feat!: NetworkPolicy in the NodePort and game-server charts, on by default

garage, minecraft-router, minecraft-server, samba, teamspeak-server,
satisfactory. One major each. These are the charts the plan said to leave for
last, and they earned it - three of them changed the convention rather than
just consuming it.

GARAGE is the clearest illustration after keycloak. Its four ports split three
ways: s3 and web are RESTRICTED by source (no probe touches them), admin is the
probe path and stays open inside the cluster - which is uncomfortable, because
admin is also the admin API, and that is said out loud instead of glossed - and
rpc gets the narrowest rule the object can express, a podSelector with no
namespaceSelector. All four numbers come from garage.settings.

MINECRAFT-SERVER is the tightest policy in the repository, and the reason is
worth knowing: all three of its probes are EXEC probes, which put no packet on
the network, so no port has to stay open for the kubelet and no probeSources
value is needed at all. RCON and metrics are restricted outright. The game port
has two branches rendered from the same value the Service reads -
server.service.type NodePort means players arrive from the internet and the
rule must be open; anything else means the only path is in-cluster, so the rule
is restricted and the router's namespace has to be in allowedNamespaces.

MINECRAFT-ROUTER derives its egress from the routing table instead of guessing:
server.backendPort plus the "port" override of every mapping that sets one. Add
a backend on a non-standard port and the policy follows. What it cannot express
is the destination - mappings name hosts, and this object matches no hostname -
so the rule is wider than the routing table, and that is written down.

SATISFACTORY gets policyTypes: [Ingress] and no egress section, and the second
half of the reason is the deciding one. Steam's content delivery is not a
pinnable port set (SteamCMD over TCP 80/443/27015-27050, master servers over
UDP 27000-27100 and 4380, changed by Valve, re-downloaded on every update) -
and this is the ONE chart with no install-test at all, because the image is
multiple GB and the first start pulls over 10GB. An egress cap here would be
the only one in the sweep with no empirical check behind it, on the chart whose
correct port set is least knowable.

SAMBA and TEAMSPEAK-SERVER carry the NodePort lesson explicitly: the rules name
445/139 and the pod's voice and file-transfer ports, never the NodePorts, and
teamspeak's file is explicit that its pod port and NodePort happening to share a
number is a coincidence of its values rather than a pattern to copy. Teamspeak's
voice rule is UDP, and the file says why that matters: a TCP rule on the same
number is accepted, looks complete, and drops every voice packet.

THREE THINGS THE CHECKS CAUGHT WHILE THIS BATCH WAS WRITTEN, all of them real:

  - minecraft-server's RCON rule named a port the pod does not declare. The
    containerPort is gated on server.rcon.enabled and the rule was not, so
    assertion 2 rejected it. The rule now carries the same gate.
  - samba and satisfactory would have shipped allowedNamespaces and
    probeSources values that reach NO rule - every one of their inbound rules
    is open to any source. A value that silently does nothing is worse than one
    that is absent, because it reads as a control, so both are gone from those
    two charts and from their schemas, with the reason in values.yaml.
    teamspeak-server loses probeSources for the same reason and keeps
    allowedNamespaces, which its web-query rule uses.
  - the policy templates no longer declare template variables they do not use.
    samba keeps one, satisfactory none.

Part of #5

minecraft-server/Chart.yaml

@@ -23,7 +23,7 @@ type: application
 # continuously, so a pod restart could pull a different image than the last one
 # without anything being recorded anywhere. The dated tags are immutable, so the
 # image is now pinned by the chart version like every other chart in this repo.
-version: 6.0.1+up2026.8.2.java25
+version: 7.0.0+up2026.8.2.java25
 appVersion: "2026.8.2-java25"
 
 maintainers:

