[major] FVT Implement Workflow for Saas AI Services

.github/workflows/build-cli.yml

@@ -143,7 +143,7 @@ jobs:
         id: test
         run: |
           cd $GITHUB_WORKSPACE/python
-          pytest
+          pytest --trace
 
       - name: Build
         id: build

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "build/bin/config/oscap/ssg-rhel9-ds.xml|^.secrets.baseline$|^docs/catalogs/",
     "lines": null
   },
-  "generated_at": "2026-05-20T23:47:35Z",
+  "generated_at": "2026-05-29T20:58:44Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -210,39 +210,47 @@
         "hashed_secret": "6ffb91fd9c01e69b8e9093d84439c8b88dd8fe35",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 76,
+        "line_number": 77,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "db40a6131d9b574bb057875df98fb03f9874d5b4",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 92,
+        "line_number": 93,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "6fbaa59234a602571baf17a51592b436b33f8491",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 93,
+        "line_number": 94,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "bd1b0b7f343605538b1da78056db3a7bddf3f807",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 96,
+        "line_number": 97,
+        "type": "Secret Keyword",
+        "verified_result": null
+      },
+      {
+        "hashed_secret": "d8a1d01c81ccc3a024b078bd0af28e40cb38cdc4",
+        "is_secret": true,
+        "is_verified": false,
+        "line_number": 285,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 312,
+        "line_number": 354,
         "type": "Secret Keyword",
         "verified_result": null
       }
@@ -252,7 +260,7 @@
         "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 374,
+        "line_number": 382,
         "type": "Secret Keyword",
         "verified_result": null
       }
@@ -347,6 +355,16 @@
         "verified_result": null
       }
     ],
+    "image/cli/mascli/functions/gitops_deprovision_kmodel": [
+      {
+        "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 173,
+        "type": "Secret Keyword",
+        "verified_result": null
+      }
+    ],
     "image/cli/mascli/functions/gitops_deprovision_mongo": [
       {
         "hashed_secret": "2582aea6f911bd00fc04cb25e0ec16d5ead62068",
@@ -362,7 +380,7 @@
         "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 188,
+        "line_number": 170,
         "type": "Secret Keyword",
         "verified_result": null
       }
@@ -405,6 +423,16 @@
         "verified_result": null
       }
     ],
+    "image/cli/mascli/functions/gitops_kmodel": [
+      {
+        "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 335,
+        "type": "Secret Keyword",
+        "verified_result": null
+      }
+    ],
     "image/cli/mascli/functions/gitops_license": [
       {
         "hashed_secret": "b2817467154949a61f8e9ad31d1eeaf03221cbfa",

README.md

@@ -18,4 +18,5 @@ Documentation
 Want to contribute to MAS Command Line Interface?
 -------------------------------------------------------------------------------
 We welcome every Maximo Application Suite users, developers and enthusiasts to contribute to the MAS Command Line Interface while fixing code issues and implementing new automated functionalities.
+
 You can contribute to this collection by raising [a new issue](https://github.com/ibm-mas/cli/issues) with suggestions on how to make our MAS automation engine even better, or if you want to become a new code contributor, please refer to the [Contributing Guidelines](CONTRIBUTING.md) and learn more about how to get started.

image/cli/mascli/functions/gitops_aiservice

@@ -72,6 +72,7 @@ function gitops_aiservice_noninteractive() {
   #adding default values 
   export AISERVICE_NAMESPACE=${AISERVICE_NAMESPACE:-"aiservice-${AISERVICE_INSTANCE_ID}"}
   export IN_SAAS_ENV=${IN_SAAS_ENV:-"true"}
+  export IS_GITOPS_FVT_ENV=${IS_GITOPS_FVT_ENV:-"false"}
   export IS_EXTERNAL_ROUTE=${IS_EXTERNAL_ROUTE:-"false"}  # Default to "false", can be set to "true" if needed  
   export JDBC_SECRET=${JDBC_SECRET:-"aiservice-jdbc-secret"}
   export USE_AWS_DB2=${USE_AWS_DB2:-"false"}  # Default to "false", can be set to "true" if needed
@@ -136,6 +137,9 @@ function gitops_aiservice_noninteractive() {
       --in-saas-env)
           export IN_SAAS_ENV=$1 && shift
         ;;
+      --is-gitops-fvt-env)
+        export IS_GITOPS_FVT_ENV=$1 && shift
+        ;;  
       --is-external-route)
           export IS_EXTERNAL_ROUTE=$1 && shift
         ;;
@@ -274,6 +278,44 @@ function gitops_aiservice_noninteractive() {
 
