fix: allow OTEL collector egress in NetworkPolicy (#40)

fix: allow OTEL collector egress in NetworkPolicy (ports 4317/4318)

The NetworkPolicy blocked gRPC/HTTP connections to the OTEL collector,
silently dropping trace exports. Adds egress rules for the standard
OTLP ports.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stubbi

internal/resources/networkpolicy.go

@@ -63,6 +63,20 @@ func BuildNetworkPolicy(instance *paperclipv1alpha1.Instance) *networkingv1.Netw
 		},
 	}
 
+	// Allow egress to OTEL collector (gRPC + HTTP) for traces and metrics
+	np.Spec.Egress = append(np.Spec.Egress, networkingv1.NetworkPolicyEgressRule{
+		Ports: []networkingv1.NetworkPolicyPort{
+			{
+				Port:     Ptr(intstr.FromInt32(4317)),
+				Protocol: Ptr(corev1.ProtocolTCP),
+			},
+			{
+				Port:     Ptr(intstr.FromInt32(4318)),
+				Protocol: Ptr(corev1.ProtocolTCP),
+			},
+		},
+	})
+
 	// Allow egress to K8s API server when cloud sandbox is enabled.
 	// The server needs to create/manage sandbox pods via the K8s API.
 	// An explicit rule is needed because some CNIs (k3s Flannel, Calico)