feat(security): enable chart-native network policies where charts support them

[Tanguille]

Follow-up to #4072 answering "can we enable network policies natively in charts?" — surveyed every pinned chart in the repo. Only two have a native knob, both enabled here; both verified rendering via helm template against the pinned versions:

• kube-state-metrics 7.8.1: networkPolicy.enabled + flavor: cilium → a real CiliumNetworkPolicy locking a pod that holds cluster-wide list/watch RBAC to kube-apiserver egress and metrics-port ingress only.
• cert-manager v1.21.0: controller + webhook + cainjector networkPolicy.enabled → upstream-scoped vanilla policies (metrics/healthz ingress; 80/443 + DNS egress, which covers apiserver via the kubernetes ClusterIP).

Not done, deliberately: app-template's networkpolicies block (renders vanilla-only — cannot express the kube-apiserver entity or deny rules from #4072, and per-app allowlists across ~20 media apps is the maintenance burden #4072 was designed to avoid). No other pinned chart (cnpg, dragonfly-operator, rook-ceph, coredns, external-dns, envoy-gateway, crowdsec, grafana-operator) exposes a netpol value.

No interaction risk with #4072: different namespaces entirely, and Cilium deny rules always win over allows regardless.

Verification: helm template on both pinned charts with these exact values renders the policies; kustomization YAML parses. Post-merge: confirm cert-manager still completes an ACME order (egress 443/DNS is allowed by the chart's own policy) and KSM metrics keep scraping.

[tanguille-cluster]

@@ spec.values @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/cert-manager/cert-manager
! + two map entries added:
+ cainjector:
+   networkPolicy:
+     enabled: true
+ networkPolicy:
+   enabled: true

@@ spec.values.webhook @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/cert-manager/cert-manager
! + one map entry added:
+ networkPolicy:
+   enabled: true

@@ spec.values @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/observability/kube-state-metrics
! + one map entry added:
+ networkPolicy:
+   enabled: true
+   flavor: cilium

[tanguille-cluster]

@@ (root level) @@
# networking.k8s.io/v1/NetworkPolicy/cert-manager/cert-manager-cainjector-allow-ingress
! + one document added:
+ apiVersion: networking.k8s.io/v1
+ kind: NetworkPolicy
+ metadata:
+   name: cert-manager-cainjector-allow-ingress
+   namespace: cert-manager
+   labels:
+     helm.toolkit.fluxcd.io/name: cert-manager
+     helm.toolkit.fluxcd.io/namespace: cert-manager
+ spec:
+   ingress:
+   - ports:
+     - port: http-metrics
+       protocol: TCP
+   podSelector:
+     matchLabels:
+       app.kubernetes.io/component: cainjector
+       app.kubernetes.io/instance: cert-manager
+       app.kubernetes.io/name: cainjector
+   policyTypes:
+   - Ingress

@@ (root level) @@
# networking.k8s.io/v1/NetworkPolicy/cert-manager/cert-manager-cainjector-allow-egress
! + one document added:
+ apiVersion: networking.k8s.io/v1
+ kind: NetworkPolicy
+ metadata:
+   name: cert-manager-cainjector-allow-egress
+   namespace: cert-manager
+   labels:
+     helm.toolkit.fluxcd.io/name: cert-manager
+     helm.toolkit.fluxcd.io/namespace: cert-manager
+ spec:
+   egress:
+   - ports:
+     - port: 80
+       protocol: TCP
+     - port: 443
+       protocol: TCP
+     - port: 53
+       protocol: TCP
+     - port: 53
+       protocol: UDP
+     - port: 6443
+       protocol: TCP
+   podSelector:
+     matchLabels:
+       app.kubernetes.io/component: cainjector
+       app.kubernetes.io/instance: cert-manager
+       app.kubernetes.io/name: cainjector
+   policyTypes:
+   - Egress

@@ (root level) @@
# networking.k8s.io/v1/NetworkPolicy/cert-manager/cert-manager-allow-ingress
! + one document added:
+ apiVersion: networking.k8s.io/v1
+ kind: NetworkPolicy
+ metadata:
+   name: cert-manager-allow-ingress
+   namespace: cert-manager
+   labels:
+     helm.toolkit.fluxcd.io/name: cert-manager
+     helm.toolkit.fluxcd.io/namespace: cert-manager
+ spec:
+   ingress:
+   - ports:
+     - port: http-metrics
+       protocol: TCP
+     - port: http-healthz
+       protocol: TCP
+   podSelector:
+     matchLabels:
+       app.kubernetes.io/component: controller
+       app.kubernetes.io/instance: cert-manager
+       app.kubernetes.io/name: cert-manager
+   policyTypes:
+   - Ingress

@@ (root level) @@
# networking.k8s.io/v1/NetworkPolicy/cert-manager/cert-manager-allow-egress
! + one document added:
+ apiVersion: networking.k8s.io/v1
+ kind: NetworkPolicy
+ metadata:
+   name: cert-manager-allow-egress
+   namespace: cert-manager
+   labels:
+     helm.toolkit.fluxcd.io/name: cert-manager
+     helm.toolkit.fluxcd.io/namespace: cert-manager
+ spec:
+   egress:
+   - ports:
+     - port: 80
+       protocol: TCP
+     - port: 443
+       protocol: TCP
+     - port: 53
+       protocol: TCP
+     - port: 53
+       protocol: UDP
+     - port: 6443
+       protocol: TCP
+   podSelector:
+     matchLabels:
+       app.kubernetes.io/component: controller
+       app.kubernetes.io/instance: cert-manager
+       app.kubernetes.io/name: cert-manager
+   policyTypes:
+   - Egress

