fix: guard k3s issuer template against absent values

The `issuer.yaml` chart template dereferenced `.Values.global.issuer.enabled` without guarding against the value being absent, which yaml serialization omitted for apps without a per-app email, causing a nil-pointer render error that broke every k3s web deploy.

plugins/scheduler-k3s/certificate_template_test.go

@@ -145,6 +145,25 @@ func TestCertificateTemplateUsesSharedClusterIssuerByDefault(t *testing.T) {
 	}
 }
 
+func TestCertificateTemplateRendersWithoutIssuerValues(t *testing.T) {
+	// Reproduces the deploy failure where global.issuer is absent from values.yaml
+	// (the common case, no per-app email). The chart must still render without a
+	// nil-pointer error, use the shared ClusterIssuer, and emit no Issuer document.
+	docs := renderCertificateChart(t, testCertificateValues("ClusterIssuer", "letsencrypt-prod", nil))
+
+	issuerRef := certificateIssuerRef(t, docs)
+	if issuerRef["kind"] != "ClusterIssuer" {
+		t.Fatalf("expected issuerRef.kind ClusterIssuer, got %#v", issuerRef["kind"])
+	}
+	if issuerRef["name"] != "letsencrypt-prod" {
+		t.Fatalf("expected issuerRef.name letsencrypt-prod, got %#v", issuerRef["name"])
+	}
+
+	if len(docs["issuer"]) != 0 {
+		t.Fatalf("expected no Issuer document when global.issuer is absent, got %#v", docs["issuer"])
+	}
+}
+
 func TestCertificateTemplateDefaultsKindWhenIssuerKindEmpty(t *testing.T) {
 	docs := renderCertificateChart(t, testCertificateValues("", "letsencrypt-prod", map[string]interface{}{"enabled": false}))
 

plugins/scheduler-k3s/template.go

@@ -46,7 +46,7 @@ type GlobalValues struct {
 	AppName         string             `yaml:"app_name"`
 	DeploymentID    string             `yaml:"deployment_id"`
 	Image           GlobalImage        `yaml:"image"`
-	Issuer          AppIssuer          `yaml:"issuer,omitempty"`
+	Issuer          AppIssuer          `yaml:"issuer"`
 	Labels          ProcessLabels      `yaml:"labels,omitempty"`
 	Keda            GlobalKedaValues   `yaml:"keda"`
 	Namespace       string             `yaml:"namespace"`

plugins/scheduler-k3s/templates/chart/issuer.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.global.issuer.enabled }}
+{{- if and .Values.global.issuer .Values.global.issuer.enabled }}
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer