feat: add tenant chart and Kubernetes networking examples

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

Related to #254. This implements a deployment-layer alternative for unified Tenant/networking configuration; it does not add native Ingress or HTTPRoute reconciliation to the Tenant CRD.

Summary of Changes

Deploying a Tenant currently requires users to assemble their own external access manifests. Add an optional, separate rustfs-tenant chart that renders the existing Tenant resource and independently enabled S3 API / Tenant Console Ingress or HTTPRoute resources. HTTPRoutes attach to existing Gateways and can include explicit backend TLS validation policies.

Keep the ownership boundary explicit: Helm or GitOps owns the Tenant and routes; the Operator owns its existing Services and workloads; platform administrators own shared Gateways, controllers, DNS and external certificates. No CRD, controller, RBAC, existing Service, or Operator chart default changes are needed. Both endpoints remain internal-only by default, and tenant.spec uses the existing native CRD fields without templated environment injection.

Provide plain Kubernetes YAML and Kustomize alternatives, chart values examples, and documentation for path-style/virtual-hosted S3, Console/OIDC routing, edge versus backend TLS, upgrade/teardown ownership, and data-path verification. Package the Tenant chart alongside the Operator chart in releases. Add rendering contract tests that compare route backends with Services generated by the actual Tenant implementation.

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (if needed)
• CHANGELOG.md updated under [Unreleased] (if user-visible change)
• CI/CD passed (if applicable)

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: Optional new deployment method; existing Tenant YAML and installations require no migration. Contributors need Helm 3 on PATH for chart contract tests (CI already installs it).

Verification

RUSTUP_TOOLCHAIN=1.98.1 make -j4 pre-commit
helm lint deploy/rustfs-tenant
cargo test --test tenant_chart
kubectl kustomize examples/networking/ingress
kubectl kustomize examples/networking/gateway
helm package deploy/rustfs-operator --destination /tmp/rustfs-charts
helm package deploy/rustfs-tenant --destination /tmp/rustfs-charts
helm repo index /tmp/rustfs-charts

The complete local gate passed with Rust 1.98.1, including nine chart contract tests. The preinstalled stable rustfmt/clippy binaries had missing dynamic libraries, so the toolchain was selected through the environment without changing repository configuration.

Additional offline checks validate the rendered Tenant against the repository CRD and HTTPRoute/BackendTLSPolicy against the Gateway API v1.4.0 CRD OpenAPI schemas. This does not execute Kubernetes CEL admission rules or validate controller behavior.

Live gateway/S3/OIDC tests were not run. Provisioning a dedicated local Kind cluster stalled while downloading the node image; the attempt was stopped and cleaned up. Runtime validation steps are documented for the target platform.

Additional Notes

This chart does not adopt existing resources or install shared infrastructure. helm uninstall removes the Tenant and chart-owned networking; deleting only the Tenant CR leaves the separately managed routes. Rendering with helm template followed by kubectl apply does not create a Helm release and requires explicit pruning. These lifecycle differences are documented.

The existing published release does not gain this chart until a release containing this change is published. BackendTLSPolicy requires Gateway API v1.4+ and controller support.

[GatewayJ]

@codex