fix(chart): rollout strategy + hostAliases for capacity-constrained nodes

- strategy: configurable RollingUpdate (default maxSurge:0/maxUnavailable:1)
  on both the API and operator deployments. The default avoids needing a
  free pod slot during upgrades — the old pod is terminated first, then
  the new one is scheduled into the freed slot — so the chart rolls out
  cleanly on capacity-constrained (e.g. single-node) clusters.
- hostAliases: pass-through on the API deployment for split-horizon DNS
  scenarios (e.g. resolving the public OIDC issuer host to an in-cluster
  Gateway IP from the pod, so backend token exchange succeeds).

Author: AYDEV-FR

charts/dploy/templates/deployment.yaml

@@ -7,6 +7,10 @@ metadata:
     {{- include "dploy.labels" . | nindent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
+  {{- with .Values.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   selector:
     matchLabels:
       {{- include "dploy.selectorLabels" . | nindent 6 }}
@@ -24,6 +28,10 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "dploy.serviceAccountName" . }}
+      {{- with .Values.hostAliases }}
+      hostAliases:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:

charts/dploy/templates/operator-deployment.yaml

@@ -8,6 +8,10 @@ metadata:
     {{- include "dploy.operator.labels" . | nindent 4 }}
 spec:
   replicas: {{ .Values.operator.replicaCount }}
+  {{- with .Values.operator.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   selector:
     matchLabels:
       {{- include "dploy.operator.selectorLabels" . | nindent 6 }}

charts/dploy/values.yaml

@@ -10,6 +10,15 @@
 # ---------------------------------------------------------------------------
 replicaCount: 1
 
+# Rollout strategy. The default avoids a surge pod (maxSurge: 0) so upgrades
+# succeed on capacity-constrained (e.g. single-node) clusters: the old pod is
+# terminated first, then the new one is scheduled into the freed slot.
+strategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxSurge: 0
+    maxUnavailable: 1
+
 image:
   repository: ghcr.io/aydev-fr/dploy
   pullPolicy: IfNotPresent
@@ -94,6 +103,13 @@ operator:
   # Enable leader election to run more than one replica safely.
   leaderElection: false
 
+  # See the API strategy note above: no surge pod, so the rollout fits a full node.
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+
   image:
     repository: ghcr.io/aydev-fr/dploy-operator
     pullPolicy: IfNotPresent