[minor] Enable Public route for cpd

[kushwahck-ibm]

Summary

Adds --cpd-public-route-enabled flag to gitops_cp4d and wires up automatic CIS DNS
CNAME + edge certificate provisioning in gitops_suite_dns when the flag is set.

https://jsw.ibm.com/browse/MASCORE-15972

Testing

Tested on: mas-cluster-8 / inst1002

Steps Performed

1. Created CLI image from PR [minor] Enable Public route for cpd with ansible-devops #2582 (branch name same as [minor] Enable Public route for cpd ansible-devops#2433)

   • Built image: quay.io/ibmmas/cli@sha256:30d03b2ac994efe036af0dc91d0319f7f2c7cb6bb216ce0602f263165591848a

2. Updated CLI image digest in gitops/instance-applications/010-ibm-sync-jobs/templates/01-ibm-mas_suite_dns_Job.yaml

   • digest: sha256:30d03b2ac994efe036af0dc91d0319f7f2c7cb6bb216ce0602f263165591848a

3. Updated saas-tekton branch (saas-tekton#281) in mcsp-gitops-mas-instance and mcsp-gitops-mas-apps pipelines

4. Enabled cpd_public_route_enabled: true in saas-envs

   • saas-envs commit: 863b33e
   • Auto-propagated to mas-dev: commit 7f757ad

5. Gitops changes merged into mas-gitops via argo-test-branch, ArgoCD app pointed to mas-gitops branch

   • Route cpd-public created automatically with correct hostname and type=external label
   • Job patched ZenService zenCustomRoute and restarted nginx — zero manual steps

6. Verified suite_dns job picked up cpd_public_route_enabled property:

   • CIS_ENTRIES_TO_ADD included cpd-public.inst1002.saasmax
   • CIS DNS CNAME created → resolves to public NLB
   • Let's Encrypt edge cert ordered with cpd-public.inst1002.saasmax.ibmmasivt.com as SAN

7. CPD public URL accessible without VPN:
   https://cpd-public.inst1002.saasmax.ibmmasivt.com

Result Recording

Screen.Recording.2026-09-08.at.1.40.44.AM.mov