[minor] Enable Public route for cpd by kushwahck-ibm · Pull Request #578 · ibm-mas/gitops

kushwahck-ibm · 2026-08-31T07:48:35Z

Summary

Adds a new Helm Job (09-ibm-cpd-public-route.yaml) to the 110-ibm-cp4d chart that
creates a public-facing CP4D URL accessible without VPN. Also wires up the new chart values
and passes them through from the instance root application.

https://jsw.ibm.com/browse/MASCORE-15972

Testing

Tested on: mas-cluster-8 / inst1002

Steps Performed

Created CLI image from PR [minor] Enable Public route for cpd with ansible-devops cli#2582 (branch name same as [minor] Enable Public route for cpd ansible-devops#2433)
- Built image: quay.io/ibmmas/cli@sha256:30d03b2ac994efe036af0dc91d0319f7f2c7cb6bb216ce0602f263165591848a
Updated CLI image digest in gitops/instance-applications/010-ibm-sync-jobs/templates/01-ibm-mas_suite_dns_Job.yaml
- digest: sha256:30d03b2ac994efe036af0dc91d0319f7f2c7cb6bb216ce0602f263165591848a
Updated saas-tekton branch (saas-tekton#281) in mcsp-gitops-mas-instance and mcsp-gitops-mas-apps pipelines
Enabled cpd_public_route_enabled: true in saas-envs
- saas-envs commit: 863b33e
- Auto-propagated to mas-dev: commit 7f757ad
Gitops changes merged into mas-gitops via argo-test-branch, ArgoCD app pointed to mas-gitops branch
- Route cpd-public created automatically with correct hostname and type=external label
- Job patched ZenService zenCustomRoute and restarted nginx — zero manual steps
Verified suite_dns job picked up cpd_public_route_enabled property:
- CIS_ENTRIES_TO_ADD included cpd-public.inst1002.saasmax
- CIS DNS CNAME created → resolves to public NLB
- Let's Encrypt edge cert ordered with cpd-public.inst1002.saasmax.ibmmasivt.com as SAN
CPD public URL accessible without VPN:
https://cpd-public.inst1002.saasmax.ibmmasivt.com

Result

Screen.Recording.2026-09-08.at.1.40.44.AM.mov

…blic support

… support)

…route_enabled

…sterRole create permission)

…subdomain prefix)

…0d03b2)

Move cpd route restore from Step 2 (before ZenService patch) to Step 4 (after ZenService Completed). ZenService overwrites cpd route spec.host during its own reconcile cycle — restoring before was immediately undone. Restoring after ZenService Completed ensures the correct hostname sticks permanently. Also: Step 1 now detects if ZenService already overwrote the host and derives the correct internal hostname from the cluster ingress domain as a fallback. Steps: 1. Read internal cpd route host (with fallback if already overwritten) 2. Patch ZenService zenCustomRoute 3. Wait for ZenService Completed 4. Restore internal cpd route host ← key fix 5. Restart nginx pods Job version bumped v3 → v4.

mnivedithaa · 2026-09-08T19:04:37Z

+    type: external
+    route-type: external
+{{ .Values.custom_labels | toYaml | indent 4 }}
+{{- else }}


This else condition is not required. You can have the custom labels value only within if condition

mnivedithaa · 2026-09-08T19:09:11Z

            cpd_iam_integration: "{{ .Values.ibm_cp4d.cpd_iam_integration }}"
            cpd_primary_storage_class: "{{ .Values.ibm_cp4d.cpd_primary_storage_class }}"
            cpd_metadata_storage_class: "{{ .Values.ibm_cp4d.cpd_metadata_storage_class }}"
+            {{- if .Values.ibm_cp4d.cpd_public_route_enabled }}


It would be better if we add condition that if dns provider is cis

mnivedithaa · 2026-09-08T19:17:27Z

            {{- $visualinspection_str := ternary "" "visualinspection" (empty $visualinspection) -}}
            {{- $optimizer_str := ternary "" "optimizer" (empty $optimizer) -}}
            {{- $facilities_str := ternary "" "facilities" (empty $facilities) -}}
+            {{- $cpd_public_str := ternary (printf "cpd-public.%s" $core.cis_subdomain) "" (and (not (empty $core)) (not (empty .Values.ibm_cp4d)) (.Values.ibm_cp4d.cpd_public_route_enabled | default false)) -}}


Can we just pass cpd-public only. Subdomain is not required to be passed from here

mnivedithaa · 2026-09-08T19:21:00Z

-{{- $_cli_image_digest := "sha256:1c5701a24c9796e02b33036f56babbe74032831e1db733ce9228a46dce4a870b" }}
+{{- $_cli_image_digest := "sha256:30d03b2ac994efe036af0dc91d0319f7f2c7cb6bb216ce0602f263165591848a" }}

 {{- /*


Also the required env property CPD_PUBLIC_ROUTE_ENABLED is not set as env property in this job

…to 15972-cpd_route_public

- 010-ibm-sync-jobs.yaml (root app): pass cpd_public_route_enabled: true to sync-jobs chart values when cpd_public_route is enabled - 01-ibm-mas_suite_dns_Job.yaml: add CPD_PUBLIC_ROUTE_ENABLED env var so gitops_suite_dns function creates CIS DNS CNAME + edge cert automatically without relying on prior manual setup - bump suite_dns job version v3 -> v4

CPD_PUBLIC_ROUTE_ENABLED is not needed in the suite_dns job because: - cis_entries_to_add already contains 'cpd-public' when cpd_public_route_enabled is true - ansible-devops derives edge_certs_cpd_public from cis_entries_to_add directly - setting CPD_PUBLIC_ROUTE_ENABLED=true in the CLI would override CIS_ENTRIES_TO_ADD entirely, wiping out core/manage/reportdb/facilities DNS entries DNS CNAME and edge cert are created correctly via cis_entries_to_add alone. Revert suite_dns job version v4 -> v3.

