Add NetworkPolicy support (was available in v0)

[wingsofovnia]

What motivated this proposal?

Cluster routes between NATS servers currently have no authentication configured by default:

"routes": [
  "nats://nats-0.nats-headless:6222",
  "nats://nats-1.nats-headless:6222",
  ...
]

Without NetworkPolicy, port 6222 is accessible from any pod in the cluster. NetworkPolicy would restrict cluster routing traffic to NATS pods only.

The v0 NATS Helm chart included NetworkPolicy resources, but this feature was not carried over to the current chart version.

What is the proposed change?

Add optional NetworkPolicy, perhaps with per-port configuration (cluster, client connections, leafnodes, websockets etc), with some safe default config.

Who benefits from this change?

No response

What alternatives have you evaluated?

No response

[samuelattwood]

@wingsofovnia There is no longer an explicit value for it, but you should be able to add whatever you need via the extraResources and the merge/patch/templating tools. Just as an example, if you wanted to restrict client access you could include something like this in your values.yaml

I included usage of $tplYaml to exemplify, but you can just drop in a fully-formed manifest as well if you like.

extraResources:
- apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name:
      $tplYaml: >
        {{ include "nats.fullname" $ }}-network-policy
    labels:
      $tplYaml: |
        {{ include "nats.labels" $ }}
  spec:
    podSelector:
      matchLabels:
        $tplYaml: |
          {{ include "nats.selectorLabels" $ }}
    policyTypes:
    - Ingress
    ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            nats-client-access: "true"
      ports:
      - protocol: TCP
        port:
          $tplYaml: >
            {{ .Values.config.nats.port }}
      - protocol: TCP
        port:
          $tplYaml: >
            {{ .Values.config.websocket.port }}