[minor] Use secret for entitlement key and artifactory token and remove it as a param of tekton pipeline

python/src/mas/cli/aiservice/install/app.py

@@ -607,6 +607,9 @@ def install(self, argv):
                     aiserviceConfig=self.aiserviceConfigSecret,
                     slack_token=self.getParam("slack_token"),
                     slack_channel=self.getParam("slack_channel"),
+                    ibm_entitlement_key=self.getParam("ibm_entitlement_key"),
+                    artifactory_token=self.getParam("artifactory_token"),
+                    artifactory_username=self.getParam("artifactory_username"),
                 )
 
                 self.setupApprovals(pipelinesNamespace)

python/src/mas/cli/backup/app.py

@@ -22,7 +22,7 @@
 from .argParser import backupArgParser
 from mas.devops.ocp import createNamespace, getConsoleURL, getStorageClasses
 from mas.devops.mas import listMasInstances, getDefaultStorageClasses, getWorkspaceId
-from mas.devops.tekton import preparePipelinesNamespace, installOpenShiftPipelines, updateTektonDefinitions, launchBackupPipeline
+from mas.devops.tekton import preparePipelinesNamespace, installOpenShiftPipelines, updateTektonDefinitions, launchBackupPipeline, prepareBackupSecrets
 
 logger = logging.getLogger(__name__)
 
@@ -249,6 +249,12 @@ def backup(self, argv):
                     createBackupPVC=True,
                     backupStorageSize=backupStorageSize,
                 )
+                prepareBackupSecrets(
+                    dynClient=self.dynamicClient,
+                    namespace=pipelinesNamespace,
+                    artifactory_token=self.getParam("artifactory_token"),
+                    artifactory_username=self.getParam("artifactory_username"),
+                )
                 h.stop_and_persist(symbol=self.successIcon, text=f"Namespace is ready ({pipelinesNamespace})")
 
             with Halo(text=f"Installing latest Tekton definitions (v{self.version})", spinner=self.spinner) as h:

python/src/mas/cli/install/app.py

@@ -3165,6 +3165,9 @@ def install(self, argv):
                     aiserviceConfig=self.aiserviceConfigSecret,
                     slack_token=self.getParam("slack_token"),
                     slack_channel=self.getParam("slack_channel"),
+                    ibm_entitlement_key=self.getParam("ibm_entitlement_key"),
+                    artifactory_token=self.getParam("artifactory_token"),
+                    artifactory_username=self.getParam("artifactory_username"),
                 )
 
                 self.setupApprovals(pipelinesNamespace)

python/src/mas/cli/restore/app.py

@@ -332,7 +332,14 @@ def restore(self, argv):
                 )
 
                 # Apply config file secrets to the namespace
-                prepareRestoreSecrets(dynClient=self.dynamicClient, namespace=pipelinesNamespace, restoreConfigs=self.configSecret)
+                prepareRestoreSecrets(
+                    dynClient=self.dynamicClient,
+                    namespace=pipelinesNamespace,
+                    restoreConfigs=self.configSecret,
+                    ibm_entitlement_key=self.getParam("ibm_entitlement_key"),
+                    artifactory_token=self.getParam("artifactory_token"),
+                    artifactory_username=self.getParam("artifactory_username"),
+                )
 
                 h.stop_and_persist(symbol=self.successIcon, text=f"Namespace is ready ({pipelinesNamespace})")
 

python/src/mas/cli/update/app.py

@@ -378,6 +378,8 @@ def update(self, argv):
                     slack_token=self.getParam("slack_token"),
                     slack_channel=self.getParam("slack_channel"),
                     db2LicenseFile=self.db2LicenseFileSecret,
+                    artifactory_token=self.getParam("artifactory_token"),
+                    artifactory_username=self.getParam("artifactory_username"),
                 )
 
             with Halo(text=f"Installing latest Tekton definitions (v{self.version})", spinner=self.spinner) as h:

python/src/mas/cli/upgrade/app.py

@@ -34,7 +34,14 @@
     getInstalledApps,
 )
 from mas.devops.utils import isVersionEqualOrAfter
-from mas.devops.tekton import preparePipelinesNamespace, installOpenShiftPipelines, updateTektonDefinitions, launchUpgradePipeline, lookupPipelineStorageClass
+from mas.devops.tekton import (
+    preparePipelinesNamespace,
+    installOpenShiftPipelines,
+    updateTektonDefinitions,
+    launchUpgradePipeline,
+    lookupPipelineStorageClass,
+    prepareUpgradeSecrets,
+)
 from mas.devops.pre_install import applyPreInstallMASRBAC
 from ..rbac_utils import evaluatePreinstallRBACAccess
 
