feat(ingress): support exposure_mode for domain-less CloudFront deployments

[allamand]

Context

When deploying via appmod-blueprints in environments without a custom domain (e.g., AWS Workshop Studio), the ALB ingress controller fails with:

FailedBuildModel: no certificate found for host: cnoe.io

This happens because ingress resources specify host and HTTPS:443, which requires an ACM certificate for the domain.

appmod-blueprints now supports an exposure_mode config (domain vs cloudfront) that conditionally renders ingresses with HTTP:80 and no host when using CloudFront. See: aws-samples/appmod-blueprints#680

Affected Charts

The following charts from this repo create Ingress resources that need the same conditional:

• agent-gateway (agentgateway ingress in agentgateway-system)
• langfuse (langfuse ingress)

Requested Change

Add conditional rendering based on global.exposure_mode (passed via valuesObject from the parent ApplicationSet):

{{- if eq (default "domain" .Values.global.exposure_mode) "cloudfront" }}
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80}]'
{{- else }}
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/ssl-redirect: '443'
{{- end }}
spec:
  ingressClassName: platform
  rules:
{{- if eq (default "domain" .Values.global.exposure_mode) "cloudfront" }}
    - http:
{{- else }}
    - host: {{ .Values.global.ingress_domain_name }}
      http:
{{- end }}

Value Propagation

The exposure_mode value is passed from the ArgoCD cluster secret annotation exposure_mode through the ApplicationSet valuesObject:

valuesObject:
  global:
    exposure_mode: '{{default "domain" .metadata.annotations.exposure_mode}}'

This is already configured in appmod-blueprints registry (agents.yaml) — the charts just need to use it.

[allamand]

Related PR in appmod-blueprints: aws-samples/appmod-blueprints#680

That PR implements the exposure.mode config and updates all ingress templates in appmod-blueprints. This issue covers the remaining ingress templates that live in this repo.