mas-cli 21.4.0__tar.gz → 21.4.1__tar.gz

{mas_cli-21.4.0/src/mas_cli.egg-info → mas_cli-21.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mas-cli
-Version: 21.4.0
+Version: 21.4.1
 Summary: Python Admin CLI for Maximo Application Suite
 Home-page: https://github.com/ibm-mas/cli
 Author: David Parker

{mas_cli-21.4.0 → mas_cli-21.4.1}/src/mas/cli/__init__.py

@@ -10,4 +10,4 @@
 
 from .cli import BaseApp  # noqa: F401
 
-__version__ = "21.4.0"  # Python module compatible semver
+__version__ = "21.4.1"  # Python module compatible semver

{mas_cli-21.4.0 → mas_cli-21.4.1}/src/mas/cli/aiservice/install/app.py

@@ -77,7 +77,7 @@ class AiServiceInstallApp(BaseApp, aiServiceInstallArgBuilderMixin, aiServiceIns
         if not isVersionEqualOrAfter("9.2.0", self.getParam("aiservice_channel")):
             return
 
-        if self.getParam("skip_preinstall_rbac") == "true":
+        if self.skip_preinstall_rbac:
             return
 
         permissionResults = permissionCheckForRBAC(self.dynamicClient)
@@ -91,7 +91,7 @@ class AiServiceInstallApp(BaseApp, aiServiceInstallArgBuilderMixin, aiServiceIns
             self.printDescription(
                 [
                     "",
-                    f"You selected the '{self.getParam('permission_mode')}' permission mode.",
+                    f"You selected the '{self.permission_mode}' permission mode.",
                     "The pre-install RBAC required for this permission mode has not been applied by your current cluster login.",
                     "This step must be completed by an OpenShift cluster administrator before AI Service installation can continue.",
                     "Ask your OpenShift administrator to run 'mas pre-install' for this AI Service instance.",
@@ -107,7 +107,7 @@ class AiServiceInstallApp(BaseApp, aiServiceInstallArgBuilderMixin, aiServiceIns
             self.fatalError(
                 "\n".join(
                     [
-                        f"You selected the '{self.getParam('permission_mode')}' permission mode.",
+                        f"You selected the '{self.permission_mode}' permission mode.",
                         "The pre-install RBAC required for this permission mode has not been applied by your current cluster login.",
                         "This step must be completed by an OpenShift cluster administrator before AI Service installation can continue.",
                         "Ask your OpenShift administrator to run 'mas pre-install' for this installation and then rerun 'mas aiservice-install' with --skip-preinstall-rbac.",
@@ -140,9 +140,9 @@ class AiServiceInstallApp(BaseApp, aiServiceInstallArgBuilderMixin, aiServiceIns
 
             permissionModeInt = self.promptForInt("Permission Mode", default=1, min=1, max=3)
             permissionModeMap = {1: "cluster", 2: "namespaced", 3: "minimal"}
-            self.setParam("permission_mode", permissionModeMap[permissionModeInt])
-        elif self.getParam("permission_mode") == "":
-            self.setParam("permission_mode", "cluster")
+            self.permission_mode = permissionModeMap[permissionModeInt]
+        elif self.permission_mode == "":
+            self.permission_mode = "cluster"
 
     @logMethodCall
     def processCatalogChoice(self) -> list:
@@ -466,12 +466,12 @@ class AiServiceInstallApp(BaseApp, aiServiceInstallArgBuilderMixin, aiServiceIns
             self.validateCatalogSource()
             self.licensePrompt()
 
-        if self.getParam("permission_mode") != "" and not isVersionEqualOrAfter("9.2.0", self.getParam("aiservice_channel")):
+        if self.permission_mode != "" and not isVersionEqualOrAfter("9.2.0", self.getParam("aiservice_channel")):
             self.fatalError("--permission-mode is supported only for AI Service releases aligned to MAS 9.2.0 and later")
 
