Summary

Add networkPolicy.enabled flag to allow users to disable the metrics-access network policy.

Problem

The current metrics-access network policy only allows ingress on ports:

• 2112 (metrics)
• 9216 (MongoDB metrics)

This blocks all other ingress traffic, which causes issues when NVSentinel is deployed in the same namespace as other services. For example:

• cert-manager webhook (port 443) is blocked, causing startupapicheck to fail
• Any service requiring ingress on non-metrics ports will be affected

Error example from cert-manager startupapicheck:

failed calling webhook "webhook.cert-manager.io": Post "https://cert-manager-webhook.eidos-stack.svc:443/mutate": context deadline exceeded

Solution

Add a configurable flag networkPolicy.enabled (default: true) that allows users to disable the network policy when needed:

networkPolicy:
  enabled: false

This maintains backward compatibility (enabled by default) while giving users control over the network policy.

Changes

• templates/networkpolicy.yaml: Wrap with {{- if .Values.networkPolicy.enabled }}
• values.yaml: Add networkPolicy.enabled: true with documentation

Test plan

• Deploy with networkPolicy.enabled: true (default) - verify policy is created
• Deploy with networkPolicy.enabled: false - verify policy is not created
• Deploy alongside cert-manager in same namespace with policy disabled - verify webhook works

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Network policies are now optional and configurable, allowing operators to enable or disable them based on deployment requirements
  • Network policies are enabled by default to restrict access to metrics ports, with an option to disable in environments where conflicts may arise with other services