[major] FVT Implement Workflow for Saas AI Services

instance-applications/113-ibm-aiservice/templates/03-aiservice-jdbc.yaml

@@ -12,6 +12,6 @@ data:
   password: {{ .Values.jdbccfg_password  | default "" | toString | b64enc | quote }}
   url: {{ .Values.jdbccfg_url  | default "" | toString | b64enc | quote }}
   sslenabled: {{ .Values.jdbccfg_sslenabled  | default "" | toString | b64enc | quote }}
-  certificate: {{ .Values.jdbccfg_ca_b64enc }}
+  certificate: {{ .Values.jdbccfg_ca_b64enc | default "" | toString | quote }}
 type: Opaque
 {{- end }}

instance-applications/113-ibm-aiservice/values.yaml

@@ -76,6 +76,7 @@ mas_icr_cpopen: "icr.io/cpopen"
 
 cluster_domain: "_cluster_dns.resources[0].spec.baseDomain"
 in_saas_env: "false"
+is_gitops_fvt_env: "false"
 
 #TENANT
 mas_aiservice_tenant_name: "aiservice-{{ mas_aiservice_tenant_name }}"

instance-applications/115-ibm-aiservice-tenant/README.md

@@ -20,6 +20,8 @@ This chart provisions a tenant for Maximo AI Service. It installs the AI Service
 | `ServiceAccount` | Migration and post-sync service accounts | Tenant namespace | Always | `application_admin_role` |
 | `Role` | Migration and post-sync roles | Tenant namespace | Always | `application_admin_role` |
 | `RoleBinding` | Migration and post-sync role bindings | Tenant namespace | Always | `application_admin_role` |
+| `ClusterRole` | Tenant cluster-level permissions | Cluster-wide | Always | `application_admin_role` |
+| `ClusterRoleBinding` | Tenant cluster role bindings | Cluster-wide | Always | `application_admin_role` |
 | `NetworkPolicy` | Tenant migration and ingress network policies | Tenant namespace | Always | `application_admin_role` |
 | `Job` | Migration, post-sync, and secret setup jobs | Tenant namespace | Always | `application_admin_role` |
 

instance-applications/115-ibm-aiservice-tenant/templates/08-aiservice-postsyncjob.yaml

@@ -170,9 +170,33 @@ spec:
               echo "Retrieve AIBroker API Key for tenant: ${AISERVICE_TENANT}"
               echo "================================================================================"
 
-              AISERVICE_APIKEY_SECRET=$(oc get secret ${AISERVICE_TENANT}----apikey-secret -n ${TARGET_NAMESPACE} -o jsonpath="{.data.AIBROKER_APIKEY}" | base64 --decode)
+              # Wait for the apikey-secret to be created by the AIService operator
+              # The operator creates this secret after the AIServiceTenant CR is reconciled
+              SECRET_NAME="${AISERVICE_TENANT}----apikey-secret"
+              MAX_RETRIES=30
+              RETRY_DELAY=10
+
+              echo "Waiting for secret ${SECRET_NAME} to be created in namespace ${TARGET_NAMESPACE}..."
+              for i in $(seq 1 $MAX_RETRIES); do
+                if oc get secret ${SECRET_NAME} -n ${TARGET_NAMESPACE} > /dev/null 2>&1; then
+                  echo "Secret ${SECRET_NAME} found (attempt $i/$MAX_RETRIES)"
+                  break
+                fi
+
+                if [ $i -eq $MAX_RETRIES ]; then
+                  echo "ERROR: Secret ${SECRET_NAME} not found after ${MAX_RETRIES} attempts"
+                  echo "The AIService operator may not have created the secret yet"
+                  exit 1
+                fi
+
+                echo "Secret not found yet, waiting ${RETRY_DELAY}s... (attempt $i/$MAX_RETRIES)"
+                sleep $RETRY_DELAY
+              done
+
+              AISERVICE_APIKEY_SECRET=$(oc get secret ${SECRET_NAME} -n ${TARGET_NAMESPACE} -o jsonpath="{.data.AIBROKER_APIKEY}" | base64 --decode)
               if [ -z "$AISERVICE_APIKEY_SECRET" ]; then
-                echo "AISERVICE_APIKEY_SECRET is empty"
+                echo "ERROR: AISERVICE_APIKEY_SECRET is empty in secret ${SECRET_NAME}"
+                echo "The secret exists but does not contain the AIBROKER_APIKEY field"
                 exit 1
               fi