feat: add NetworkPolicy template

charts/nginx-ingress/templates/controller-networkpolicy.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.controller.networkPolicy.enabled }}
+{{- $ingress := .Values.controller.networkPolicy.ingress }}
+{{- $egress := .Values.controller.networkPolicy.egress }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "nginx-ingress.controller.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "nginx-ingress.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "nginx-ingress.selectorLabels" . | nindent 6 }}
+  {{- if or $ingress $egress }}
+  policyTypes:
+    {{- if $ingress }}
+    - Ingress
+    {{- end }}
+    {{- if $egress }}
+    - Egress
+    {{- end }}
+  {{- end }}
+  {{- with $ingress }}
+  ingress:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with $egress }}
+  egress:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/nginx-ingress/values.schema.json

@@ -2103,6 +2103,37 @@
           "examples": [
             false
           ]
+        },
+        "networkPolicy": {
+          "type": "object",
+          "default": {},
+          "title": "Configure a NetworkPolicy for the Ingress Controller pods",
+          "required": [
+            "enabled"
+          ],
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "default": false,
+              "title": "Create a NetworkPolicy that targets the controller pods"
+            },
+            "ingress": {
+              "type": "array",
+              "default": [],
+              "title": "Ingress rules",
+              "items": {
+                "$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.36.1/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyIngressRule"
+              }
+            },
+            "egress": {
+              "type": "array",
+              "default": [],
+              "title": "Egress rules",
+              "items": {
+                "$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.36.1/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyEgressRule"
+              }
+            }
+          }
         }
       },
       "examples": [

charts/nginx-ingress/values.yaml

@@ -714,6 +714,15 @@ controller:
   ## variable_hash_bucket_size, and variable_hash_max_size in the ConfigMap based on the number of two-way splits.
   enableWeightChangesDynamicReload: false
 
+  ## Configure an optional NetworkPolicy for the Ingress Controller pods.
+  networkPolicy:
+    ## Create a NetworkPolicy that targets the controller pods.
+    enabled: false
+    ## Configure ingress rules. When non-empty, the Ingress policy type is added automatically.
+    ingress: []
+    ## Configure egress rules. When non-empty, the Egress policy type is added automatically.
+    egress: []
+
 rbac:
   ## Configures RBAC.
   create: true