Part of #2102 — Epic: Migrate from ingress-nginx to Contour.

Description

Replace ingress-nginx with Contour in the Kind local development reference architecture.

Contour provides an official Kind guide which simplifies this migration.

Current state: ingress-nginx deployed with NodePort, control-plane tolerations, hostNetwork, single replica, no admission webhooks.

Files to modify

• local/kubernetes/kind-single-region/procedure/ingress-nginx-deploy.sh → rename to contour-deploy.sh, use Contour Helm install with Kind-specific settings
• local/kubernetes/kind-single-region/helm-values/values-domain.yml → update ingressClassName to contour
• local/kubernetes/kind-single-region/helm-values/values-no-domain.yml → update references
• local/kubernetes/kind-single-region/Makefile → update ingress.deploy target to reference new script
• local/kubernetes/kind-single-region/configs/coredns-configmap.yaml → update CoreDNS rewrite rules to point to Contour's Envoy service instead of ingress-nginx-controller
• Remove nginx-specific annotations from values files

Current install script

INGRESS_HELM_CHART_VERSION="4.15.0"
helm upgrade --install ingress-nginx ingress-nginx \
    --repo https://kubernetes.github.io/ingress-nginx \
    --version "$INGRESS_HELM_CHART_VERSION" \
    --namespace ingress-nginx \
    --create-namespace \
    --set controller.nodeSelector."node-role\.kubernetes\.io/control-plane"="" \
    --set controller.tolerations[0].key="node-role.kubernetes.io/control-plane" \
    --set controller.tolerations[0].operator="Exists" \
    --set controller.tolerations[0].effect="NoSchedule" \
    --set controller.ingressClassResource.default=true \
    --set controller.replicaCount=1 \
    --set controller.admissionWebhooks.enabled=false \
    --set controller.hostNetwork=true \
    --set controller.service.type=NodePort

Target Contour install (based on Kind guide)

helm repo add contour https://projectcontour.github.io/helm-charts/
helm upgrade --install contour contour/contour \
    --namespace projectcontour \
    --create-namespace \
    --set envoy.hostNetwork=true \
    --set envoy.service.type=NodePort \
    --set contour.ingressClass.default=true

Acceptance criteria

• Contour installed and running in Kind
• CoreDNS rewrite rules point to Contour Envoy service
• camunda.example.com resolves locally via mkcert TLS
• Zeebe gRPC accessible
• Makefile targets updated and working