feat(chart): make NebariApp gateway explicit (public) for frontend and webapi

[viniciusdc]

Description

Adds an explicit gateway: public field to both NebariApp CRs defined in the nebariapp.yaml chart template, instead of relying on the kubebuilder default value.

Why

The NebariApp spec has gateway as an optional field with a +kubebuilder:default=public marker. While the default is public, making it explicit:

1. Makes the intent clear in the rendered manifest — reviewers don't need to look up the CRD defaults to understand which gateway is used.
2. Prevents surprises if the default ever changes in a future operator version.
3. Adds an explanatory comment documenting the oauth2-proxy architecture and the planned migration path.

Architecture note

Frontend NebariApp (/oauth2/* + /* → oauth2-proxy sidecar):

• auth.enabled: false / enforceAtGateway: false — the Gateway passes traffic straight through to the pod.
• The oauth2-proxy sidecar in the frontend pod intercepts every request and enforces Keycloak login before proxying to the nginx static server.

Webapi NebariApp (/api/* → Go webapi):

• auth.enabled: false / enforceAtGateway: false — no SecurityPolicy created.
• The webapi validates Bearer tokens in-process via its JWT validator.

Future migration path

Once nebari-operator#61 is resolved, the oauth2-proxy sidecar can be made optional. At that point this chart can switch the frontend NebariApp to auth.enabled: true, enforceAtGateway: true, moving OIDC enforcement to the Envoy Gateway level natively.

Changes

• charts/nebari-landing/templates/nebariapp.yaml: add gateway: public + comments to both NebariApp resources

Testing

• Render the chart with helm template and confirm both NebariApp resources include gateway: public:

  helm template nebari-landing charts/nebari-landing     --set nebariApp.enabled=true     --set httpRoute.hostname=nebari.example.com     | grep -A2 'kind: NebariApp'

[github-actions]

Docker images built for this PR

Branch tag: feat-explicit-public-gateway-nebariapp

Component	Image	Platforms
webapi	quay.io/nebari/nebari-webapi:feat-explicit-public-gateway-nebariapp	linux/amd64 · linux/arm64
frontend	quay.io/nebari/nebari-landing:feat-explicit-public-gateway-nebariapp	linux/amd64 · linux/arm64

To deploy this PR locally:

helm upgrade --install nebari-landing charts/nebari-landing \
  --namespace nebari-system \
  --set webapi.image.tag=feat-explicit-public-gateway-nebariapp \
  --set frontend.image.tag=feat-explicit-public-gateway-nebariapp