minecraft-server/templates/NOTES.txt

@@ -364,3 +364,65 @@ server env IS APPENDED, NOT MERGED
   everyone who can read pods in {{ .Release.Namespace }}; anything sensitive belongs in
   valueFrom.secretKeyRef.
 {{- end }}
+{{- if .Values.networkPolicy.enabled }}
+
+NETWORKPOLICY IS ACTIVE — WHAT IT CAPS, AND WHAT IT DOES NOT
+  {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy selects this workload's pods.
+  Inbound: the game port (TCP {{ .Values.server.port }}){{ if eq .Values.server.service.type "NodePort" }} — OPEN, because the Service is a
+  NodePort and the senders are players on the internet{{ else }} — RESTRICTED to this namespace
+  and networkPolicy.allowedNamespaces, because the Service is {{ .Values.server.service.type }} and the only
+  path to it is in-cluster{{ end }}; RCON (TCP {{ .Values.server.rcon.port }}) and metrics (TCP 19565), both always
+  restricted by source. Outbound: DNS and TCP 443{{ with .Values.networkPolicy.egress }}{{ with .extraPorts }}, plus TCP {{ join ", " . }}{{ end }}{{ end }}.
+
+  THIS POLICY IS UNUSUALLY TIGHT, and the reason is that all three probes are
+  exec probes: they run inside the container and put no packet on the network,
+  so no port has to stay open for the kubelet and networkPolicy.probeSources is
+  not needed at all.
+{{- if not (eq .Values.server.service.type "NodePort") }}
+
+  SO CHECK ONE THING: players reach this server through minecraft-router, which
+  runs in ITS OWN namespace. That namespace must be in
+  networkPolicy.allowedNamespaces, or the server is unreachable and the symptom
+  is a connection timeout in a game client with a perfectly healthy pod behind
+  it. The same goes for a Prometheus scraping port 19565 from elsewhere.
+{{- end }}
+
+  Three limits belong in the same breath, because none of them is visible in
+  the object itself:
+
+  - EGRESS IS BY PORT, NEVER BY DESTINATION. A NetworkPolicy matches CIDRs and
+    selectors and cannot express a hostname, so every egress rule permits its
+    port to ANY address. That is a limit of the object, not a shortcut — this
+    cluster's CNI (Canal: Flannel plus Calico) has no FQDN rule either. An
+    outbound port the chart does not know about is BLOCKED: add it to
+    networkPolicy.egress.extraPorts, and expect to find out through an
+    application-level connection error rather than through this object.
+{{- if .Values.networkPolicy.probeSources }}
+  - THE PROBE PATH IS RESTRICTED in this release, because
+    networkPolicy.probeSources is set to
+      {{ join ", " .Values.networkPolicy.probeSources }}
+    Probes come from the IP of the WORKER NODE running the pod. If none of those
+    CIDRs covers the node this pod lands on, the kubelet's probes are dropped
+    and THE POD NEVER BECOMES READY — the rollout then times out and the symptom
+    looks like a broken application. Compare
+
+      kubectl -n {{ .Release.Namespace }} describe pod -l app={{ .Release.Name }}-{{ .Chart.Name }}-sfs
+
+    against `kubectl get node -o wide`.
+{{- else }}
+  - THE PROBED PORT IS OPEN INSIDE THE CLUSTER. networkPolicy.probeSources is
+    empty, so that rule carries no source selector at all and any pod the CNI
+    routes to can reach it. Not from the internet — but this is NOT pod-level
+    isolation. Narrowing it means listing the worker node IPs in
+    networkPolicy.probeSources, because the kubelet probes from the node's own
+    address and the chart cannot know it; a wrong guess there leaves the pod
+    permanently un-Ready.
+{{- end }}
+  - IT IS ONLY A BOUNDARY WHERE THE CNI ENFORCES POLICIES. Where it does not,
+    this object is accepted and filters nothing, so everything reads as
+    configured while nothing is filtered. `kubectl -n {{ .Release.Namespace }} get networkpolicy`
+    shows the object exists; only a connection attempt from an unrelated
+    namespace shows that it bites.
+
+  Switch it off with networkPolicy.enabled: false.
+{{- end }}