         # Set default permission_mode for 9.2.0+ if not provided
-        if isVersionEqualOrAfter("9.2.0", self.getParam("aiservice_channel")) and self.getParam("permission_mode") == "":
-            self.setParam("permission_mode", "cluster")
+        if isVersionEqualOrAfter("9.2.0", self.getParam("aiservice_channel")) and self.permission_mode == "":
+            self.permission_mode = "cluster"
 
     @logMethodCall
     def install(self, argv):
@@ -487,6 +487,7 @@ class AiServiceInstallApp(BaseApp, aiServiceInstallArgBuilderMixin, aiServiceIns
         self.noConfirm = args.no_confirm
         self.licenseAccepted = args.accept_license
         self.devMode = args.dev_mode
+        self.permission_mode = args.permission_mode if args.permission_mode else ""
 
         self.printDescription(
             [
@@ -514,8 +515,7 @@ class AiServiceInstallApp(BaseApp, aiServiceInstallArgBuilderMixin, aiServiceIns
         if args.skip_pre_check:
             self.setParam("skip_pre_check", "true")
 
-        if hasattr(args, "skip_preinstall_rbac") and args.skip_preinstall_rbac:
-            self.setParam("skip_preinstall_rbac", "true")
+        self.skip_preinstall_rbac = hasattr(args, "skip_preinstall_rbac") and args.skip_preinstall_rbac
 
         if instanceId is None:
             self.printH1("Set Target OpenShift Cluster")
@@ -625,7 +625,7 @@ class AiServiceInstallApp(BaseApp, aiServiceInstallArgBuilderMixin, aiServiceIns
                         dynClient=self.dynamicClient,
                         masVersion=".".join(self.getParam("aiservice_channel").split(".")[:2]),
                         masInstanceId=self.getParam("aiservice_instance_id"),
-                        permissionMode=self.getParam("permission_mode"),
+                        permissionMode=self.permission_mode,
                         selectedApps=["aiservice"],
                     )
                     h.stop_and_persist(symbol=self.successIcon, text=f"Pre-install RBAC for AI Service is ready for {self.getParam('aiservice_instance_id')}")

{mas_cli-21.4.0 → mas_cli-21.4.1}/src/mas/cli/aiservice/install/argBuilder.py

@@ -96,9 +96,9 @@ class aiServiceInstallArgBuilderMixin:
             command += f"  --dev-mode{newline}"
         if self.getParam("skip_pre_check") is True:
             command += f"  --skip-pre-check{newline}"
-        if self.getParam("permission_mode") != "":
-            command += f"  --permission-mode \"{self.getParam('permission_mode')}\"{newline}"
-        if self.getParam("skip_preinstall_rbac") != "":
+        if self.permission_mode != "":
+            command += f'  --permission-mode "{self.permission_mode}"{newline}'
+        if self.skip_preinstall_rbac:
             command += f"  --skip-preinstall-rbac{newline}"
         if self.getParam("image_pull_policy") != "":
             command += f"  --image-pull-policy {self.getParam('image_pull_policy')}{newline}"

{mas_cli-21.4.0 → mas_cli-21.4.1}/src/mas/cli/aiservice/install/summarizer.py

@@ -46,9 +46,9 @@ class aiServiceInstallSummarizerMixin:
         self.printParamSummary("Release", "aiservice_channel")
         self.printParamSummary("Instance ID", "aiservice_instance_id")
         self.printParamSummary("Environment Type", "environment_type")
-        if self.getParam("permission_mode") not in [None, ""]:
-            self.printParamSummary("Permission Mode", "permission_mode")
-            self.printSummary("Skip Pre-Install RBAC", "Yes" if self.getParam("skip_preinstall_rbac") == "true" else "No")
+        if self.permission_mode not in [None, ""]:
+            self.printSummary("Permission Mode", self.permission_mode)
+            self.printSummary("Skip Pre-Install RBAC", "Yes" if self.skip_preinstall_rbac else "No")
 
         if "aiservice_certificate_issuer" in self.params:
             self.printParamSummary("Certificate Issuer", "aiservice_certificate_issuer")

