feat: add Gateway API HTTPRoute support & existing secret for DB credentials

[aagarwal-apexanalytix]

Summary

• Adds native Kubernetes Gateway API HTTPRoute support as an alternative (or complement) to traditional Ingress resources
• Adds db.existingSecret support to pull DB credentials from an existing Kubernetes secret (e.g. CrunchyData pguser secret) instead of hardcoding them in the ConfigMap
• Reverts db.sslmode default to disable to match upstream

Changes

1. Gateway API HTTPRoute support

File	Change
values.yaml	Added gateway section (disabled by default) with enabled, annotations, and parentRefs fields
templates/httproute.yaml	New template — generates 3 gateway.networking.k8s.io/v1 HTTPRoute resources

New values:

gateway:
  enabled: false
  annotations: {}
  parentRefs:
    - name: ""
      namespace: ""
      sectionName: https

• Independent of Ingress: ingress.enabled and gateway.enabled are fully independent — both can be true for migration scenarios
• Reuses existing hostname values: Hostnames come from ingress.hostPrefix.{broker,rest,ui} + baseDomain
• No breaking changes: Default gateway.enabled: false means existing deployments are unaffected

2. Existing Kubernetes secret for DB credentials

File	Change
values.yaml	Added db.existingSecret block with enabled, name, and keys sub-fields; reverted db.sslmode default to disable
templates/configmap.yml	Conditionally omit SQL_HOST/SQL_PORT/SQL_DB/SQL_USER/SQL_PASS when existingSecret.enabled is true (SQL_SSL_MODE always stays)
templates/netmaker-statefulset.yaml	Add conditional env entries with secretKeyRef that override ConfigMap values
templates/mq.yaml	Same conditional env block for the MQ deployment

New values:

db:
  existingSecret:
    enabled: false
    name: ""
    keys:
      host: "pgbouncer-host"
      port: "pgbouncer-port"
      username: "user"
      password: "password"
      database: "dbname"

• Default key mappings match CrunchyData's pguser secret format — users with different secrets can override individual key names
• Backward compatible: When existingSecret.enabled is false (default), behavior is identical to before
• env overrides envFrom: Kubernetes merges envFrom first, then env entries override, so the secret values take precedence over any ConfigMap values

Test plan

• helm template test . with defaults — ConfigMap has all SQL_* keys, no secretKeyRef, no HTTPRoutes
• helm template test . --set gateway.enabled=true --set 'gateway.parentRefs[0].name=my-gw' — verify 3 HTTPRoute resources
• helm template test . --set db.existingSecret.enabled=true --set db.existingSecret.name=postgres-pguser-usrnetmaker — ConfigMap omits SQL creds, both StatefulSet and MQ Deployment have secretKeyRef entries
• helm template test . --set db.existingSecret.enabled=true --set db.existingSecret.name=my-secret --set db.existingSecret.keys.host=my-host-key — verify custom key mappings work