------------------
-    - name: artifactory_username
-      value: "{{ artifactory_username }}"
-    - name: artifactory_token
-      value: "{{ artifactory_token }}"
-{%- endif %}
 {%- if db2_action_system == "install" or db2_action_manage == "install" %}
 
     # Dependencies - Db2 - Actions