 }
 
+function gitops_aiservice_fvt_prepare() {
+
+  SECRETS_PREFIX="${ACCOUNT_ID}${SECRETS_KEY_SEPERATOR}${CLUSTER_ID}${SECRETS_KEY_SEPERATOR}"
+
+  WATSONXAI_APIKEY=${WATSONXAI_APIKEY:-"watsonxai-apikey"}
+  WATSONXAI_PROJECT_ID=${WATSONXAI_PROJECT_ID:-"watsonxai-project-id"}
+
+  SECRET_NAME_WATSONXAI=${SECRETS_PREFIX}watsonx
+
+  TAGS="[{\"Key\": \"watsonxai_apikey\", \"Value\": \"watsonxai_apikey\"}, {\"Key\": \"watsonxai_project_id\", \"Value\": \"watsonxai_project_id\"}]"
+
+  sm_update_secret \
+    "$SECRET_NAME_WATSONXAI" \
+    "{\"watsonxai_apikey\":\"$WATSONXAI_APIKEY\",\"watsonxai_project_id\":\"$WATSONXAI_PROJECT_ID\"}" \
+    "$TAGS" || {
+      echo "Failed to update WatsonX secret"
+      return 1
+    }
+
+  SM_S3_ACCESSKEY=${SM_S3_ACCESSKEY:-"sm_s3_accesskey"}
+  SM_S3_SECRETKEY=${SM_S3_SECRETKEY:-"sm_s3_secretkey"}
+  SM_S3_HOST=${SM_S3_HOST:-"sm_s3_host"}
+  SM_S3_REGION=${SM_S3_REGION:-"sm_s3_region"}
+
+  SECRET_NAME_S3=${SECRETS_PREFIX}s3
+  TAGS="[{\"Key\": \"sm_s3_accesskey\", \"Value\": \"sm_s3_accesskey\"}, {\"Key\": \"sm_s3_secretkey\", \"Value\": \"sm_s3_secretkey\"}, {\"Key\": \"sm_s3_host\", \"Value\": \"sm_s3_host\"}, {\"Key\": \"sm_s3_region\", \"Value\": \"sm_s3_region\"}]"
+
+  sm_update_secret \
+    "$SECRET_NAME_S3" \
+    "{\"sm_s3_accesskey\":\"$SM_S3_ACCESSKEY\",\"sm_s3_secretkey\":\"$SM_S3_SECRETKEY\",\"sm_s3_host\":\"$SM_S3_HOST\",\"sm_s3_region\":\"$SM_S3_REGION\"}" \
+    "$TAGS" || {
+      echo "Failed to update S3 secret"
+      return 1
+    }
+
+  echo "AI Service FVT secret creating function end"
+}
+
 function gitops_aiservice() {
   # Take the first parameter off (it will be create-gitops)
   shift
@@ -353,6 +395,7 @@ function gitops_aiservice() {
   echo_reset_dim "Is External Route ...................... ${COLOR_MAGENTA}${IS_EXTERNAL_ROUTE}"
   echo_reset_dim "JDBC Secret ............................ ${COLOR_MAGENTA}${JDBC_SECRET}"
   echo_reset_dim "Use AWS DB2 ............................ ${COLOR_MAGENTA}${USE_AWS_DB2}"
+  echo_reset_dim "Is GitOps FVT ENV ............................ ${COLOR_MAGENTA}${IS_GITOPS_FVT_ENV}"
 
   AVP_TYPE=aws  # Support for IBM will be added later
   sm_login
@@ -381,10 +424,18 @@ function gitops_aiservice() {
   export MAS_ENTITLEMENT_KEY=${SECRETS_PREFIX}ibm_entitlement#entitlement_key
   export ARTIFACTORY_TOKEN=${SECRETS_PREFIX}ibm_entitlement#image_pull_secret_b64
 
