[patch] enable tactical SAAS_MODE and override_dns_cis_flags_to_false fixes in suite-dns role

[tomklapiscak]

https://jsw.ibm.com/browse/MASCORE-6361

This PR includes 2 tactical fixes for the rollout of gitops:6.0.0 to address rate limit problems encountered in the suite-dns Job

single edge certificate via SAAS_MODE hostname template

• Ensure only a single edge certificate is ordered per new MAS instance (alleviates 50 certs / week LE limits). This is achieved by setting the SAAS_MODE env var is set to true before running suite-dns role - see [patch] fix suite-dns edge certs logic & remove redundant HTTP call ansible-devops#1714 for details. That PR also resolves an issue whereby edge certs would be reordered even when override_edge_certs: false.

override_dns_cis_flags_to_false

• Add mechanism to ensure dns.cis update_dns_entries, override_edge_certs and delete_wildcards are set to false during >=6.0.0 rollout. This is because >=6.0.0 (necessarily) forces a re-run of the suite-dns Job for all existing MAS instances. If these flags are true when this happens, a new edge cert would be ordered for every MAS instance (which would easily hit the 50 certs / week LE limit, and each run of the suite-dns job would make ~60 unnecessary calls to the CIS HTTP API (which would cause us to repeatedly hit the per IP 100 req / minute rate limit imposed by CIS). This achieved by the introduction of a new override_dns_cis_flags_to_false flag on the root manfiest. When true the dns.cis flags will be forced to false, regardless of envionment configuration. The intention is to actually update these values in the env config post 6.0.0, at which point the override_dns_cis_flags_to_false can (and should) be removed from the root app manifest.

Also pulls in a change from ansible-devops that removes an unnecessary PATCH call made to CIS API that was adding 70 calls each time the suite-dns job ran. See ibm-mas/ansible-devops#1700

Testing

SAAS_MODE: True

Set on suite-dns job:

SaaS-specific edge cert hostnames loaded:

override_dns_cis_flags_to_false flag

No flag set on root manifest:

dns.cis flags set according to env config on syncjobs app:

flag set to false on root manifest:

dns.cis flags set according to env config on syncjobs app:

flag set to true on root manifest:

dns.cis flags ignore env config and are forced to false on syncjobs app:

[rbinns]

Reviewed

The base branch was changed.

[rbinns]

Previously reviewed - this is just rebasing. Reviewed the changes.