minecraft-server/templates/minecraft-server.networkpolicy.yaml

@@ -0,0 +1,210 @@
+{{- /*
+NetworkPolicy for minecraft-server (Gitea #5).
+
+THIS IS THE CHART WHERE THE POLICY GETS GENUINELY TIGHT, and the reason is its
+probes: all three are exec probes. An exec probe runs inside the container
+through the kubelet's runtime and puts NO packet on the network, so there is no
+kubelet traffic to accommodate on any port - which means every port here can be
+restricted by source, with no probeSources needed at all. valkey is tight for
+the same reason.
+
+The one rule that cannot be fixed is the game port, and it depends on a value:
+
+  server.service.type == NodePort  players arrive from the internet, already
+                                   masqueraded, so the rule must be OPEN.
+  anything else (the default)      the only reachable path is in-cluster, i.e.
+                                   minecraft-router, so the rule is RESTRICTED
+                                   to this namespace plus allowedNamespaces -
+                                   and the router's namespace has to be in that
+                                   list.
+
+Both branches are rendered from the same value the Service reads, so they cannot
+disagree. The RCON and metrics ports are restricted in either case.
+
+WHAT THIS OBJECT IS: a ceiling on reachability, not an authentication layer.
+Only the ports declared below are reachable at all - whatever else the process
+binds, now or after the next app update, is blocked without anyone having to
+notice it exists.
+
+WHAT IT IS NOT:
+  - EGRESS IS COARSE. A NetworkPolicy matches CIDRs and selectors and NEVER
+    hostnames, so "only to the database host" cannot be expressed at all. This
+    cluster's CNI is Canal (Flannel plus Calico for policy) and has no FQDN
+    rule; Calico's GlobalNetworkSet could express one but would bind this chart
+    to Calico, the same argument that kept implementation-specific objects out
+    of the Gateway-API sweep (#114). Each egress rule therefore permits its
+    PORT to any destination.
+  - NOT A BOUNDARY WHERE THE CNI DOES NOT ENFORCE ONE. An unenforced policy is
+    accepted by the API server and filters nothing, so everything reads as
+    configured while nothing is filtered.
+  - THE REASONING IS IN TEMPLATE COMMENTS, not in "#" comments: those are part
+    of the rendered object, travel into the cluster and appear in every release
+    diff. ci/run-networkpolicy-test.sh fails on a rendered "#".
+
+THE PORT NUMBERS BELOW ARE POD PORTS, NEVER NODEPORTS. A NetworkPolicy is
+evaluated at the pod's network interface, after kube-proxy has already
+translated a NodePort to the targetPort, so a NodePort number here would match
+nothing while looking strict - and, being the only rule for that port, would
+block every inbound connection instead. ci/run-networkpolicy-test.sh asserts
+every port here against the containerPorts of the pod spec this policy
+selects.
+*/ -}}
+{{- if .Values.networkPolicy.enabled }}
+{{- $np := .Values.networkPolicy }}
+{{- $ns := .Release.Namespace }}
+{{- $allowedNs := $np.allowedNamespaces | default list }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy
+  labels:
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy
+spec:
+  {{- /*
+  Selects the StatefulSet's pods. ci/run-networkpolicy-test.sh fails if
+  this matches no pod spec of the same render - which is the mistake that
+  would otherwise leave a policy in the namespace filtering nothing, and
+  its usual cause is a label renamed in the workload template.
+  */}}
+  podSelector:
+    matchLabels:
+      app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+  policyTypes:
+    - Ingress
+    {{- /*
+    Egress is listed because there is something real to restrict: a Minecraft
+    server needs DNS and HTTPS and nothing else in the normal case. Mod packs that
+    call out on other ports are the exception, and extraPorts is for them.
+    */}}
+    - Egress
+  ingress:
+    {{- if eq .Values.server.service.type "NodePort" }}
+    {{- /*
+    THE GAME PORT, NODEPORT BRANCH (server.service.type is NodePort). Open with no
+    "from": the senders are Minecraft clients on the internet and, after NodePort
+    masquerading, the source address is a cluster node anyway.
+
+    THE NUMBER IS THE POD PORT (server.port), not server.service.outwardPort. A
+    NetworkPolicy is evaluated after kube-proxy has translated the NodePort, so the
+    NodePort number would match nothing here while looking strict - and being the