{mas_cli-21.4.0 → mas_cli-21.4.1}/src/mas/cli/cli.py

@@ -119,7 +119,7 @@ class BaseApp(PrintMixin, PromptMixin):
         logging.getLogger("asyncio").setLevel(logging.INFO)
 
         # Supports extended semver, unlike mas.cli.__version__
-        self.version: str = "21.4.0"
+        self.version: str = "21.4.1"
         self.h1count: int = 0
         self.h2count: int = 0
 
@@ -147,6 +147,8 @@ class BaseApp(PrintMixin, PromptMixin):
 
         self._isSNO: bool | None = None
         self._isAirgap: bool | None = None
+        self.useCliDigest: bool = False
+        self.cliDigest: str | None = None
 
         # Until we connect to the cluster we don't know what architecture it's worker nodes are
         self.architecture: str | None = None
@@ -255,44 +257,90 @@ class BaseApp(PrintMixin, PromptMixin):
         if path.exists(self.tektonDefsWithDigestPath):
             logger.debug(f"We have already generated {self.tektonDefsWithDigestPath}")
             self.tektonDefsPath = self.tektonDefsWithDigestPath
-        elif isAirgapInstall(self.dynamicClient):
-            # We need to modify the tekton definitions to
+        elif isAirgapInstall(self.dynamicClient) or self.useCliDigest:
+            # We need to modify the tekton definitions to use image digest
             imageWithoutDigest = f"quay.io/ibmmas/cli:{self.version}"
-            self.printH1("Disconnected OpenShift Preparation")
-            self.printDescription(
-                [f"Unless the {imageWithoutDigest} image is accessible from your cluster the MAS CLI container image must be present in your mirror registry"]
-            )
-            cmdArray = ["skopeo", "inspect", f"docker://{imageWithoutDigest}"]
-            logger.info(f"Skopeo inspect command: {' '.join(cmdArray)}")
-            skopeoResult = runCmd(cmdArray)
-            if skopeoResult.successful():
-                skopeoData = json.loads(skopeoResult.out)
-                logger.info(f"Skopeo Data for {imageWithoutDigest}: {skopeoData}")
-                if "Digest" not in skopeoData:
-                    self.fatalError("Recieved bad data inspecting CLI manifest to determine digest")
-                cliImageDigest = skopeoData["Digest"]
+
+            if self.useCliDigest:
+                self.printH1("CLI Digest Preparation")
+                self.printDescription(
+                    [f"Converting Tekton pipeline definitions to use {imageWithoutDigest} image digest instead of tag to avoid registry QPS issues"]
+                )
+
+                # Check if user provided a specific digest
+                if self.cliDigest:
+                    logger.info(f"Using user-provided CLI image digest: {self.cliDigest}")
+                    cliImageDigest = self.cliDigest
+                else:
+                    logger.info(f"--use-cli-digest flag is set, will lookup digest for {imageWithoutDigest}")
+                    # Auto-lookup the digest
+                    cmdArray = ["skopeo", "inspect", f"docker://{imageWithoutDigest}"]
+                    logger.info(f"Skopeo inspect command: {' '.join(cmdArray)}")
+                    skopeoResult = runCmd(cmdArray)
+                    if skopeoResult.successful():
+                        skopeoData = json.loads(skopeoResult.out)
+                        logger.debug(f"Skopeo Data for {imageWithoutDigest}: {skopeoData}")
+                        if "Digest" not in skopeoData:
+                            self.fatalError("Recieved bad data inspecting CLI manifest to determine digest")
+                        cliImageDigest = skopeoData["Digest"]
+                        logger.info(f"Successfully retrieved CLI image digest: {cliImageDigest}")
+                    else:
+                        warning = f"Unable to retrieve image digest for {imageWithoutDigest} ({skopeoResult.rc})"
+                        self.printWarning(warning)
+                        logger.warning(warning)
+                        logger.warning(skopeoResult.err)
+                        if self.noConfirm:
+                            self.fatalError("Unable to automatically determine CLI image digest and --no-confirm flag has been set")
+                        else:
+                            cliImageDigest = self.promptForString(f"Enter {imageWithoutDigest} image digest")
+                            logger.info(f"User provided CLI image digest: {cliImageDigest}")
             else:
-                warning = f"Unable to retrieve image digest for {imageWithoutDigest} ({skopeoResult.rc})"
-                self.printWarning(warning)
-                logger.warning(warning)
-                logger.warning(skopeoResult.err)
-                if self.noConfirm:
-                    self.fatalError("Unable to automatically determine CLI image digest and --no-confirm flag has been set")
+                # Airgap install
+                self.printH1("Disconnected OpenShift Preparation")
+                self.printDescription(
+                    [
+                        f"Unless the {imageWithoutDigest} image is accessible from your cluster the MAS CLI container image must be present in your mirror registry"
+                    ]
+                )
+                logger.info(f"Airgap install detected, will lookup digest for {imageWithoutDigest}")
+
+                cmdArray = ["skopeo", "inspect", f"docker://{imageWithoutDigest}"]
+                logger.info(f"Skopeo inspect command: {' '.join(cmdArray)}")
+                skopeoResult = runCmd(cmdArray)
+                if skopeoResult.successful():
+                    skopeoData = json.loads(skopeoResult.out)
+                    logger.debug(f"Skopeo Data for {imageWithoutDigest}: {skopeoData}")
+                    if "Digest" not in skopeoData:
+                        self.fatalError("Recieved bad data inspecting CLI manifest to determine digest")
+                    cliImageDigest = skopeoData["Digest"]
+                    logger.info(f"Successfully retrieved CLI image digest: {cliImageDigest}")
                 else:
-                    cliImageDigest = self.promptForString(f"Enter {imageWithoutDigest} image digest")
+                    warning = f"Unable to retrieve image digest for {imageWithoutDigest} ({skopeoResult.rc})"
+                    self.printWarning(warning)
+                    logger.warning(warning)
+                    logger.warning(skopeoResult.err)
+                    if self.noConfirm:
+                        self.fatalError("Unable to automatically determine CLI image digest and --no-confirm flag has been set")
+                    else:
+                        cliImageDigest = self.promptForString(f"Enter {imageWithoutDigest} image digest")
+                        logger.info(f"User provided CLI image digest: {cliImageDigest}")
 
