feat: add NetworkPolicy template

[GabboPenna]

Proposed changes

This PR adds optional NetworkPolicy support to the nginx-ingress Helm chart.

It introduces:

• A new controller.networkPolicy section in values.yaml with:
  • An enabled flag.
  • Configurable ingress and egress rules.
• A NetworkPolicy template that always derives its podSelector from nginx-ingress.selectorLabels so it targets the correct controller pods.
• Automatic policyTypes generation based on whether ingress and/or egress rules are configured.
• JSON schema validation and Helm snapshot coverage.

With this change, chart consumers can declare fine-grained network controls for their Ingress Controller pods without maintaining external manifests.

Fixes: #8060

Checklist

• I have read the CONTRIBUTING doc
• I have added tests that prove my feature works
• I have checked that all Helm unit tests and helm lint pass
• I have updated the necessary values documentation and schema
• I have refreshed the branch on main
• I have hereby read the F5 CLA and agree to its terms

[github-actions]

✅ All required contributors have signed the F5 CLA for this PR. Thank you!
_{Posted by the CLA Assistant Lite bot.}

[GabboPenna]

I have hereby read the F5 CLA and agree to its terms

[AlexFenlon]

Hi @GabboPenna,

Thanks for this PR,

Can you please create an issue for this so we can track it appropriately.

[GabboPenna]

Hi @GabboPenna,

Thanks for this PR,

Can you please create an issue for this so we can track it appropriately.

Hi @AlexFenlon, i open a new issue: #8060

[vepatel]

hi @GabboPenna, can you please also update:

1. helm schema files for NetworkPolicy: https://github.com/GabboPenna/kubernetes-ingress/blob/add-networkpolicy-support/charts/nginx-ingress/values.schema.json
2. helm tests for NetworkPolicy https://github.com/GabboPenna/kubernetes-ingress/blob/add-networkpolicy-support/charts/tests/helmunit_test.go, you can run make test-update-snaps from project root to generate new snapshots based off of helm values in /testdata

[github-actions]

This PR is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[github-actions]

This PR was closed because it has been stalled for 10 days with no activity.

[GabboPenna]

hi @GabboPenna, can you please also update:

1. helm schema files for NetworkPolicy: https://github.com/GabboPenna/kubernetes-ingress/blob/add-networkpolicy-support/charts/nginx-ingress/values.schema.json

2. helm tests for NetworkPolicy https://github.com/GabboPenna/kubernetes-ingress/blob/add-networkpolicy-support/charts/tests/helmunit_test.go, you can run `make test-update-snaps` from project root to generate new snapshots based off of helm values in /testdata

Hi, sorry for the delay:

1. Helm schema file
2. testdata for netpool and new snap

Let me know if I need to do anything else.
Thanks.

[haywoodsh]

I looked at controller-networkpolicy.yaml and I think we should make the configuration more robust by avoiding manual selector entry. Maybe we should follow the pattern used in the HorizontalPodAutoscaler template or PodDisruptionBudget template where the target selectors are not configurable by the user but are derived from the chart's context:

  selector:
    matchLabels:
      {{- include "nginx-ingress.selectorLabels" . | nindent 6 }}

https://github.com/nginx/kubernetes-ingress/blob/main/charts/nginx-ingress/templates/controller-pdb.yaml#L14-L16
We should do the same for the NetworkPolicy's podSelector. Instead of exposing it in values.yaml, we should hardcode it in the template to ensure it always targets the correct controller pods. This removes the risk of a mismatch.

Additionally, we can simplify values.yaml by automatically determining policyTypes. If ingress rules are present, we add "Ingress"; if egress rules are present, we add "Egress". This would leave ingress: [] and egress: [] as the only configurable fields under networkPolicy, making it much cleaner.

What do you think?

[javorszky]

Hi @GabboPenna!

This PR / Issue pair came up in our community call. There is a pending comment waiting for your input. Let us know what you think of the suggestions!

Thank you!

[github-actions]

This PR is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[github-actions]

This PR was closed because it has been stalled for 10 days with no activity.

[GabboPenna]

Hi @haywoodsh, apologies for the long delay. I agree with your suggestions and have updated the PR accordingly.

The podSelector is now derived from nginx-ingress.selectorLabels, while policyTypes is automatically generated from the configured ingress and egress rules. I also refreshed the implementation on the current main, updated the schema, and added Helm test coverage and snapshots.

I verified the changes locally with Helm v3.21.2 using the full chart test suite and helm lint.

Thanks for reopening the PR and for your patience. Please let me know if anything else needs adjusting.

[Copilot]

Pull request overview

Adds optional NetworkPolicy support to the charts/nginx-ingress Helm chart, allowing consumers to define ingress/egress rules for the controller pods via values.yaml while keeping label selection consistent with the chart’s controller workload.

Changes:

• Introduces controller.networkPolicy values (enabled/ingress/egress) and corresponding JSON schema validation.
• Adds a controller-networkpolicy.yaml template that targets controller pods via nginx-ingress.selectorLabels and auto-populates policyTypes based on configured rules.
• Extends Helm unit snapshot coverage with new test value sets and updated snapshots.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
charts/nginx-ingress/templates/controller-networkpolicy.yaml	New NetworkPolicy template gated by controller.networkPolicy.enabled, with selectorLabels-based pod selection and optional ingress/egress sections.
charts/nginx-ingress/values.yaml	Adds controller.networkPolicy configuration knobs and inline documentation.
charts/nginx-ingress/values.schema.json	Adds schema for controller.networkPolicy, referencing k8s NetworkPolicy rule definitions.
charts/tests/helmunit_test.go	Adds Helm unit test cases for NetworkPolicy disabled, ingress-only, and ingress+egress scenarios.
charts/tests/testdata/network-policy-disabled.yaml	Test values for NetworkPolicy disabled case.
charts/tests/testdata/network-policy-ingress.yaml	Test values for ingress-only NetworkPolicy.
charts/tests/testdata/network-policy-ingress-egress.yaml	Test values for ingress+egress NetworkPolicy.
charts/tests/snapshots/helmunit_test.snap	Updates snapshots to cover the new NetworkPolicy template output.

[AlexFenlon]

Hi @GabboPenna, thanks for coming back to this PR! great to see you again.

we really appreciate that you addressed the feedback, we will look into this as soon as we can!

[pdabelf5]

/approve-pipeline-run

[vepatel]

/approve-pipeline-run