@@ (root level) @@
# networking.k8s.io/v1/NetworkPolicy/cert-manager/cert-manager-webhook-allow-ingress
! + one document added:
+ apiVersion: networking.k8s.io/v1
+ kind: NetworkPolicy
+ metadata:
+   name: cert-manager-webhook-allow-ingress
+   namespace: cert-manager
+   labels:
+     helm.toolkit.fluxcd.io/name: cert-manager
+     helm.toolkit.fluxcd.io/namespace: cert-manager
+ spec:
+   ingress:
+   - ports:
+     - port: https
+       protocol: TCP
+     - port: healthcheck
+       protocol: TCP
+     - port: http-metrics
+       protocol: TCP
+   podSelector:
+     matchLabels:
+       app.kubernetes.io/component: webhook
+       app.kubernetes.io/instance: cert-manager
+       app.kubernetes.io/name: webhook
+   policyTypes:
+   - Ingress

@@ (root level) @@
# networking.k8s.io/v1/NetworkPolicy/cert-manager/cert-manager-webhook-allow-egress
! + one document added:
+ apiVersion: networking.k8s.io/v1
+ kind: NetworkPolicy
+ metadata:
+   name: cert-manager-webhook-allow-egress
+   namespace: cert-manager
+   labels:
+     helm.toolkit.fluxcd.io/name: cert-manager
+     helm.toolkit.fluxcd.io/namespace: cert-manager
+ spec:
+   egress:
+   - ports:
+     - port: 80
+       protocol: TCP
+     - port: 443
+       protocol: TCP
+     - port: 53
+       protocol: TCP
+     - port: 53
+       protocol: UDP
+     - port: 6443
+       protocol: TCP
+   podSelector:
+     matchLabels:
+       app.kubernetes.io/component: webhook
+       app.kubernetes.io/instance: cert-manager
+       app.kubernetes.io/name: webhook
+   policyTypes:
+   - Egress

@@ (root level) @@
# cilium.io/v2/CiliumNetworkPolicy/observability/kube-state-metrics
! + one document added:
+ apiVersion: cilium.io/v2
+ kind: CiliumNetworkPolicy
+ metadata:
+   name: kube-state-metrics
+   namespace: observability
+   labels:
+     app.kubernetes.io/component: metrics
+     app.kubernetes.io/instance: kube-state-metrics
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: kube-state-metrics
+     app.kubernetes.io/part-of: kube-state-metrics
+     helm.toolkit.fluxcd.io/name: kube-state-metrics
+     helm.toolkit.fluxcd.io/namespace: observability
+ spec:
+   egress:
+   - toEntities:
+     - kube-apiserver
+   endpointSelector:
+     matchLabels:
+       app.kubernetes.io/instance: kube-state-metrics
+       app.kubernetes.io/name: kube-state-metrics
+   ingress:
+   - toPorts:
+     - ports:
+       - port: "8080"
+         protocol: TCP

[github-actions]

AI Automated Review

Analysis engine: qwen-3.6-fast@http://litellm.ai.svc.cluster.local/v1 (openai)

Recommendation: Approve

This PR enables native network policies for cert-manager and kube-state-metrics, reducing reliance on external policy definitions where chart-native support exists. The changes are minimal, focused, and align with the repository's security hardening goals.

Required Checks

• Validate manifest against target cluster version: Verified. The manifests use helm.toolkit.fluxcd.io/v2 and standard Kubernetes resources (NetworkPolicy, CiliumNetworkPolicy) supported by the cluster's Cilium CNI and API server versions. No deprecated fields or incompatible features detected.
• Check for resource quota / limit changes: Not applicable. This change only modifies network policy configurations; no CPU, memory, or storage requests/limits are altered.

Change-by-Change Findings

1. kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml

   • Enables networkPolicy.enabled for the controller, webhook, and cainjector components.
   • The PR body confirms these render upstream-scoped vanilla NetworkPolicies allowing metrics/healthz ingress and necessary egress (80/443 + DNS).
   • No interaction risk with existing deny-all policies in other namespaces.

2. kubernetes/apps/observability/kube-state-metrics/app/helmrelease.yaml

   • Enables networkPolicy.enabled with flavor: cilium.
   • Correctly targets a pod with cluster-wide list/watch RBAC, restricting it to kube-apiserver egress and metrics-port ingress.
   • The comment explains the security rationale clearly.

Standards Compliance

• Follows Conventional Commit title format (feat(security): ...).
• Changes are small and focused.
• No secrets or sensitive data exposed.
• Consistent with existing HelmRelease patterns in the repo.

Unknowns or Needs Verification

• Post-merge verification is recommended: confirm cert-manager completes ACME orders and KSM metrics continue scraping without interruption. This is noted in the PR body and is an operational check rather than a code defect.