feat(helm): replace Ingress with Gateway API HTTPRoute for ITSH Cloud

- Replace Ingress template with HTTPRoute (gateway.networking.k8s.io/v1)
- Add cert-manager.io/cluster-issuer annotation for auto TLS
- Add imagePullSecrets, env, envFrom support to deployment
- Update NOTES.txt with ITSH Cloud DNS records

helm/heatguard/templates/NOTES.txt

@@ -1,10 +1,14 @@
 HeatGuard has been deployed.
 
 1. Get the application URL:
-{{- if .Values.ingress.enabled }}
-{{- range $host := .Values.ingress.hosts }}
-  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}
+{{- if .Values.httpRoute.enabled }}
+{{- range .Values.httpRoute.hostnames }}
+  https://{{ . }}
 {{- end }}
+
+  DNS records should point to:
+    A    → 91.98.6.3
+    AAAA → 2a01:4f8:1c1f:7bfa::1
 {{- else if contains "NodePort" .Values.service.type }}
   export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "heatguard.fullname" . }})
   export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")

helm/heatguard/templates/deployment.yaml

@@ -19,6 +19,10 @@ spec:
       serviceAccountName: {{ include "heatguard.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
@@ -27,6 +31,14 @@ spec:
             - name: http
               containerPort: {{ .Values.service.targetPort }}
               protocol: TCP
+          {{- with .Values.env }}
+          env:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.envFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           livenessProbe:
             httpGet:
               path: /healthz

helm/heatguard/templates/httproute.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.httpRoute.enabled -}}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "heatguard.fullname" . }}
+  labels:
+    {{- include "heatguard.labels" . | nindent 4 }}
+  {{- with .Values.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  parentRefs:
+    {{- toYaml .Values.httpRoute.parentRefs | nindent 4 }}
+  {{- with .Values.httpRoute.hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    - backendRefs:
+        - name: {{ include "heatguard.fullname" . }}
+          port: {{ .Values.service.port }}
+{{- end }}

helm/heatguard/templates/ingress.yaml

@@ -1,41 +0,0 @@
-{{- if .Values.ingress.enabled -}}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ include "heatguard.fullname" . }}
-  labels:
-    {{- include "heatguard.labels" . | nindent 4 }}
-  {{- with .Values.ingress.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  {{- if .Values.ingress.className }}
-  ingressClassName: {{ .Values.ingress.className }}
-  {{- end }}
-  {{- if .Values.ingress.tls }}
-  tls:
-    {{- range .Values.ingress.tls }}
-    - hosts:
-        {{- range .hosts }}
-        - {{ . | quote }}
-        {{- end }}
-      secretName: {{ .secretName }}
-    {{- end }}
-  {{- end }}
-  rules:
-    {{- range .Values.ingress.hosts }}
-    - host: {{ .host | quote }}
-      http:
-        paths:
-          {{- range .paths }}
-          - path: {{ .path }}
-            pathType: {{ .pathType }}
-            backend:
-              service:
-                name: {{ include "heatguard.fullname" $ }}
-                port:
-                  name: http
-          {{- end }}
-    {{- end }}
-{{- end }}

helm/heatguard/values.yaml

@@ -5,21 +5,33 @@ image:
   pullPolicy: IfNotPresent
   tag: ""
 
+imagePullSecrets: []
+
 service:
   type: ClusterIP
   port: 80
   targetPort: 8080
 
-ingress:
+httpRoute:
   enabled: false
-  className: ""
-  annotations: {}
-  hosts:
-    - host: heatguard.local
-      paths:
-        - path: /
-          pathType: Prefix
-  tls: []
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+  parentRefs:
+    - name: default
+      namespace: nginx-gateway
+  hostnames: []
+  # - heatguard.example.com
+
+env: []
+# - name: API_KEY
+#   valueFrom:
+#     secretKeyRef:
+#       name: heatguard-secrets
+#       key: api-key
+
+envFrom: []
+# - configMapRef:
+#     name: heatguard-config
 
 resources:
   requests: