feat: add NetworkPolicy template

charts/nginx-ingress/templates/controller-networkpolicy.yaml

@@ -0,0 +1,47 @@
+{{- /*
+NetworkPolicy for the controller.
+Uses only .Values.controller.networkPolicy.
+Defaults podSelector to controller selectorLabels when empty.
+*/ -}}
+{{- $np := .Values.controller.networkPolicy -}}
+{{- if and $np $np.enabled }}
+
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "nginx-ingress.fullname" . }}-controller-netpol
+  labels:
+    {{- include "nginx-ingress.labels" . | nindent 4 }}
+spec:
+  podSelector:
+  {{- if $np.podSelector }}
+  {{- toYaml $np.podSelector | nindent 4 }}
+  {{- else }}
+    matchLabels:
+  {{- include "nginx-ingress.selectorLabels" . | nindent 6 }}
+  {{- end }}
+
+  {{- if $np.policyTypes }}
+  policyTypes:
+  {{- toYaml $np.policyTypes | nindent 2 }}
+  {{- end }}
+
+  {{- if and $np.policyTypes (has "Ingress" $np.policyTypes) }}
+  {{- if $np.ingress }}
+  ingress:
+  {{- toYaml $np.ingress | nindent 2 }}
+  {{- else }}
+  ingress: []
+  {{- end }}
+  {{- end }}
+
+  {{- if and $np.policyTypes (has "Egress" $np.policyTypes) }}
+  {{- if $np.egress }}
+  egress:
+  {{- toYaml $np.egress | nindent 2 }}
+  {{- else }}
+  egress: []
+  {{- end }}
+  {{- end }}
+
+{{- end }}

charts/nginx-ingress/values.schema.json

@@ -1922,6 +1922,92 @@
           "examples": [
             false
           ]
+        },
+        "networkPolicy": {
+          "type": "object",
+          "default": {},
+          "title": "Optional NetworkPolicy for the Ingress Controller pods",
+          "required": [
+            "enabled"
+          ],
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "default": false,
+              "title": "Create a NetworkPolicy that targets the controller pods"
+            },
+            "policyTypes": {
+              "type": "array",
+              "title": "List of policy types to apply",
+              "items": {
+                "type": "string",
+                "enum": [
+                  "Ingress",
+                  "Egress"
+                ]
+              },
+              "default": [
+                "Ingress",
+                "Egress"
+              ]
+            },
+            "podSelector": {
+              "type": "object",
+              "default": {},
+              "title": "Override selector for targeted pods (empty -> controller selector)",
+              "$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.33.1/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector"
+            },
+            "ingress": {
+              "type": "array",
+              "default": [],
+              "title": "Ingress rules",
+              "items": {
+                "$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.33.1/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyIngressRule"
+              }
+            },
+            "egress": {
+              "type": "array",
+              "default": [],
+              "title": "Egress rules",
+              "items": {
+                "$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.33.1/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyEgressRule"
+              }
+            }
+          },
+          "examples": [
+            {
+              "enabled": true,
+              "policyTypes": [
+                "Ingress",
+                "Egress"
+              ],
+              "podSelector": {},
+              "ingress": [
+                {
+                  "ports": [
+                    {
+                      "protocol": "TCP",
+                      "port": 80
+                    },
+                    {
+                      "protocol": "TCP",
+                      "port": 443
+                    }
+                  ]
+                }
+              ],
+              "egress": [
+                {
+                  "ports": [
+                    {
+                      "protocol": "UDP",
+                      "port": 53
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
         }
       },
       "examples": [

charts/nginx-ingress/values.yaml

@@ -622,6 +622,28 @@ controller:
   ## variable_hash_bucket_size, and variable_hash_max_size in the ConfigMap based on the number of two-way splits.
   enableWeightChangesDynamicReload: false
 
+  # Default values for nginx-ingress with optional NetworkPolicy
+  networkPolicy:
+    enabled: false
+    # If empty, the template will default to the controller selectorLabels
+    podSelector: {}
+    policyTypes:
+      - Ingress
+      - Egress
+    # Default examples (safe, minimal). Feel free to keep them commented out
+    ingress:
+      - from: []   # e.g. - namespaceSelector: { matchLabels: { name: ingress-allow } }
+        ports:
+          - protocol: TCP
+            port: 80
+          - protocol: TCP
+            port: 443
+    egress:
+      - to: []
+        ports:
+          - protocol: UDP
+            port: 53
+
 rbac:
   ## Configures RBAC.
   create: true