-  sm_verify_secret_exists ${SECRETS_PREFIX}ibm_entitlement "image_pull_secret_b64,entitlement_key"
-  sm_verify_secret_exists ${SECRETS_PREFIX}dro "dro_api_token,dro_url,dro_ca_b64enc"
-  sm_verify_secret_exists ${SECRETS_PREFIX}s3 "sm_s3_accesskey,sm_s3_secretkey,sm_s3_host,sm_s3_region"
-  sm_verify_secret_exists ${SECRETS_PREFIX}jdbc "jdbccfg_username,jdbccfg_password,jdbccfg_url,jdbccfg_sslenabled,jdbccfg_ca_b64enc"
+  # Skip DRO, S3, and JDBC secret validation in FVT environments
+  # These secrets will be created by postSync jobs after deployment
+  if [[ "${IS_GITOPS_FVT_ENV}" != "true" ]]; then
+    sm_verify_secret_exists ${SECRETS_PREFIX}ibm_entitlement "image_pull_secret_b64,entitlement_key"
+    sm_verify_secret_exists ${SECRETS_PREFIX}dro "dro_api_token,dro_url,dro_ca_b64enc"
+    sm_verify_secret_exists ${SECRETS_PREFIX}s3 "sm_s3_accesskey,sm_s3_secretkey,sm_s3_host,sm_s3_region"
+    sm_verify_secret_exists ${SECRETS_PREFIX}jdbc "jdbccfg_username,jdbccfg_password,jdbccfg_url,jdbccfg_sslenabled,jdbccfg_ca_b64enc"
+  else
+    echo "IS_GITOPS_FVT_ENV is true - Skipping DRO, S3, and JDBC secret validation"
+
+    gitops_aiservice_fvt_prepare
+  fi
 
     if [ -z $GIT_SSH ]; then
       export GIT_SSH=false

image/cli/mascli/functions/gitops_aiservice_tenant

@@ -38,6 +38,7 @@ AiService :
 --aiservice-tenant-install-plan-approval ${TEXT_RESET}AISERVICE_TENANT_INSTALL_PLAN_APPROVAL${TEXT_RESET}                                                          
 --cluster-domain ${COLOR_YELLOW}CLUSTER_DOMAIN${TEXT_RESET}                                                 The domain name of the Kubernetes cluster (e.g., cluster.local)
 --in-saas-env ${COLOR_YELLOW}IN_SAAS_ENV${TEXT_RESET}                                                       Whether the environment is SaaS (true/false)
+--is-gitops-fvt-env ${COLOR_YELLOW}IS_GITOPS_FVT_ENV${TEXT_RESET}                                           Whether this is a GitOps FVT environment (true/false)
 --aiservice_operator_log_level ${COLOR_YELLOW}AISERVICE_OPERATOR_LOG_LEVEL${TEXT_RESET}                     Log level for the AI Service operator (e.g., info, debug)
 --mas-icr-cp ${COLOR_YELLOW}MAS_ICR_CP${TEXT_RESET}                                                         IBM Cloud Pak container registry URL
 --mas-icr-cpopen ${COLOR_YELLOW}MAS_ICR_CPOPEN${TEXT_RESET}                                                 IBM Cloud Pak Open container registry URL
@@ -108,6 +109,7 @@ function gitops_aiservice_tenant_noninteractive() {
   export AISERVICE_TENANT_INSTALL_PLAN_APPROVAL=${AISERVICE_TENANT_INSTALL_PLAN_APPROVAL:-"Automatic"}
   export CATALOG_SOURCE=${CATALOG_SOURCE:-"ibm-operator-catalog"}
   export IN_SAAS_ENV=${IN_SAAS_ENV:-"true"}
+  export IS_GITOPS_FVT_ENV=${IS_GITOPS_FVT_ENV:-"false"}
   export MAS_ICR_CP=${MAS_ICR_CP:-"docker-na-public.artifactory.swg-devops.com/wiotp-docker-local"}
   export MAS_ICR_CPOPEN=${MAS_ICR_CPOPEN:-"docker-na-public.artifactory.swg-devops.com/wiotp-docker-local/cpopen"}
   export AISERVICE_S3_BUCKET_PREFIX=${AISERVICE_S3_BUCKET_PREFIX:-"m"}
@@ -184,6 +186,9 @@ function gitops_aiservice_tenant_noninteractive() {
       --in-saas-env)
         export IN_SAAS_ENV=$1 && shift
         ;;
+      --is-gitops-fvt-env)
+        export IS_GITOPS_FVT_ENV=$1 && shift
+        ;;
       --mas-icr-cp)
         export MAS_ICR_CP=$1 && shift
         ;;
@@ -326,14 +331,17 @@ function gitops_aiservice_tenant_noninteractive() {
     [[ -z "$SLSCFG_URL" ]] && gitops_aiservice_tenant_help "SLSCFG_URL is not set. Please specify the SLS configuration URL using --slscfg-url."
   fi
 