             # Overwrite the tekton definitions with one that uses the looked up image digest
             imageWithDigest = f"quay.io/ibmmas/cli@{cliImageDigest}"
             self.printHighlight(f"\nConverting Tekton definitions to use {imageWithDigest}")
+            logger.info(f"Converting from tag-based image ({imageWithoutDigest}) to digest-based image ({imageWithDigest})")
+
             with open(self.tektonDefsPath, "r") as file:
                 tektonDefsWithoutDigest = file.read()
 
             tektonDefsWithDigest = tektonDefsWithoutDigest.replace(imageWithoutDigest, imageWithDigest)
 
+            logger.info(f"Writing Tekton definitions with digest to {self.tektonDefsWithDigestPath}")
             with open(self.tektonDefsWithDigestPath, "w") as file:
                 file.write(tektonDefsWithDigest)
 
             self.tektonDefsPath = self.tektonDefsWithDigestPath
+            logger.info("Successfully created Tekton definitions with CLI digest")
 
     @logMethodCall
     def getCompatibleVersions(self, coreChannel: str, appId: str) -> List[str]:

{mas_cli-21.4.0 → mas_cli-21.4.1}/src/mas/cli/install/app.py

@@ -123,12 +123,10 @@ class InstallApp(
         if not isVersionEqualOrAfter("9.2.0", self.getParam("mas_channel")):
             return
 
