02 — web app with Ingress and HPA

A web service reachable from outside the cluster, scaling on CPU.

What this shows

One Deployment with a multi-port Service (http + metrics).
Singleton ingress block with one host and one TLS secret.
HPA on CPU.
Monitoring via ServiceMonitor (Prometheus Operator), targeting the metrics port by name.
A pod-level securityContext and resource requests / limits.

Added	What changed
`service.ports` (map)	Replaces single-port `service.port` shorthand to expose two ports.
`metrics.enabled: true`	Opt-in to monitoring (defaults are off).
`ingress`	Routes `web.example.com` to the Service. Its `serviceName` is a plain string, so it has to name what the chart renders.
`fullnameOverride`	Pins the prefix on every resource name to `webapp`, making the Service `webapp-web` instead of `webapp-universal-helm-chart-web` — that is the name the Ingress backend spells out.
`hpa`	Auto-scales on CPU; `replicaCount` is omitted from the rendered Deployment because HPA is on (see ADR 007).
`integrations.monitoring.defaults.enabled: true`	Turns the default scrape on for every workload (per-workload `metrics.enabled` still acts as opt-out).

File	Purpose
`values.yaml`	Chart values for this scenario.
`argocd/application.yaml`	Argo CD `Application`, single source.
`argocd/application-multisource.yaml`	Argo CD `Application` with `spec.sources[]`.
`flux/ocirepository.yaml`	Flux `OCIRepository`.
`flux/helmrelease.yaml`	Flux `HelmRelease`.
`helm/install.sh`	Plain `helm upgrade --install` command.

# Helm
bash helm/install.sh

# Argo CD
kubectl apply -f argocd/application.yaml -n argocd

# Flux
kubectl apply -f flux/

An Ingress controller (e.g. nginx, traefik) installed in the cluster. Adjust ingressClassName.
Prometheus Operator CRDs (monitoring.coreos.com) installed if you want the ServiceMonitor to actually be picked up. Without them the chart still renders but the resource has no consumer.
For TLS to work, a Secret named web-example-tls with cert/key, or a cert-manager Certificate issuing into it.