MASCORE-13194: Fix MREF AES encryption keystore not the same amongst all customer instances by LamyaG10 · Pull Request #2437 · ibm-mas/cli

LamyaG10 · 2026-06-26T14:21:30Z

Isuue

https://jsw.ibm.com/browse/MASCORE-13194

Description

Implemented ICN (IBM Customer Number) extraction from multiple sources to support customer-level secrets in Facilities and other MAS applications, enabling both standard and centralized SLS deployments.

Direct ICN (SLS_LICENSE_ICN): Pre-configured ICN passed directly via environment variable (highest priority)

Entitlement ICN (LICENSE_FILE): Extracted from license file content for standard SLS deployments

Centralized ICN (CENTRALIZED_SLS_SERVICE): Extracted from centralized SLS service path for shared SLS deployments

Screenshots

Direct ICN

SLS configuration

Parameters

APP-CFG-FACILTIES LOG - ICN EXTRACTION & PASSWORD SETUP

Entitlement LIC

SLS configuration

APP-CFG-FACILTIES LOG - ICN EXTRACTION & PASSWORD SETUP

Centralized ICN

SLS configuration

APP-CFG-FACILTIES LOG - ICN EXTRACTION

APP-CFG-FACILTIES LOG - PASSWORD SETUP

…ation

…ilities secrets

…ic section.

…word function

…_config

…emplate

mnivedithaa · 2026-06-29T04:28:35Z

-          echo "Error: Secret name $FACILITIES_LIBERTY_EXTENSIONS_SECRET_NAME does not match ${MAS_WORKSPACE_ID}-facilities-lexml--sn" 
+
+      # Sanitize ICN to prevent path injection (allow only alphanumeric, underscore, hyphen)
+      SANITIZED_ICN=$(echo "${ICN}" | tr -cd 'A-Za-z0-9_-')


We need to use the passed ICN value as is

mnivedithaa · 2026-06-29T04:36:50Z


-
-
 function gitops_suite_app_config_help() {


Pass the newly added params to this function

mnivedithaa · 2026-06-29T04:37:42Z

+  fi
+
+  # Try SLS_LICENSE_FILE if LICENSE_FILE didn't work
+  if [[ -z "${ICN}" ]] && [[ -n "${SLS_LICENSE_FILE}" ]] && [[ -f "${SLS_LICENSE_FILE}" ]]; then


Only LICENSE_FILE is passed. In that case, we need not check SLS_LICENSE_FILE

mnivedithaa · 2026-06-29T04:38:21Z

+    - name: sls_license_icn
+      value: $(params.sls_license_icn)
+    - name: centralized_sls_service
+      value: $(params.centralized_sls_service)


This info is required only for Facilities. Need to be removed for other apps

LamyaG10

Have made the requested changes.

whitfiea · 2026-06-29T07:04:09Z

+    # Source gitops_utils unconditionally in callback context
+    # Nested functions require explicit sourcing even if parent has it loaded
+    if [[ -n "${CLI_DIR}" ]]; then
+      echo "DEBUG: Sourcing ${CLI_DIR}/functions/gitops_utils"
+      ls -l "${CLI_DIR}/functions/gitops_utils" || echo "WARNING: File not found"
+      if ! source "${CLI_DIR}/functions/gitops_utils"; then
+        echo "ERROR: Failed to source gitops_utils from ${CLI_DIR}/functions/gitops_utils"
+        exit 1
+      fi
+    else
+      DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+      echo "DEBUG: Sourcing ${DIR}/gitops_utils"
+      ls -l "${DIR}/gitops_utils" || echo "WARNING: File not found"
+      if ! source "${DIR}/gitops_utils"; then
+        echo "ERROR: Failed to source gitops_utils from ${DIR}/gitops_utils"
+        exit 1
+      fi
+    fi
+    echo "- Sourced gitops_utils in apply_suite_app_config_changes callback"


we shouldn't need to source the gitops_utils as it should already be sourced

whitfiea · 2026-06-29T07:05:18Z

+    declare -F manage_customer_mref_password || echo "WARNING: Function not found in declare -F"
+
+    if ! declare -F manage_customer_mref_password >/dev/null; then
+      echo "ERROR: manage_customer_mref_password function not loaded after sourcing gitops_utils"
+      echo "DEBUG: Checking file contents for function definition"
+      if [[ -n "${CLI_DIR}" ]]; then
+        grep -n "^function manage_customer_mref_password" "${CLI_DIR}/functions/gitops_utils" || echo "Function definition not found in file"
+      else
+        grep -n "^function manage_customer_mref_password" "${DIR}/gitops_utils" || echo "Function definition not found in file"
+      fi
+      exit 1
+    fi


the code is delivered as a container image so the function in gitops_utils will be available so no need to check it

whitfiea · 2026-06-29T07:05:44Z

      --manage-update-schedule ${COLOR_YELLOW}MANAGE_UPDATE_SCHEDULE${TEXT_RESET}                         Cron based schedule to indicate when manage will do the offline update when the onlineUpgrade is set in the ManageWorkspace CR. Optional as default is  "0 0 * * *"

+SLS License Configuration:
+      --sls-license-icn ${COLOR_YELLOW}SLS_LICENSE_ICN${TEXT_RESET}                                       SLS License ICN (Installation Customer Number)


