[minor] Enable Public route for cpd - #578
Conversation
mnivedithaa
changed the title
| cat <<EOF | oc apply -f - | ||
| apiVersion: route.openshift.io/v1 | ||
| kind: Route | ||
| metadata: | ||
| name: ${ROUTE_NAME} | ||
| namespace: ${CPD_INSTANCE_NAMESPACE} | ||
| labels: | ||
| type: external | ||
| route-type: external | ||
| spec: | ||
| host: ${CPD_PUBLIC_HOST} | ||
| to: | ||
| kind: Service | ||
| name: ibm-nginx-svc | ||
| weight: 100 | ||
| port: | ||
| targetPort: ibm-nginx-https-port | ||
| tls: | ||
| termination: passthrough | ||
| insecureEdgeTerminationPolicy: None | ||
| EOF | ||
| echo " Route created." | ||
| fi |
There was a problem hiding this comment.
This route should not be created by the job. It should be created and maintained by Argo itself
| cpd_public_route_enabled: false | ||
| cis_subdomain: "" | ||
| cis_domain: "" | ||
| cis_crn: "" |
There was a problem hiding this comment.
Are we using cis_crn anywhere? If no please remove from all three places.
| # ----------------------------------------------------------------------- | ||
| echo | ||
| echo "Step 2: Ensuring cpd-public Route exists..." | ||
| EXISTING_ROUTE=$(oc get route "${ROUTE_NAME}" -n "${CPD_INSTANCE_NAMESPACE}" \ |
There was a problem hiding this comment.
Step 2 skips route creation if ${ROUTE_NAME} already exists — but it does not verify that the existing route's spec.host matches ${CPD_PUBLIC_HOST}. If cis_subdomain or cis_domain ever changes, the old route will silently persist with the stale hostname. Consider adding a host-mismatch check and patching the existing route rather than only guarding against creation.
| | `ClusterRoleBinding` | CP4D cluster role bindings | N/A (cluster-scoped) | Always | `cluster_admin_role` | | ||
| | `Job` | CP4D install and verification jobs | CP4D operators namespace | Version-dependent and always for verification hooks as applicable | `cluster_admin_role` | | ||
| | `Route` | `cpd-public` public route (passthrough TLS, type=external) | CP4D instance namespace | When `cpd_public_route_enabled` is true | `cluster_admin_role` | | ||
| | `Service` | Route backend service reference (ibm-nginx-svc) | CP4D instance namespace | When `cpd_public_route_enabled` is true | `cluster_admin_role` | |
There was a problem hiding this comment.
Are we creating this service or its already exist?
There was a problem hiding this comment.
ibm-nginx-svc is not created by us — it is a pre-existing service installed by CP4D itself as part of its standard deployment. We only reference it in the Route's spec.to.name as the backend. The Service row has been removed from the README to avoid the confusion.
There was a problem hiding this comment.
They this should not part of created record right?
| CURRENT_CUSTOM_HOST=$(oc get ZenService lite-cr -n "${CPD_INSTANCE_NAMESPACE}" \ | ||
| --ignore-not-found -o jsonpath='{.spec.zenCustomRoute.route_host}') | ||
|
|
||
| if [[ "${CURRENT_CUSTOM_HOST}" == "${CPD_PUBLIC_HOST}" ]]; then |
There was a problem hiding this comment.
Step 4 (route restore) only runs inside the ZenService patch branch
File: 09-ibm-cpd-public-route.yaml L227-L244
The internal cpd route is restored in Step 4, but only when CURRENT_CUSTOM_HOST != CPD_PUBLIC_HOST. On a re-run (e.g. after the ArgoCD job re-triggers due to a values change), the ZenService is already patched so the else branch is skipped entirely — meaning if ZenService had silently reverted the cpd route host in the meantime, it would go un-repaired. Consider always re-asserting the internal route host regardless of the ZenService patch path, or at minimum asserting it at the end of the script unconditionally.
|
|
||
| restartPolicy: Never | ||
| serviceAccountName: cpd-sa | ||
| backoffLimit: 2 |
There was a problem hiding this comment.
change backoffLimit to 4
3 participants
Summary
Adds a new Helm Job (
09-ibm-cpd-public-route.yaml) to the110-ibm-cp4dchart thatcreates a public-facing CP4D URL accessible without VPN. Also wires up the new chart values
and passes them through from the instance root application.
https://jsw.ibm.com/browse/MASCORE-15972