Update Helm chart with correct Istio gateway and DNS config

[rockythorn]

Summary

• Set Istio gateway to istio-system/base-gateway-public (was placeholder default-gateway)
• Add external-dns.alpha.kubernetes.io/target: ingress.build.resf.org annotation to VirtualService

Both values match the existing apollo-frontend-http-prod-vs VirtualService currently routing errata.build.resf.org in the apollo-frontend namespace.

Deployment Plan

Step 1 — Deploy without VirtualService

Deploy the new frontend alongside the old one, with the VirtualService disabled to avoid two VirtualServices competing for the same host:

helm install errata-frontend deploy/helm/ \
  -n apollo-frontend \
  --set istio.enabled=false \
  --set image.tag=latest

Step 2 — Verify via port-forward

kubectl port-forward svc/errata-frontend 8086:8086 -n apollo-frontend

Open http://localhost:8086 and confirm the site loads and static assets render.

Step 3 — Switch traffic

Delete the old VirtualService and enable ours in a single upgrade:

kubectl delete virtualservice apollo-frontend-http-prod-vs -n apollo-frontend
helm upgrade errata-frontend deploy/helm/ \
  -n apollo-frontend \
  --set image.tag=latest

Step 4 — Verify production

Confirm https://errata.build.resf.org loads correctly — advisory list, detail pages, filters, RSS feed.

Step 5 — Clean up old deployment

After confirming the new frontend is stable:

kubectl delete deployment apollo-frontend-deployment -n apollo-frontend
kubectl delete svc apollo-frontend-http-prod-service -n apollo-frontend
kubectl delete svc apollo-frontend-metrics-prod-service -n apollo-frontend
kubectl delete virtualservice apollo-frontend-http-prod-internal-vs -n apollo-frontend
kubectl delete virtualservice apollo-frontend-metrics-prod-internal-vs -n apollo-frontend

Rollback

If something goes wrong after Step 3:

helm uninstall errata-frontend -n apollo-frontend
kubectl apply -f tmp/apollo-frontend-vs-backup.yaml

The old deployment and service are still running until Step 5, so restoring the backed-up VirtualService returns traffic to the original frontend immediately.

Backup files (saved in tmp/ before deployment):

• tmp/apollo-frontend-vs-backup.yaml — public VirtualService for errata.build.resf.org
• tmp/apollo-frontend-internal-vs-backup.yaml — internal service mesh VirtualService
• tmp/apollo-frontend-metrics-vs-backup.yaml — metrics VirtualService