@@ -594,6 +601,13 @@ def channelOrder(ch):
                     storageClass=self.pipelineStorageClass,
                     accessMode=self.pipelineStorageAccessMode,
                 )
+                prepareUpgradeSecrets(
+                    dynClient=self.dynamicClient,
+                    namespace=pipelinesNamespace,
+                    ibm_entitlement_key=self.getParam("ibm_entitlement_key"),
+                    artifactory_token=self.getParam("artifactory_token"),
+                    artifactory_username=self.getParam("artifactory_username"),
+                )
                 h.stop_and_persist(symbol=self.successIcon, text=f"Namespace is ready ({pipelinesNamespace})")
 
             with Halo(text=f"Installing latest Tekton definitions (v{self.version})", spinner=self.spinner) as h:

tekton/src/params/backup.yml.j2

@@ -194,11 +194,6 @@
   default: ""
   description: Required for DRO installation during restore
 
-- name: ibm_entitlement_key
-  type: string
-  default: ""
-  description: Required for DRO installation during restore
-
 # Restore-specific Configuration
 # -----------------------------------------------------------------------------
 - name: mas_domain_on_restore

tekton/src/params/common.yml.j2

@@ -6,15 +6,13 @@
   default: IfNotPresent
   description: Pull policy for pipeline container images
 
-# Development Build Support
-- name: artifactory_username
-  default: ""
-  type: string
-  description: Required to install development MAS catalogs
-- name: artifactory_token
-  default: ""
+# Registry Credentials Secret
+# "mas-secrets" as default avoids empty-string secretKeyRef.name which Kubernetes rejects at pod scheduling
+# even with optional: true. Taskdefs with registry-secret-param.yml.j2 always override this except FVTs tasks.
+- name: pipeline_registry_secret_name
   type: string
-  description: Required to install development MAS catalogs
+  default: "mas-secrets"
+  description: Name of the per-pipeline Kubernetes Secret holding registry credentials (IBM_ENTITLEMENT_KEY, ARTIFACTORY_TOKEN, ARTIFACTORY_USERNAME)
 
 # Custom Labels
 - name: custom_labels

tekton/src/params/install-common.yml.j2

@@ -9,12 +9,6 @@
   default: ""
   description: ReadWriteMany storage class
 
-# Entitlement
-# -----------------------------------------------------------------------------
-- name: ibm_entitlement_key
-  type: string
-  description: IBM Entitlement Key
-
 # Pipeline config
 # -----------------------------------------------------------------------------
 - name: skip_pre_check

tekton/src/pipelines/aiservice-upgrade.yml.j2

@@ -73,6 +73,7 @@ spec:
     - name: aiservice-upgrade
       timeout: "0"
       params:
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
         - name: aiservice_instance_id
           value: $(params.aiservice_instance_id)
         - name: aiservice_channel

tekton/src/pipelines/mas-backup.yml.j2

@@ -78,6 +78,7 @@ spec:
       timeout: "0"
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: devops_suite_name
           value: backup-ibm-catalogs
@@ -87,11 +88,6 @@ spec:
         - name: ibm_catalogs_action
           value: backup
 