It is "IBM customer number"

whitfiea · 2026-06-29T07:10:10Z

+      --license-file ${COLOR_YELLOW}LICENSE_FILE${TEXT_RESET}                                             Path to SLS license file (ICN will be extracted)
+      --centralized-sls-service ${COLOR_YELLOW}CENTRALIZED_SLS_SERVICE${TEXT_RESET}                       Centralized SLS service path


it isn't obvious that you only need one of these and not all three. Can we update the description to say what order these will be check in, i.e. the SLS_LICENSE_ICN first, and if that is not set then LICENSE_FILE and if that is not set then CENTRALIZED_SLS_SERVICE (which I think is a ref path to something? that might need an example or pointer to another function)

whitfiea · 2026-06-29T07:10:25Z

+  if ! type manage_customer_mref_password &>/dev/null; then
+    if [[ -n "${CLI_DIR}" ]]; then
+      if ! source "${CLI_DIR}/functions/gitops_utils"; then
+        echo "ERROR: Failed to source gitops_utils from ${CLI_DIR}/functions/gitops_utils"
+        exit 1
+      fi
+    else
+      DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+      if ! source "${DIR}/gitops_utils"; then
+        echo "ERROR: Failed to source gitops_utils from ${DIR}/gitops_utils"
+        exit 1
+      fi
+    fi
+    echo "- Sourced gitops_utils for manage_customer_mref_password function"
+  fi


shouldn't need this

LamyaG10 added 27 commits June 5, 2026 17:57

Implemented customer-level MREF AES keystore password changes

8f984a2

MASCORE-13194: fix ICN extraction, Facilities secret paths, and valid…

2050028

…ation

MASCORE-13194: add customer-level MREF password for Facilities

98377c8

fix(MASCORE-13194): Extract ICN from mas-instance-params.yaml for Fac…

bad0c14

…ilities secrets

fix(MASCORE-13194): Move ICN extraction to after repo clone

491a4c4

chore: Update secrets baseline

3359275

Fix: Move ICN extraction to run for ALL apps before the Manage-specif…

b99f57f

…ic section.

fix(MASCORE-13194): Include REGION in gitops instance directory path

7fa8bda

fix(MASCORE-13194): Remove mas-instance-params.yaml ICN extraction

51c38db

fix(MASCORE-13194): Remove REGION from GITOPS_INSTANCE_DIR path

183a7ab

fix(MASCORE-13194): Source gitops_utils for manage_customer_mref_pass…

a17d388

…word function

fix(MASCORE-13194): Load gitops_utils dynamically in gitops_suite_app…

d8b30ba

…_config

fix(MASCORE-13194):Fix customer-level MREF password handling

65a15c1

fix(MASCORE-13194): Add pragma comments for detect-secrets

6738e36

fix(MASCORE-13194): Fix missing closing brace and add diagnostics

8cd9359

fix(MASCORE-13194): Add missing separator in Facilities secret path t…

a44b1d4

…emplate

chore(MASCORE-13194): Trigger rebuild with template separator fix

10b5ea0

chore(MASCORE-13194): Update secrets baseline for pre-commit

8b26dd3

dummy

b44709d

changed the icn retrieving regex

715c6ca

Made sls_license_icn to take as a parameter

81db7e1

Add sls_license_icn parameter to gitops-suite-app-config task

ce67b73

Add sls_license_icn parameter to gitops-mas-apps

2c64e66

Add centrqlized parameter to gitops-mas-apps

987b551

Modifications for centralized sls

3066956

Modifications for centralized sls

52a1091

Modifications for centralized sls

b04818e

LamyaG10 requested a review from mnivedithaa June 26, 2026 14:21

LamyaG10 requested a review from a team as a code owner June 26, 2026 14:21

LamyaG10 requested a review from rbinns June 29, 2026 04:18

Merge branch 'master' into mascore-13194

b9ad76b

mnivedithaa requested changes Jun 29, 2026

View reviewed changes

Modifications based on comments

8f14588

LamyaG10 commented Jun 29, 2026

View reviewed changes

whitfiea requested changes Jun 29, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

MASCORE-13194: Fix MREF AES encryption keystore not the same amongst all customer instances#2437

MASCORE-13194: Fix MREF AES encryption keystore not the same amongst all customer instances#2437
LamyaG10 wants to merge 29 commits into
masterfrom
mascore-13194

LamyaG10 commented Jun 26, 2026

Uh oh!

mnivedithaa Jun 29, 2026

Uh oh!

mnivedithaa Jun 29, 2026

Uh oh!

mnivedithaa Jun 29, 2026

Uh oh!

mnivedithaa Jun 29, 2026

Uh oh!

LamyaG10 left a comment

Uh oh!

whitfiea Jun 29, 2026

Uh oh!

whitfiea Jun 29, 2026

Uh oh!

whitfiea Jun 29, 2026

Uh oh!

whitfiea Jun 29, 2026

Uh oh!

whitfiea Jun 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		--license-file ${COLOR_YELLOW}LICENSE_FILE${TEXT_RESET} Path to SLS license file (ICN will be extracted)
		--centralized-sls-service ${COLOR_YELLOW}CENTRALIZED_SLS_SERVICE${TEXT_RESET} Centralized SLS service path

Uh oh!

Conversation

LamyaG10 commented Jun 26, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

LamyaG10 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants