feat(helm): add global.ingress defaults shared across charts

[gavinelder]

Enhancement

Allow global configuration of Ingress options across the platform parent chart and all subcharts via a new global.ingress block. Set once at the parent (enabled, path, defaultPathType, ingressClassName, annotations, extraLabels, tls) and every subchart's Ingress picks it up — no need to repeat controller-wide config per subchart.

Why a global block

In practice, users who expose one of these services via Ingress almost always expose them all the same way: same ingress controller, same class name, same annotations (cert-manager, ALB scheme, NGINX body-size limits, etc.). The previous shape forced the same values to be repeated under platform.ingress.*, studios.ingress.*, wave.ingress.*, and so on — verbose, drift-prone, and easy to get inconsistent across subcharts.

Lifting these controller-wide concerns into global.ingress matches the way users actually configure ingress: one decision per cluster, applied uniformly. Per-chart overrides remain available for the rare case where one service genuinely needs different routing.

Why the Prefix default change

With the previous defaults (defaultPathType: ImplementationSpecific, path: "/"), the same chart and values produced different routing behavior depending on the customer's ingress controller:

• NGINX treats path: / + ImplementationSpecific as a prefix match
• AWS ALB treats it as an exact match and needs /* for the same effect
• GKE applies its own controller-specific interpretation

That's an unpredictable user experience: the chart "works" on one cluster and silently routes differently on another. Switching the default to Prefix is spec-defined and produces consistent prefix-match semantics across NGINX, Traefik, AWS ALB, and most modern controllers. Customers can still override per-controller when needed.

Summary

• Introduce global.ingress block (enabled, path, defaultPathType, ingressClassName) that the platform parent and every subchart's Ingress falls back to. Set once at the parent and every chart picks it up.
• BREAKING: default defaultPathType is now Prefix (was ImplementationSpecific). ALB users on the old default can set global.ingress.defaultPathType: ImplementationSpecific once at the parent.
• Adds a seqera.ingress.host template helper in each chart's _helpers.tpl returning that chart's primary domain. Set it once in global.ingress.annotations and the right hostname renders per chart:

  global:
    ingress:
      annotations:
        external-dns.alpha.kubernetes.io/hostname: '{{ include "seqera.ingress.host" . }}'

• Adds docs/conventions/ingress.md documenting the Ingress conventions for this repo.
• Updates examples/ingress-configurations/* to drop redundant defaultPathType: Prefix overrides and showcase global.ingress.ingressClassName in nginx-cert-manager.yaml.

Resolution semantics

Field	Local default	Global default	Resolution
enabled	false	false	OR — either being true enables the Ingress
path	""	"/"	Local wins when set; otherwise global
defaultPathType	""	"Prefix"	Local wins when set; otherwise global
ingressClassName	""	""	Local wins when set; otherwise global
annotations	{}	{}	Merged; local wins on key collision
extraLabels	{}	{}	Merged; local wins on key collision
tls	[]	[]	Concatenated (supports a single wildcard cert across charts)

Version bumps

• platform 0.32.3 → 0.33.0
• studios 1.2.11 → 1.3.0
• portal-web 0.2.5 → 0.3.0
• mcp 0.3.2 → 0.4.0
• wave 0.1.0 → 0.2.0
• agent-backend 0.4.7 → 0.5.0

Tests

• All 1279 helm-unittest tests pass (snapshots refreshed for the new default pathType).
• New tests cover: rendering when only global.ingress.enabled is true; falling back to global.ingress.defaultPathType when local is empty; local defaultPathType overriding global.

Test plan

• Confirm version bumps are correct (or adjust before merge)
• Confirm Prefix default is acceptable as a breaking change, or restore ImplementationSpecific and only ship the global plumbing
• Sanity-check rendered output with each example file: helm template platform charts/platform -f charts/platform/examples/ingress-configurations/<file>
• Review docs/conventions/ingress.md content/wording

🤖 Generated with Claude Code

[gwright99]

FWIW, I would still have to do some minor bespoke annotations in the individual Ingresses still (e.g externaldns entry, unique group numbering since my Ingresses share an ALB for cost savings).

In general, however, I like the idea of being more DRY so there are fewer ways I can shoot myself in the foot as I'm updating various charts 👍

[gavinelder]

@gwright99

For external DNS we have the following

based on your example chart usage the new value would be the following at the top level.

(This is in the examples)

global:
  ingress:
    enabled: true
    ingressClassName: alb
    annotations:
      alb.ingress.kubernetes.io/group.name: cluster-alb
      alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
      alb.ingress.kubernetes.io/ssl-redirect: "443"
      external-dns.alpha.kubernetes.io/hostname: '{{ include "seqera.ingress.host" . }}'

If you wish to specific annotations at a deployment level these can still be merged.

wave:
  ingress:
    annotations:
	  alb.ingress.kubernetes.io/group.order: 1 

[bebosudo]

LGTM, nice addition, only one minor comment

[bebosudo]

The chart versions were updated in the changelog files and readme files, but weren't updated in the chart.yaml files, which automatically rebuilds the readme files upon commit with helm-docs, so changing the readmes was reverted in my latest merge commit - could you make sure prek is installed in your local repo?

Once versions are upgraded, could you run make rebuild-deps-force too to update the Chart.lock file in charts/platform with the new subchart versions?