…tion The suite_dns ansible role uses cpd_public_route_enabled (from CPD_PUBLIC_ROUTE_ENABLED env var) in dnsentries.yml.j2 to create the cpd-public DNS CNAME. Without this env var the CNAME is never created even though the edge cert is ordered correctly via cis_entries_to_add. The CLI gitops_suite_dns bug (overwriting CIS_ENTRIES_TO_ADD entirely) is fixed separately in the CLI repo — it now appends cpd-public instead of overwriting. Since cis_entries_to_add already contains cpd-public, the append is a no-op and does not affect the cert ordering flow. - 010-ibm-sync-jobs.yaml: pass cpd_public_route_enabled: true to chart values - 01-ibm-mas_suite_dns_Job.yaml: add CPD_PUBLIC_ROUTE_ENABLED env var, bump v3->v4

…s-cluster-8/inst1002

…false fix) + bump suite_dns v6

…proxied:false fix) + bump suite_dns v6" This reverts commit dae6ace.

kushwahck-ibm added 3 commits August 31, 2026 13:17

feat: add cpd-public-route job to expose CP4D on public URL without VPN

c5fc015

Update README.md

fff5fa4

Update 09-ibm-cpd-public-route.yaml

5e04694

kushwahck-ibm marked this pull request as ready for review September 1, 2026 07:28

mnivedithaa changed the title ~~feat: add cpd-public-route job to expose CP4D on public URL without VPN~~ [minor] Enable Public route for cpd Sep 2, 2026

Merge branch 'main' into 15972-cpd_route_public

1736792

mnivedithaa reviewed Sep 2, 2026

View reviewed changes

Comment thread instance-applications/110-ibm-cp4d/templates/09-ibm-cpd-public-route.yaml Outdated

amitpandey0217 reviewed Sep 2, 2026

View reviewed changes

kushwahck-ibm added 4 commits September 2, 2026 23:48

Merge branch 'main' into 15972-cpd_route_public

a5146de

fix: review comments done

8515471

fix: updating readme

e27cd72

fix: service remove

78d1d65

amitpandey0217 previously approved these changes Sep 3, 2026

View reviewed changes

test: update suite_dns job to use mascore-15972 CLI image with cpd-pu…

6aac9a5

…blic support

kushwahck-ibm dismissed amitpandey0217’s stale review via 6aac9a5 September 3, 2026 17:05

kushwahck-ibm and others added 11 commits September 3, 2026 22:47

test: update all CLI image digests to mascore-15972 build (cpd-public…

2579f1d

… support)

fix: dummy commit

c7ce80c

feat: add cpd-public to suite-dns CIS_ENTRIES_TO_ADD when cpd_public_…

28ee51a

…route_enabled

fix: guard against nil ibm_cp4d in cis_entries_to_add template

a501356

fix: replace ClusterRole with namespace-scoped Role (ArgoCD lacks Clu…

d42baf5

…sterRole create permission)

fix: use cis_mas_domain directly for cpd-public route host (drop cis_…

f2eca83

…subdomain prefix)

fix: updated version

71a2788

fix: update cpd-public-route job to mascore-15972 CLI image digest (3…

5d356bf

…0d03b2)

fix: script modified for private route

19269e6

Merge branch 'main' into 15972-cpd_route_public

12b2c3c

mnivedithaa reviewed Sep 8, 2026

View reviewed changes

kushwahck-ibm added 2 commits September 9, 2026 01:18

fix: review comments

d427307

Merge branch '15972-cpd_route_public' of github.com:ibm-mas/gitops in…

b7fbc1b

…to 15972-cpd_route_public

kushwahck-ibm added 7 commits September 9, 2026 13:20

test: bump suite_dns job version v4→v5 to re-trigger end-to-end on ma…

86da58e

…s-cluster-8/inst1002

fix(MASCORE-15972): update CLI digest to 9488282 (cpd-public proxied:…

dae6ace

…false fix) + bump suite_dns v6

Revert "fix(MASCORE-15972): update CLI digest to 9488282 (cpd-public …

903a415

…proxied:false fix) + bump suite_dns v6" This reverts commit dae6ace.

Merge branch 'main' into 15972-cpd_route_public

316adc8

Navigation Menu

Uh oh!

[minor] Enable Public route for cpd - #578

[minor] Enable Public route for cpd#578
kushwahck-ibm wants to merge 29 commits into
mainfrom
15972-cpd_route_public

kushwahck-ibm commented Aug 31, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mnivedithaa Sep 8, 2026

Uh oh!

mnivedithaa Sep 8, 2026

Uh oh!

mnivedithaa Sep 8, 2026

Uh oh!

mnivedithaa Sep 8, 2026

Uh oh!

kushwahck-ibm Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

kushwahck-ibm commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Steps Performed

Result

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mnivedithaa Sep 8, 2026

Choose a reason for hiding this comment

Uh oh!

mnivedithaa Sep 8, 2026

Choose a reason for hiding this comment

Uh oh!

mnivedithaa Sep 8, 2026

Choose a reason for hiding this comment

Uh oh!

mnivedithaa Sep 8, 2026

Choose a reason for hiding this comment

Uh oh!

kushwahck-ibm Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kushwahck-ibm commented Aug 31, 2026 •

edited

Loading