-        # TODO: Sort out the openshift-ingress exception properly.
-        # For now, keep continue pre-install RBAC for minimal mode here.
-        # if self.getParam("mas_permission_mode") == "minimal":
-        # return
+        if self.mas_permission_mode == "minimal":
+            return
 
-        if self.getParam("skip_preinstall_rbac") == "true":
+        if self.skip_preinstall_rbac:
             return
 
         permissionResults = permissionCheckForRBAC(self.dynamicClient)
@@ -142,26 +140,26 @@ class InstallApp(
             self.printDescription(
                 [
                     "",
-                    f"You selected the '{self.getParam('mas_permission_mode')}' permission mode.",
+                    f"You selected the '{self.mas_permission_mode}' permission mode.",
                     "The pre-install RBAC required for this permission mode has not been applied by your current cluster login.",
                     "This step must be completed by an OpenShift cluster administrator before MAS installation can continue.",
-                    "Ask your OpenShift administrator to run 'mas pre-install' for this MAS instance, MAS version, permission mode, and selected apps.",
+                    "Ask your OpenShift administrator to run 'mas pre-install' for this MAS instance, MAS channel, permission mode, and selected apps.",
                     "If that has already been done, you can continue the installation without applying it again.",
                 ]
             )
 
             if not self.yesOrNo("Has your OpenShift administrator already run 'mas pre-install' for this installation"):
                 self.fatalError(
-                    "Installation aborted. Ask your OpenShift administrator to run 'mas pre-install' for this installation and then run mas install again with --skip-preinstall-rbac."
+                    "Installation aborted. Ask your OpenShift administrator to run 'mas pre-install' for this installation and then run 'mas install' again with --skip-preinstall-rbac using the same permission mode that was used in 'mas pre-install'."
                 )
         else:
             self.fatalError(
                 "\n".join(
                     [
-                        f"You selected the '{self.getParam('mas_permission_mode')}' permission mode.",
+                        f"You selected the '{self.mas_permission_mode}' permission mode.",
                         "The pre-install RBAC required for this permission mode has not been applied by your current cluster login.",
                         "This step must be completed by an OpenShift cluster administrator before MAS installation can continue.",
-                        "Ask your OpenShift administrator to run 'mas pre-install' for this installation and then rerun 'mas install' with --skip-preinstall-rbac.",
+                        "Ask your OpenShift administrator to run 'mas pre-install' for this installation and then rerun 'mas install' with --skip-preinstall-rbac using the same permission mode that was used in 'mas pre-install'.",
                     ]
                 )
             )
@@ -776,9 +774,9 @@ class InstallApp(
 
                 permissionModeInt = self.promptForInt("Permission Mode", default=1, min=1, max=3)
                 permissionModeMap = {1: "cluster", 2: "namespaced", 3: "minimal"}
-                self.setParam("mas_permission_mode", permissionModeMap[permissionModeInt])
+                self.mas_permission_mode = permissionModeMap[permissionModeInt]
 
-                if self.getParam("mas_permission_mode") in ["namespaced", "minimal"]:
+                if self.mas_permission_mode in ["namespaced", "minimal"]:
                     self.setParam("mas_issuer_kind", "Issuer")
                 else:
                     self.printDescription(
@@ -795,18 +793,18 @@ class InstallApp(
                     )
                     issuerKindChoice = self.promptForInt("Certificate issuer kind", min=1, max=2, default=2)
                     self.setParam("mas_issuer_kind", "ClusterIssuer" if issuerKindChoice == 2 else "Issuer")
-            elif self.getParam("mas_permission_mode") == "":
-                self.setParam("mas_permission_mode", "cluster")
+            elif self.mas_permission_mode == "":
+                self.mas_permission_mode = "cluster"
                 self.setParam("mas_issuer_kind", "ClusterIssuer")
 
     def _handleDNSIntegrationRestriction(self):
         if not isVersionEqualOrAfter("9.2.0", self.getParam("mas_channel")):
             return False
 