-        - name: artifactory_username
-          value: $(params.artifactory_username)
-        - name: artifactory_token
-          value: $(params.artifactory_token)
-
       taskRef:
         kind: Task
         name: mas-devops-ibm-catalogs
@@ -107,6 +103,7 @@ spec:
       timeout: "0"
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: devops_suite_name
           value: backup-cert-manager
@@ -134,6 +131,7 @@ spec:
       timeout: "0"
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: devops_suite_name
           value: backup-mongodb
@@ -173,6 +171,7 @@ spec:
       timeout: "0"
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: mas_instance_id
           value: $(params.mas_instance_id)
@@ -208,6 +207,7 @@ spec:
       timeout: "0"
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: mas_instance_id
           value: $(params.mas_instance_id)
@@ -240,6 +240,7 @@ spec:
           values: ["true", "True"]
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: mas_instance_id
           value: $(params.mas_instance_id)
@@ -288,6 +289,7 @@ spec:
           values: ["true", "True"]
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: mas_instance_id
           value: $(params.mas_instance_id)
@@ -322,6 +324,7 @@ spec:
           values: ["true", "True"]
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: mas_instance_id
           value: $(params.mas_instance_id)
@@ -370,6 +373,7 @@ spec:
           values: ["true", "True"]
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: mas_instance_id
           value: $(params.mas_instance_id)
@@ -404,6 +408,7 @@ spec:
           values: ["true", "True"]
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: backup_version
           value: $(params.backup_version)
@@ -423,10 +428,6 @@ spec:
           value: $(params.s3_endpoint_url)
 
         # Artifactory parameters
-        - name: artifactory_username
-          value: $(params.artifactory_username)
-        - name: artifactory_token
-          value: $(params.artifactory_token)
         - name: artifactory_url
           value: $(params.artifactory_url)
         - name: artifactory_repository

tekton/src/pipelines/mas-restore.yml.j2

@@ -84,6 +84,7 @@ spec:
       timeout: "0"
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/backup-restore/restore-params.yml.j2') | indent(8) }}
 
@@ -121,10 +122,6 @@ spec:
           value: $(params.s3_endpoint_url)
 
         # Artifactory parameters
-        - name: artifactory_username
-          value: $(params.artifactory_username)
-        - name: artifactory_token
-          value: $(params.artifactory_token)
         - name: artifactory_url
           value: $(params.artifactory_url)
         - name: artifactory_repository
@@ -150,6 +147,7 @@ spec:
       timeout: "0"
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/backup-restore/restore-params.yml.j2') | indent(8) }}
 
@@ -177,6 +175,7 @@ spec:
       timeout: "0"
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/backup-restore/restore-params.yml.j2') | indent(8) }}
 
@@ -204,6 +203,7 @@ spec:
       timeout: "0"
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/backup-restore/restore-params.yml.j2') | indent(8) }}
 
@@ -230,6 +230,7 @@ spec:
       timeout: "0"
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/backup-restore/restore-params.yml.j2') | indent(8) }}
 
@@ -272,6 +273,7 @@ spec:
       timeout: "0"
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/backup-restore/restore-params.yml.j2') | indent(8) }}
 
@@ -310,6 +312,7 @@ spec:
       timeout: "0"
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/backup-restore/restore-params.yml.j2') | indent(8) }}
 
@@ -329,8 +332,6 @@ spec:
           value: "$(params.dro_contact_firstname)"
         - name: dro_contact_lastname
           value: "$(params.dro_contact_lastname)"
-        - name: ibm_entitlement_key
-          value: $(params.ibm_entitlement_key)
         - name: dro_namespace
           value: $(params.dro_namespace)
         - name: dro_storage_class
@@ -356,6 +357,7 @@ spec:
       timeout: "0"
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/backup-restore/restore-params.yml.j2') | indent(8) }}
 
@@ -418,6 +420,7 @@ spec:
           values: ["true", "True"]
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: db2_action
           value: restore
@@ -457,6 +460,7 @@ spec:
           values: ["true", "True"]
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: mas_instance_id
           value: $(params.mas_instance_id)
@@ -497,6 +501,7 @@ spec:
           values: ["true", "True"]
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: db2_action
           value: restore
@@ -536,6 +541,7 @@ spec:
           values: ["true", "True"]
       params:
         {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/cli-params.yml.j2') | indent(8) }}
+        {{ lookup('template', pipeline_src_dir ~ '/taskdefs/common/registry-secret-param.yml.j2') | indent(8) }}
 
         - name: mas_instance_id
           value: $(params.mas_instance_id)