feat(helm): add GKE ManagedCertificate support for automatic TLS

[chocobar]

Summary

• Adds optional support for Google-managed TLS certificates on GKE deployments
• When enabled, the Helm chart automatically creates a ManagedCertificate resource
• Eliminates the need for manual certificate setup when deploying to GKE with a custom domain

Usage

In values.yaml:

ingress:
  enabled: true
  className: "gce"
  annotations:
    kubernetes.io/ingress.global-static-ip-name: "helix-ip"
    networking.gke.io/managed-certificates: "my-helix-controlplane-managed-cert"
  hosts:
    - host: helix.example.com
      paths:
        - path: /
          pathType: Prefix
  gke:
    managedCertificate:
      enabled: true

Test plan

• Deploy to GKE with ingress.gke.managedCertificate.enabled: true
• Verify ManagedCertificate resource is created
• Verify certificate provisions successfully (takes 10-15 min)
• Verify HTTPS works on the domain

🤖 Generated with Claude Code