[minor] Enable Public route for cpd - #2566
Open
kushwahck-ibm wants to merge 10 commits into
Open
Conversation
kushwahck-ibm
marked this pull request as draft
August 28, 2026 10:16
kushwahck-ibm
marked this pull request as ready for review
September 1, 2026 07:28
mnivedithaa
changed the title
amitpandey0217
previously approved these changes
Sep 3, 2026
mnivedithaa
reviewed
Sep 9, 2026
|
|
||
| # If CPD public route is enabled, add the cpd-public hostname to CIS DNS + edge cert | ||
| if [[ "${CPD_PUBLIC_ROUTE_ENABLED}" == "true" ]]; then | ||
| export CIS_ENTRIES_TO_ADD="cpd-public.${CIS_SUBDOMAIN}" |
Contributor
There was a problem hiding this comment.
Qn: Is this function used anywhere?
Contributor
Author
There was a problem hiding this comment.
Yes, it's used in two places in the CLI workspace:
-
gitops_suite_dns:143-146 — the exact snippet you pasted. When CPD_PUBLIC_ROUTE_ENABLED=true, it overrides CIS_ENTRIES_TO_ADD to include cpd-public.${CIS_SUBDOMAIN} so the DNS CNAME and edge cert are created for the public route.
-
gitops_cp4d:135-136 — parses --cpd-public-route-enabled CLI flag and exports CPD_PUBLIC_ROUTE_ENABLED.
-
ibm-cp4d.yaml.j2:25-26 — Jinja2 template that writes cpd_public_route_enabled: true into the gitops-envs YAML when CPD_PUBLIC_ROUTE_ENABLED == 'true'.
So CPD_PUBLIC_ROUTE_ENABLED flows end-to-end:
CLI flag --cpd-public-route-enabled
→ gitops_cp4d exports CPD_PUBLIC_ROUTE_ENABLED
→ ibm-cp4d.yaml.j2 writes cpd_public_route_enabled: true to gitops-envs
→ gitops_suite_dns adds cpd-public.<subdomain> to CIS_ENTRIES_TO_ADD
→ DNS CNAME + edge cert created
Previously when CPD_PUBLIC_ROUTE_ENABLED=true, the entire CIS_ENTRIES_TO_ADD was replaced with just 'cpd-public.<subdomain>', wiping out core/manage/reportdb etc. and breaking DNS/cert creation for all other MAS components. Now cpd-public is appended to the existing CIS_ENTRIES_TO_ADD list, and only if not already present (idempotent). Since gitops already adds cpd-public to cis_entries_to_add via 010-ibm-sync-jobs.yaml, this append is a no-op in the gitops flow but correctly handles the standalone CLI case.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
--cpd-public-route-enabledflag togitops_cp4dand wires up automatic CIS DNSCNAME + edge certificate provisioning in
gitops_suite_dnswhen the flag is set.https://jsw.ibm.com/browse/MASCORE-15972
Testing
Tested on: mas-cluster-8 / inst1002
Steps Performed
Created CLI image from PR [minor] Enable Public route for cpd with ansible-devops #2582 (branch name same as [minor] Enable Public route for cpd ansible-devops#2433)
Updated CLI image digest in gitops/instance-applications/010-ibm-sync-jobs/templates/01-ibm-mas_suite_dns_Job.yaml
Updated saas-tekton branch (saas-tekton#281) in mcsp-gitops-mas-instance and mcsp-gitops-mas-apps pipelines
Enabled cpd_public_route_enabled: true in saas-envs
Gitops changes merged into mas-gitops via argo-test-branch, ArgoCD app pointed to mas-gitops branch
Verified suite_dns job picked up cpd_public_route_enabled property:
CPD public URL accessible without VPN:
https://cpd-public.inst1002.saasmax.ibmmasivt.com
Result Recording
Screen.Recording.2026-09-08.at.1.40.44.AM.mov