feat(ci): DNS_PROVIDER=manual is a "no DNS yet" run — cluster now, TLS/nginx proxy later (Part of #273, closes #470)

[bhumi46]

Part of #273
Closes #470

Problem

A team without a usable DNS zone (or before DNS is mapped) wants VMs, security groups, EBS, the RKE2 cluster, NFS, PostgreSQL and ActiveMQ now, and DNS / TLS + nginx reverse proxy / Rancher import later. DNS_PROVIDER=manual already skipped the Terraform iam/dns jobs and printed the records, but configure still ran TLS + nginx (Let's Encrypt DNS-01 via Route53 — without permissions in this mode) and failed before RKE2 / NFS / PostgreSQL / ActiveMQ; preflight also waited ~5 min for DNS.

What

• generate.py --without COMPONENT (repeatable / comma list): drops components from the profile's configure_components for this run; unknown names rejected; terraform and data-centre (--from-hosts) modes.
• terraform.yml, DNS_PROVIDER=manual = "no DNS yet": inventory rendered --without nginx --without rancher_import → no DNS gate, no TLS / nginx proxy; the dns play still prints the exact records to create. The nginx host still serves NFS, PostgreSQL and ActiveMQ.
• manual + ENABLE_RANCHER_IMPORT → validate fails early with a clear message.
• Input description / header comment updated; the validate and Render Ansible inventory steps now take inputs via env: (no ${{ inputs }} in those run: blocks).
• README: run 1 (no DNS) → map DNS → run 2 with an API provider (TLS + nginx; the rest skips or is unchanged); data-centre equivalent.

Run with DNS_PROVIDER=manual
Created / configured	security, compute, storage; RKE2; NFS + CSI, PostgreSQL, ActiveMQ
Skipped	Terraform iam / dns; TLS + nginx reverse proxy; Rancher import

Tests

• generate.py: 20 passed (+4: drop nginx + rancher_import → rke2, nfs, postgresql, activemq; comma list; unknown component fails; data-centre mode).
• Mock data-centre run (Docker Ubuntu VMs, real site.yml): records table printed; DNS gate skipped; all 21 TLS/nginx tasks skipped; RKE2 ran (existing cluster detected); NFS server part ran — the CSI step then hit the known Docker RKE2 API instability (not related).
• actionlint clean. zizmor on terraform.yml: same findings before and after (none added).
• No impact on the paths already tested: old vs new Render Ansible inventory step on the same Terraform outputs → inventory byte-identical for terraform-route53, godaddy, cloudflare, rfc2136 (only manual drops nginx + rancher_import). Old vs new validate step over 120 input combinations → only manual + ENABLE_RANCHER_IMPORT on all/configure differ (now rejected, by design).

Follow-ups (pre-existing, not in this PR)

zizmor on terraform.yml: ${{ inputs.REMOTE_BACKEND_CONFIG }} (free text) expanded inside a run: block in the configure job; 8398a7/action-slack@v3 not pinned by hash. Worth a separate hardening PR.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review: 17

• ^main$
• ^master$
• ^master-java21$
• ^develop$
• ^develop2$
• ^develop/.*
• ^release$
• ^release/.*
• ^release-.*
• ^\d+.\d+.x$
• ^\d+.\d+.\d+$
• ^hotfix/.*
• ^hotfix-.*
• ^issue-.*
• develop
• release-*
• MOSIP*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 9344224d-e223-454c-b887-a0a92c2ee5c9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}