-        if self.getParam("mas_permission_mode") in ["namespaced", "minimal"]:
+        if self.mas_permission_mode in ["namespaced", "minimal"]:
             self.printDescription(
                 [
-                    f"You are using the {self.getParam('mas_permission_mode')} permission mode.",
+                    f"You are using the {self.mas_permission_mode} permission mode.",
                     "DNS integration is not available in this mode.",
                     "If you use a custom domain, you need to configure DNS manually.",
                 ]
@@ -2226,6 +2224,7 @@ class InstallApp(
                 "advanced",
                 "simplified",
                 "mas_configure_ingress",
+                "use_cli_digest",
             ]:
                 pass
 
@@ -2340,17 +2339,17 @@ class InstallApp(
         if self.getParam("mas_issuer_kind") != "" and not isVersionEqualOrAfter("9.2.0", self.getParam("mas_channel")):
             self.fatalError(f"--mas-issuer-kind is only supported for MAS 9.2+ (selected channel: {self.getParam('mas_channel')})")
 
-        if self.getParam("mas_permission_mode") != "":
+        if self.mas_permission_mode != "":
             if not isVersionEqualOrAfter("9.2.0", self.getParam("mas_channel")):
                 self.fatalError(f"--permission-mode is only supported for MAS 9.2+ (selected channel: {self.getParam('mas_channel')})")
             else:
                 if self.getParam("mas_issuer_kind") == "":
-                    if self.getParam("mas_permission_mode") == "cluster":
+                    if self.mas_permission_mode == "cluster":
                         self.setParam("mas_issuer_kind", "ClusterIssuer")
                     else:
                         self.setParam("mas_issuer_kind", "Issuer")
 
-                if self.getParam("mas_issuer_kind") == "ClusterIssuer" and self.getParam("mas_permission_mode") != "cluster":
+                if self.getParam("mas_issuer_kind") == "ClusterIssuer" and self.mas_permission_mode != "cluster":
                     self.fatalError(
                         "\n".join(
                             [
@@ -2361,21 +2360,21 @@ class InstallApp(
                     )
 
                 if self.getParam("dns_provider") != "":
-                    if self.getParam("mas_permission_mode") in [
+                    if self.mas_permission_mode in [
                         "namespaced",
                         "minimal",
                     ]:
                         self.fatalError(
                             "\n".join(
                                 [
-                                    f"Invalid configuration for permission mode '{self.getParam('mas_permission_mode')}'",
+                                    f"Invalid configuration for permission mode '{self.mas_permission_mode}'",
                                     "DNS integration is not available in this mode.",
                                     "Remove DNS integration option --dns-provider, or switch to --permission-mode cluster and use --mas-issuer-kind ClusterIssuer.",
                                 ]
                             )
                         )
 
-                    if self.getParam("mas_permission_mode") == "cluster" and self.getParam("mas_issuer_kind") == "Issuer":
+                    if self.mas_permission_mode == "cluster" and self.getParam("mas_issuer_kind") == "Issuer":
                         self.fatalError(
                             "\n".join(
                                 [
@@ -2386,7 +2385,7 @@ class InstallApp(
                             )
                         )
         elif isVersionEqualOrAfter("9.2.0", self.getParam("mas_channel")):
-            self.setParam("mas_permission_mode", "cluster")
+            self.mas_permission_mode = "cluster"
             if self.getParam("mas_issuer_kind") == "":
                 self.setParam("mas_issuer_kind", "ClusterIssuer")
 
@@ -2464,6 +2463,7 @@ class InstallApp(
         self.licenseAccepted = args.accept_license
         self.devMode = args.dev_mode
         self.skipGrafanaInstall = args.skip_grafana_install
+        self.mas_permission_mode = args.mas_permission_mode if args.mas_permission_mode else ""
 
