fix(deploy): correct HTTPRoute parentRefs, cert-manager annotation, imagePullSecrets

- httproute.yaml: name=default namespace=nginx-gateway (was: itsh-gateway, no namespace)
- httproute.yaml: add cert-manager.io/cluster-issuer annotation for TLS cert issuance
- httproute.yaml: parameterise sectionNames and parentRefs through values
- deployment.yaml: render imagePullSecrets from values (itsh-registry pull secret)
- values.yaml: add parentRefs, annotations, httpRedirectSectionName, imagePullSecrets

deploy/templates/deployment.yaml

@@ -16,6 +16,10 @@ spec:
         {{- include "tutortool.selectorLabels" . | nindent 8 }}
     spec:
       serviceAccountName: {{ include "tutortool.serviceAccountName" . }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       securityContext:
         fsGroup: 1000
       containers:

deploy/templates/httproute.yaml

@@ -5,10 +5,17 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "tutortool.labels" . | nindent 4 }}
+  {{- with .Values.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   parentRefs:
-    - name: itsh-gateway
-      sectionName: {{ .Values.httpRoute.sectionName }}
+    {{- range .Values.httpRoute.parentRefs }}
+    - name: {{ .name }}
+      namespace: {{ .namespace }}
+      sectionName: {{ $.Values.httpRoute.sectionName }}
+    {{- end }}
   hostnames:
     {{- range .Values.httpRoute.hostnames }}
     - {{ . | quote }}
@@ -31,8 +38,11 @@ metadata:
     {{- include "tutortool.labels" . | nindent 4 }}
 spec:
   parentRefs:
-    - name: itsh-gateway
-      sectionName: http-tutor-puchstein-dev
+    {{- range .Values.httpRoute.parentRefs }}
+    - name: {{ .name }}
+      namespace: {{ .namespace }}
+      sectionName: {{ $.Values.httpRoute.httpRedirectSectionName }}
+    {{- end }}
   hostnames:
     {{- range .Values.httpRoute.hostnames }}
     - {{ . | quote }}

deploy/values.yaml

@@ -27,10 +27,19 @@ pvc:
   storageClassName: hcloud-volumes
   storage: 1Gi
 
+imagePullSecrets:
+  - name: itsh-registry
+
 httpRoute:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+  parentRefs:
+    - name: default
+      namespace: nginx-gateway
   hostnames:
     - tutor.puchstein.dev
   sectionName: https-tutor-puchstein-dev
+  httpRedirectSectionName: http-tutor-puchstein-dev
 
 # JWT_SECRET provisioned as a pre-existing K8s Secret named here.
 # Do not set jwtSecretValue in committed values — provision via kubectl manually.