+    only rule for the port, it would block every player instead.
+    */}}
+    - ports:
+        - protocol: TCP
+          port: {{ .Values.server.port | int64 }}
+    {{- end }}
+    {{- if not (eq .Values.server.service.type "NodePort") }}
+    {{- /*
+    THE GAME PORT, CLUSTER-INTERNAL BRANCH (the default): the Service is not a
+    NodePort, so nothing outside the cluster can reach this port through this
+    chart, and the rule is restricted to this namespace plus allowedNamespaces.
+
+    PUT THE ROUTER'S NAMESPACE IN allowedNamespaces. In this cluster players reach
+    the server through minecraft-router, which runs in its own namespace - so
+    without that entry the server is unreachable and the symptom is a connection
+    timeout in a game client, with a healthy pod behind it.
+    */}}
+    - ports:
+        - protocol: TCP
+          port: {{ .Values.server.port | int64 }}
+      from:
+        - namespaceSelector:
+            matchLabels:
+              {{- /*
+              Set by Kubernetes itself on every namespace (>= 1.21), so this needs no
+              labelling work on a namespace this chart does not own.
+              */}}
+              kubernetes.io/metadata.name: {{ $ns }}
+        {{- range $allowedNs }}
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ . | quote }}
+        {{- end }}
+    {{- end }}
+    {{- if .Values.server.rcon.enabled }}
+    {{- /*
+    RCON - remote console, i.e. full administrative control of the server. No
+    Service and no probe, so it is restricted to this namespace plus
+    allowedNamespaces: the rule with the most security value in this chart, and it
+    costs nothing.
+
+    GATED ON server.rcon.enabled, AND THAT GATE IS NOT COSMETIC. The containerPort
+    itself is rendered only when RCON is on (see the StatefulSet), so without the
+    same condition here the policy would name a port the pod does not declare -
+    which is not merely untidy: ci/run-networkpolicy-test.sh rejects it, and it
+    rejected exactly this while the chart was being written. A rule for a port
+    nothing listens on is a rule nobody can verify.
+    */}}
+    - ports:
+        - protocol: TCP
+          port: {{ .Values.server.rcon.port | int64 }}
+      from:
+        - namespaceSelector:
+            matchLabels:
+              {{- /*
+              Set by Kubernetes itself on every namespace (>= 1.21), so this needs no
+              labelling work on a namespace this chart does not own.
+              */}}
+              kubernetes.io/metadata.name: {{ $ns }}
+        {{- range $allowedNs }}
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ . | quote }}
+        {{- end }}
+    {{- end }}
+    {{- /*
+    The metrics port. No Service, no probe, so restricted like RCON. A Prometheus
+    that scrapes this release from another namespace needs that namespace in
+    allowedNamespaces - and the failure is a target that silently stops reporting,
+    which is worth knowing before it happens.
+    */}}
+    - ports:
+        - protocol: TCP
+          port: 19565
+      from:
+        - namespaceSelector:
+            matchLabels:
+              {{- /*
+              Set by Kubernetes itself on every namespace (>= 1.21), so this needs no
+              labelling work on a namespace this chart does not own.
+              */}}
+              kubernetes.io/metadata.name: {{ $ns }}
+        {{- range $allowedNs }}
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ . | quote }}
+        {{- end }}
+  egress:
+    {{- /*
+    DNS, unconditionally. There is no value to switch this off, and that is
+    deliberate: a knob whose only other setting breaks every name lookup in
+    the pod is a trap and not a feature.
+    */}}
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    {{- /*
+    Outbound HTTPS. Needed for Mojang's session server when online-mode is on - a
+    server that cannot reach it rejects every login - and for resource-pack and mod
+    downloads. To any destination, because those are hostnames.
+    */}}
+    - ports:
+        - protocol: TCP
+          port: 443
+    {{- with $np.egress }}
+    {{- with .extraPorts }}
+    {{- /*
+    Ports only, to any destination - see the header. This is the operator's
+    escape hatch from the egress cap, and the only alternative to switching
+    the whole policy off.
+    */}}
+    - ports:
+        {{- range . }}
+        - protocol: TCP
+          port: {{ int . }}
+        {{- end }}
+    {{- end }}
+    {{- end }}
+{{- end }}