         # Set image_pull_policy of the CLI in interactive mode
         if args.image_pull_policy and args.image_pull_policy != "":
@@ -2478,8 +2478,29 @@ class InstallApp(
         if args.skip_pre_check:
             self.setParam("skip_pre_check", "true")
 
-        if hasattr(args, "skip_preinstall_rbac") and args.skip_preinstall_rbac:
-            self.setParam("skip_preinstall_rbac", "true")
+        self.skip_preinstall_rbac = hasattr(args, "skip_preinstall_rbac") and args.skip_preinstall_rbac
+
+        # Handle --use-cli-digest parameter which can be:
+        # - False (not provided)
+        # - True (provided without value, auto-lookup digest)
+        # - "sha256:..." (provided with specific digest value)
+        if hasattr(args, "use_cli_digest"):
+            use_cli_digest_value = args.use_cli_digest
+            if use_cli_digest_value is False:
+                # Flag not provided
+                self.useCliDigest = False
+                self.cliDigest = None
+            elif use_cli_digest_value is True:
+                # Flag provided without value - auto-lookup digest
+                self.useCliDigest = True
+                self.cliDigest = None
+            else:
+                # Flag provided with digest value
+                self.useCliDigest = True
+                self.cliDigest = use_cli_digest_value
+        else:
+            self.useCliDigest = False
+            self.cliDigest = None
 
         if hasattr(args, "mas_configure_ingress") and args.mas_configure_ingress:
             self.setParam("mas_configure_ingress", "true")
@@ -2687,7 +2708,7 @@ class InstallApp(
                         dynClient=self.dynamicClient,
                         masVersion=".".join(self.getParam("mas_channel").split(".")[:2]),
                         masInstanceId=self.getParam("mas_instance_id"),
-                        permissionMode=self.getParam("mas_permission_mode"),
+                        permissionMode=self.mas_permission_mode,
                         selectedApps=self.getSelectedApps(),
                     )
                     h.stop_and_persist(symbol=self.successIcon, text="Pre-install MAS RBAC applied")

{mas_cli-21.4.0 → mas_cli-21.4.1}/src/mas/cli/install/argBuilder.py

@@ -92,8 +92,8 @@ class installArgBuilderMixin:
         if self.operationalMode == 2:
             command += f"  --non-prod{newline}"
 
-        if self.getParam("mas_permission_mode") != "":
-            command += f"  --permission-mode {self.getParam('mas_permission_mode')}{newline}"
+        if self.mas_permission_mode != "":
+            command += f"  --permission-mode {self.mas_permission_mode}{newline}"
 
         if self.getParam("mas_trust_default_cas").lower() == "false":
             command += f"  --disable-ca-trust{newline}"
@@ -608,12 +608,17 @@ class installArgBuilderMixin:
             command += f"  --dev-mode{newline}"
         if self.getParam("skip_pre_check") is True:
             command += f"  --skip-pre-check{newline}"
-        if self.getParam("skip_preinstall_rbac") == "true":
+        if self.skip_preinstall_rbac:
             command += f"  --skip-preinstall-rbac{newline}"
         if self.getParam("image_pull_policy") != "":
             command += f"  --image-pull-policy {self.getParam('image_pull_policy')}{newline}"
         if self.getParam("service_account_name") != "":
             command += f"  --service-account {self.getParam('service_account_name')}{newline}"
+        if self.useCliDigest:
+            if self.cliDigest:
+                command += f"  --use-cli-digest {self.cliDigest}{newline}"
+            else:
+                command += f"  --use-cli-digest{newline}"
 
         command += "  --accept-license --no-confirm"
         return command

{mas_cli-21.4.0 → mas_cli-21.4.1}/src/mas/cli/install/argParser.py

@@ -1571,5 +1571,14 @@ otherArgGroup.add_argument(
     required=False,
     help="Custom service account for install pipeline (disables default 'pipeline' service account creation)",
 )
+otherArgGroup.add_argument(
+    "--use-cli-digest",
+    dest="use_cli_digest",
+    required=False,
+    nargs="?",
+    const=True,
+    default=False,
+    help="Use CLI image digest instead of tag in Tekton pipelines. Optionally provide a specific digest (e.g., sha256:abc123...), or omit the value to auto-lookup the digest.",
+)
 
 otherArgGroup.add_argument("-h", "--help", action="help", default=False, help="Show this help message and exit")