-  # -- Watsonx
-  [[ -z "$AISERVICE_WATSONXAI_URL" ]] && gitops_aiservice_tenant_help "AISERVICE_WATSONXAI_URL is not set. Please specify the Watsonx.ai URL using --aiservice-watsonxai-url."
-  [[ -z "$AISERVICE_WATSONX_FULL" ]] && gitops_aiservice_tenant_help "AISERVICE_WATSONX_FULL is not set. Please specify the full Watsonx.ai URL using --aiservice-watsonx-full."
-  [[ -z "$AISERVICE_S3_ENDPOINT_URL" ]] && gitops_aiservice_tenant_help "AISERVICE_S3_ENDPOINT_URL is not set. Please specify the S3 endpoint URL using --aiservice-s3-endpoint-url."
-
-  [[ -z "$AISERVICE_STORAGE_SSL" ]] && gitops_aiservice_tenant_help "AISERVICE_STORAGE_SSL is not set. Please specify whether SSL is enabled for STORAGE using --aiservice-storage-ssl."
-  [[ -z "$AISERVICE_STORAGE_PROVIDER" ]] && gitops_aiservice_tenant_help "AISERVICE_STORAGE_PROVIDER is not set. Please specify the STORAGE provider using --aiservice-storage-provider."
-
+  if [[ "${IS_GITOPS_FVT_ENV}" != "true" ]]; then
+    # -- Watsonx
+    [[ -z "$AISERVICE_WATSONXAI_URL" ]] && gitops_aiservice_tenant_help "AISERVICE_WATSONXAI_URL is not set. Please specify the Watsonx.ai URL using --aiservice-watsonxai-url."
+    [[ -z "$AISERVICE_WATSONX_FULL" ]] && gitops_aiservice_tenant_help "AISERVICE_WATSONX_FULL is not set. Please specify the full Watsonx.ai URL using --aiservice-watsonx-full."
+    [[ -z "$AISERVICE_S3_ENDPOINT_URL" ]] && gitops_aiservice_tenant_help "AISERVICE_S3_ENDPOINT_URL is not set. Please specify the S3 endpoint URL using --aiservice-s3-endpoint-url."
+
+    [[ -z "$AISERVICE_STORAGE_SSL" ]] && gitops_aiservice_tenant_help "AISERVICE_STORAGE_SSL is not set. Please specify whether SSL is enabled for STORAGE using --aiservice-storage-ssl."
+    [[ -z "$AISERVICE_STORAGE_PROVIDER" ]] && gitops_aiservice_tenant_help "AISERVICE_STORAGE_PROVIDER is not set. Please specify the STORAGE provider using --aiservice-storage-provider."
+  else
+      echo "GitOps FVT Environment: Skipping watsonx verification (will be created by postSync job)"
+  fi
  }
 
 function gitops_aiservice_tenant() {
@@ -483,14 +491,20 @@ fi
 
   # check for those variables present into the aws sm 
 
-  sm_verify_secret_exists ${SECRETS_PREFIX}ibm_entitlement "image_pull_secret_b64,entitlement_key"
-  sm_verify_secret_exists ${SECRETS_PREFIX}dro "dro_api_token,dro_ca_b64enc"
-  if [ -z "$STANDALONE_SLS_SERVICE" ]; then
-    sm_verify_secret_exists ${SLS_SECRETS_PREFIX}sls "slscfg_registration_key,slscfg_ca_b64enc"
+  if [[ "${IS_GITOPS_FVT_ENV}" != "true" ]]; then
+    sm_verify_secret_exists ${SECRETS_PREFIX}ibm_entitlement "image_pull_secret_b64,entitlement_key"
+    sm_verify_secret_exists ${SECRETS_PREFIX}dro "dro_api_token,dro_ca_b64enc"
+    if [ -z "$STANDALONE_SLS_SERVICE" ]; then
+      # In GitOps FVT environment, skip SLS secret verification as they will be created by postSync job
+      sm_verify_secret_exists ${SLS_SECRETS_PREFIX}sls "slscfg_registration_key,slscfg_ca_b64enc"    
+    else
+      sm_verify_secret_exists ${SLS_SECRETS_PREFIX}sls "registration_key,ca_b64,sls_url"
+    fi
+    sm_verify_secret_exists ${SECRETS_PREFIX}rsl "rsl_org_id,rsl_token"
+    sm_verify_secret_exists ${SECRETS_PREFIX}watsonx "watsonxai_apikey,watsonxai_project_id"
   else
-    sm_verify_secret_exists ${SLS_SECRETS_PREFIX}sls "registration_key,ca_b64,sls_url"
+      echo "GitOps FVT Environment: Skipping SLS secret verification (will be created by postSync job)"
   fi
-  sm_verify_secret_exists ${SECRETS_PREFIX}watsonx "watsonxai_apikey,watsonxai_project_id"
 
   # Load scheduling config file
   # ---------------------------------------------------------------------------