minecraft-server/values.schema.json

@@ -9,6 +9,36 @@
       "description": "Helm's conventional cross-chart values. Unused by this chart, kept open so an umbrella install cannot break on it.",
       "type": "object"
     },
+    "networkPolicy": {
+      "description": "The chart's NetworkPolicy (Gitea #5), on by default. A ceiling on reachability and not an authentication layer: only the declared container ports are reachable at all, egress is capped by PORT (a NetworkPolicy matches CIDRs and selectors, never hostnames, so a destination host cannot be expressed), and ingress is capped by source for every port no network probe touches. Only a boundary where the cluster's CNI enforces policies - an unenforced policy is accepted by the API server and filters nothing. The template's header carries the full list of what it does not do.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        },
+        "allowedNamespaces": {
+          "description": "Namespaces whose pods may reach this workload, in addition to the release's own namespace, which is always allowed. Matched on the kubernetes.io/metadata.name label Kubernetes sets on every namespace itself, so no labelling work is needed - and no typo protection either: a name that does not exist matches nothing and is silently ineffective. An entry opens the port to EVERY pod in that namespace; for the ingress controller use ingressController instead.",
+          "type": ["array", "null"],
+          "items": {
+            "type": "string"
+          }
+        },
+        "egress": {
+          "type": ["object", "null"],
+          "additionalProperties": false,
+          "properties": {
+            "extraPorts": {
+              "description": "Additional outbound TCP ports, to ANY destination - ports and not destinations, because a NetworkPolicy cannot express a hostname. DNS is always allowed and has no switch. Without an entry here an outbound port the chart does not already derive is blocked, which is the cap's whole purpose and also its upgrade risk.",
+              "type": ["array", "null"],
+              "items": {
+                "type": "integer"
+              }
+            }
+          }
+        }
+      }
+    },
     "scaleDown": {
       "type": "boolean"
     },

minecraft-server/values.yaml

@@ -313,3 +313,56 @@ curseforgeServerpack:
   # Longhorn.
   downloadUrl: null
   workingDirectory: '/data/serverpack'
+
+# ---------------------------------------------------------------------------
+# NetworkPolicy (Gitea #5). On by default. The reference implementation with
+# the full reasoning is template-chart; the convention is in README, "Chart
+# style guidelines", and the operator's view on this chart's wiki page.
+# ---------------------------------------------------------------------------
+networkPolicy:
+  # THIS IS ONE OF THE TIGHTEST POLICIES IN THE REPOSITORY, and the reason is
+  # the probes: all three are EXEC probes, which run inside the container and
+  # put no packet on the network. So there is no kubelet traffic to
+  # accommodate, every port can be restricted by source, and no probeSources
+  # value is needed at all.
+  #
+  # WHAT IT ALLOWS, inbound:
+  #   - the game port (server.port): OPEN when server.service.type is NodePort
+  #     (players arrive from the internet, already masqueraded), and
+  #     RESTRICTED to this namespace plus allowedNamespaces otherwise - which
+  #     is the default. Both branches read the same value the Service does.
+  #   - RCON (server.rcon.port) and metrics (19565): always restricted. RCON is
+  #     full administrative control of the server, so this is the rule with the
+  #     most security value here, and it costs nothing.
+  # Outbound: DNS and TCP 443 (Mojang's session server for online-mode, plus
+  # resource packs and mods).
+  #
+  # PUT THE ROUTER'S NAMESPACE IN allowedNamespaces when the Service is not a
+  # NodePort. In this cluster players reach the server through
+  # minecraft-router, in its own namespace; without that entry the server is
+  # unreachable and the symptom is a timeout in a game client with a healthy
+  # pod behind it. The same applies to a Prometheus scraping 19565.
+  enabled: true
+  # Namespaces whose pods may reach this workload, in addition to the release's
+  # own namespace, which is always allowed. Empty means: own namespace only.
+  #
+  # Matched on the "kubernetes.io/metadata.name" label Kubernetes sets on every
+  # namespace itself, so no labelling work is needed on a namespace this chart
+  # does not own - and no typo protection either: a name that does not exist
+  # matches nothing and is silently ineffective. Note the granularity: an entry
+  # opens the port to EVERY pod in that namespace.
+  allowedNamespaces: []
+  egress:
+    # Additional outbound TCP ports. DNS (UDP and TCP 53) is always allowed and
+    # has no switch - a knob whose only other setting breaks every name lookup
+    # in the pod is a trap, not a feature.
+    #
+    # PORTS, NOT DESTINATIONS, and that is a limit of the object rather than
+    # laziness: a NetworkPolicy matches CIDRs and selectors and never hostnames,
+    # so "only to the database host" cannot be written at all. Each entry
+    # permits its port to ANY destination. What the cap still buys is real: a
+    # compromised pod cannot open arbitrary outbound connections.
+    #
+    # Add a port for a mod pack that calls out somewhere other than 443 - an
+    # authentication proxy, a map renderer upload, a Discord bridge.
+    extraPorts: []