{mas_cli-21.4.0 → mas_cli-21.4.1}/src/mas/cli/install/summarizer.py

@@ -72,6 +72,12 @@ class InstallSummarizerMixin:
         self.printH2("Pipeline Configuration")
         self.printParamSummary("Service Account", "service_account_name")
         self.printParamSummary("Image Pull Policy", "image_pull_policy")
+        if self.useCliDigest:
+            if self.cliDigest:
+                self.printSummary("Use CLI Digest", self.cliDigest)
+            else:
+                self.printParamSummary("Use CLI Digest", "Yes (auto-lookup)")
+
         self.printSummary(
             "Skip Pre-Install Healthcheck",
             "Yes" if self.getParam("skip_pre_check") == "true" else "No",
@@ -101,14 +107,15 @@ class InstallSummarizerMixin:
 
         print()
         self.printSummary("Operational Mode", operationalModeNames[self.operationalMode])
-        if self.getParam("mas_permission_mode") != "":
-            self.printParamSummary("Permission Mode", "mas_permission_mode")
+        if self.mas_permission_mode != "":
+            self.printSummary("Permission Mode", self.mas_permission_mode)
+            # Only show "Apply Pre-Install MAS RBAC" when permission mode is defined
+            self.printSummary(
+                "Apply Pre-Install MAS RBAC",
+                "No" if self.skip_preinstall_rbac else "Yes",
+            )
         if self.getParam("mas_issuer_kind") != "":
             self.printParamSummary("Mas Certificate Issuer Kind", "mas_issuer_kind")
-        self.printSummary(
-            "Apply Pre-Install MAS RBAC",
-            "No" if self.getParam("skip_preinstall_rbac") == "true" else "Yes",
-        )
         if self.isAirgap():
             self.printSummary("Install Mode", "Disconnected Install")
         else:

{mas_cli-21.4.0 → mas_cli-21.4.1}/src/mas/cli/mirror/app.py

@@ -819,6 +819,7 @@ class MirrorApp(BaseApp):
             # Get version from catalog - handle both direct keys and release-specific keys
             perReleaseVersions = [
                 "aiservice_version",
+                "aiservice_tenant_version",
                 "mas_core_version",
                 "mas_assist_version",
                 "mas_iot_version",

{mas_cli-21.4.0 → mas_cli-21.4.1}/src/mas/cli/mirror/config.py

@@ -13,7 +13,8 @@ PACKAGE_CONFIGS = [
     ("Required Dependencies", "tsm", "ibm-truststore-mgr", "tsm_version"),
     ("Optional Dependencies", "amlen", "amlen", "amlen_extras_version"),
     ("Optional Dependencies", "aiservice", "ibm-aiservice", "aiservice_version"),
-    ("Optional Dependencies", "aiservice", "ibm-aiservice-tenant", "aiservice_version"),
+    ("Optional Dependencies", "aiservice", "ibm-aiservice-tenant", "aiservice_tenant_version"),
+    ("Optional Dependencies", "aiservice", "opendatahub", "odh_version"),
     ("Optional Dependencies", "data-dictionary", "ibm-data-dictionary", "dd_version"),
     ("Optional Dependencies", "db2u-s11", "ibm-db2uoperator-s11", "db2u_version"),
     ("Optional Dependencies", "db2u-s12", "ibm-db2uoperator-s12", "db2u_version"),