feat: ferro tunnel

[zreigz]

Test Plan

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• I have added tests to cover my changes.
• If required, I have updated the Plural documentation accordingly.

[linear]

PROD-5236

[greptile-apps]

Confidence Score: 0/5

The PR is not safe to merge until the tunnel workload's image, credential, and service-account integration failures are addressed.

Findings

1.  Tunnel ignores registry override ▶
2.  Configured token key is ignored ▶
3.  Default leaves TLS credentials unused ▶
4.  Deployment can lack token Secret ▶
5.   Tunnel inherits cluster-admin access ▶
6.  Observability selects tunnel pods ▶
7.  Credential changes lack rollout signal ▶

Summary

The PR adds an optional FerroTunnel client Deployment, a chart-managed credential Secret, Helm defaults, and Liquid mappings for managed installations.

• The new workload has image-registry, credential-mount, and service-account integration issues.
• Its labels also broaden observability Service selection, and credential updates lack a rollout signal.

_{Reviews (1) · Last reviewed commit: "ferro tunnel"}

[michaeljguarino]

the idea here is this tunnel controller is created via crd and not via helm here