fix(helm): quote proxy CA ConfigMap references

Signed-off-by: Philippe Martin <phmartin@redhat.com>

Author: feloy

deploy/helm/openshell/templates/_gateway-workload.tpl

@@ -278,11 +278,11 @@ spec:
     {{- if .Values.upstreamProxy.caBundle.configMapName }}
     - name: upstream-proxy-ca
       configMap:
-        name: {{ .Values.upstreamProxy.caBundle.configMapName }}
+        name: {{ .Values.upstreamProxy.caBundle.configMapName | quote }}
         items:
           # The mounted filename stays fixed so the rendered proxy_ca_bundle
           # path does not depend on the operator's ConfigMap key.
-          - key: {{ .Values.upstreamProxy.caBundle.key | default "ca.crt" }}
+          - key: {{ .Values.upstreamProxy.caBundle.key | default "ca.crt" | quote }}
             path: ca.crt
     {{- end }}
     {{- if .Values.server.providerTokenGrants.spiffe.enabled }}

deploy/helm/openshell/tests/gateway_upstream_proxy_ca_test.yaml

@@ -78,6 +78,26 @@ tests:
                 - key: ca-bundle.crt
                   path: ca.crt
 
+  # Kubernetes requires both ConfigMap reference fields to be strings. Quote
+  # numeric-looking operator values in the rendered workload so YAML does not
+  # decode them as numbers before typed Kubernetes validation.
+  - it: preserves numeric-looking ConfigMap references as strings
+    template: templates/statefulset.yaml
+    set:
+      upstreamProxy.url: https://proxy.corp.example:3130
+      upstreamProxy.caBundle.configMapName: "123"
+      upstreamProxy.caBundle.key: "456"
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: upstream-proxy-ca
+            configMap:
+              name: "123"
+              items:
+                - key: "456"
+                  path: ca.crt
+
   - it: adds no volume when no corporate proxy CA is configured
     template: templates/statefulset.yaml
     set: