chore(eks): remediate management runtime blockers

[plural-copilot]

Summary

Create the minimal bootstrap management-runtime release required for the EKS 1.35 add-on blockers.

Version changes

• Runtime chart: 0.1.36 → 0.1.37
• Runtime public ingress-nginx dependency: chart 4.14.1 → 4.15.0 (controller app 1.14.1 → 1.15.0)
• Runtime private ingress-nginx alias dependency: chart 4.14.1 → 4.15.0 (controller app 1.14.1 → 1.15.0)
• Gatekeeper GlobalService: chart/app 3.15.1 → 3.21.1 (upstream chart metadata reports appVersion v3.21.1)

charts/runtime/Chart.lock and the vendored archive were refreshed (ingress-nginx-4.14.1.tgz replaced by ingress-nginx-4.15.0.tgz). No encrypted runtime values or unrelated runtime components changed.

Ownership and scope

charts/runtime/Chart.yaml packages ingress-nginx twice: the normal subchart and the ingress-nginx-private alias. Both pins must move together to keep public and private runtime controllers aligned.

Gatekeeper is not a workload-only declaration here. The definitive chart source is resources/policy/services/gatekeeper.yaml, a fleet-wide GlobalService; setup/pr-automation/gatekeeper-setup.yaml copies this bootstrap-owned template into bootstrap/policy management-app configuration. It is therefore included in this same minimal remediation.

Deployment order

This PR must be merged and released first, so the bootstrap chart release runtime-0.1.37 is available. Then update plrl-up-demos in the downstream management runtime ServiceDeployment-reference PR to reference 0.1.37, and wait for that reference PR to reconcile healthy.

Only after that healthy reconciliation, apply the existing management upgrade PR #2782, then #2779. This change is additive to #2782 and #2779: it supplies prerequisite controller versions and does not replace, reorder internally, or otherwise modify either upgrade PR.

Validation

Passed with containerized Helm 3.17.3:

docker run --rm --entrypoint /bin/sh -v "$PWD:/work" -w /work alpine/helm:3.17.3 -ec '
  helm repo add jetstack https://charts.jetstack.io
  helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
  helm repo add fluxcd-community https://fluxcd-community.github.io/helm-charts
  helm dependency build charts/runtime
  helm lint charts/runtime
  helm template runtime charts/runtime > /tmp/runtime-rendered.yaml
'

Results: dependency build succeeded; linted 1 chart with 0 failures (one non-blocking recommended-icon info message); template rendered 2,312 lines. Inspected vendored ingress metadata confirms chart 4.15.0 / appVersion 1.15.0; inspected Gatekeeper upstream metadata confirms chart 3.21.1 / appVersion v3.21.1.

git diff --check

Result: passed.

Plural Stack: mgmt
Plural Service: mgmt/runtime
Plural Service: mgmt/apps

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create ONE minimal management-runtime EKS 1.35 blocker-remediation PR in this repository. Do not inspect or modify any pre-existing PR branches....
🔗 Run history	View run history