feat: allow dynamic list of ingress rules (#21)

The control NetworkPolicy only ever allowed traffic from the
ingress-nginx namespace, with no way to add more. In clusters that
deny pod-to-pod traffic by default, that leaves no way to permit
other legitimate callers, such as PgDog pods reaching the control
plane's API.

Add networkPolicy.extraIngress, a list of NetworkPolicyIngressRule
entries appended to the control NetworkPolicy's ingress rules
verbatim, alongside the existing ingress-nginx rule.

Author: siryur

README.md

@@ -48,6 +48,7 @@ The PgDog deployment contains the following components:
 | ConfigMap | Configuration for the control plane. |
 | Secret | Secret that stores the key used to encrypt authentication cookies. |
 | Service account, Cluster role, Cluster role bindings | Service account with RBAC to access select Kube APIs. See [RBAC](#rbac) for more details. |
+| NetworkPolicy | Optional; restricts ingress/egress traffic. See [NetworkPolicy](#networkpolicy) for more details. |
 
 In addition to installing the PgDog control plane, this chart will deploy a Redis deployment (with one replica). The control plane uses Redis for storing
 metrics. The Redis deployment has the following components:
@@ -293,6 +294,37 @@ In the above example, the dashboard can see workloads in every namespace, but it
 
 If your cluster manages RBAC out-of-band (a platform team's controller, GitOps, an admission policy), set `control.rbac.create: false`. The chart then renders no ServiceAccount, no ClusterRole/Binding, and no Role/Bindings, and the deployment runs the pod with `automountServiceAccountToken: false`. The dashboard still serves the UI, but every Kubernetes-backed view will be empty until you bind an externally-managed ServiceAccount with equivalent permissions to the pod yourself.
 
+## NetworkPolicy
+
+When `networkPolicy.enabled` is `true`, the chart renders a `NetworkPolicy` for the control pod and one for Redis, restricting traffic to what the control plane actually needs:
+
+- Ingress on `control.port` from the `ingress-nginx` namespace only.
+- Egress to Redis, to `kube-system` for DNS, and to the public internet on 5432 (Postgres) and 443 (HTTPS, e.g. the AWS/CloudWatch/RDS APIs), excluding RFC1918 private ranges.
+- Redis accepts ingress only from the control pod and allows no egress.
+
+In clusters that deny pod-to-pod traffic by default, the built-in ingress-nginx rule alone often isn't enough — for example, PgDog pods calling the control plane's API need their own rule. Use `networkPolicy.extraIngress` to add any number of additional ingress rules to the control `NetworkPolicy`:
+
+```yaml
+networkPolicy:
+  enabled: true
+  extraIngress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: pgdog
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: pgdog
+      ports:
+        - protocol: TCP
+          port: 8080
+```
+
+| Option | Description |
+|-|-|
+| `networkPolicy.enabled` | Render the control and Redis `NetworkPolicy` resources (bool, default `false`). |
+| `networkPolicy.extraIngress` | Additional ingress rules appended to the control `NetworkPolicy`, on top of the built-in ingress-nginx rule. Each entry follows the standard `NetworkPolicyIngressRule` schema (`from`/`ports`) and is passed through verbatim (list, default `[]`). |
+
 ## AWS access (EKS / IRSA)
 
 The control plane reads RDS topology and CloudWatch metrics so the dashboard can show your databases alongside the PgDog workloads. To do that in EKS without baking long-lived keys into the cluster, the recommended path is **IRSA** (IAM Roles for Service Accounts).

templates/networkpolicy.yaml

@@ -20,6 +20,9 @@ spec:
     ports:
     - protocol: TCP
       port: {{ .Values.control.port }}
+  {{- with .Values.networkPolicy.extraIngress }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   egress:
   - to:
     - podSelector:

test/values-networkpolicy.yaml

@@ -0,0 +1,16 @@
+networkPolicy:
+  enabled: true
+  extraIngress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: pgdog
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: pgdog
+      ports:
+        - protocol: TCP
+          port: 8080
+    - from:
+        - ipBlock:
+            cidr: 10.0.0.0/16

values.yaml

@@ -191,6 +191,25 @@ redis:
 
 networkPolicy:
   enabled: false
+  # extraIngress appends additional ingress rules to the control
+  # NetworkPolicy, on top of the built-in rule allowing traffic from the
+  # ingress-nginx namespace. Each entry follows the standard
+  # NetworkPolicyIngressRule schema (from/ports) and is passed through
+  # verbatim. Useful in clusters that deny pod-to-pod traffic by default,
+  # e.g. to allow pgdog pods to reach the control API.
+  # Example:
+  # extraIngress:
+  #   - from:
+  #       - namespaceSelector:
+  #           matchLabels:
+  #             kubernetes.io/metadata.name: pgdog
+  #         podSelector:
+  #           matchLabels:
+  #             app.kubernetes.io/name: pgdog
+  #     ports:
+  #       - protocol: TCP
+  #         port: 8080
+  extraIngress: []
 
 ingress:
   enabled: true