feat(keycloak)!: NetworkPolicy, on by default - the full convention in one chart

Major. This is the richest policy of the sweep and the one with the largest
blast radius, and it is the only chart whose three ports fall into three
different classes - so it is where the convention is visible in full:

  http (8080)       NOT addressed by any probe, so it CAN be restricted by
                    source, and it is: own namespace, allowedNamespaces, and
                    the ingress controller. The only real inbound restriction
                    in this whole rollout, possible only because the probes use
                    a different port.
  management (9000) the port all three probes address, so it stays open inside
                    the cluster. That matters here specifically: this surface
                    carries health and metrics UNAUTHENTICATED, and "no
                    Ingress" was its only protection before this object. The
                    policy turns "anything that can route to the pod" into
                    "anything inside the cluster"; probeSources closes the rest.
  jgroups (7800)    the cluster bus, restricted to the pods this policy itself
                    selects - a podSelector with no namespaceSelector, the
                    narrowest rule the object can express.

All four port numbers come from keycloak.settings rather than being written
down twice, so moving keycloak.ports.http moves the policy with it. And the
egress rule for the database is the CONFIGURED port, keycloak.db.port - this is
the one chart in the sweep that does not have to guess, because its database
port is a value instead of a field inside an opaque secret.

The outbound cluster-bus rule is not a duplicate of the inbound one: policyTypes
lists Egress, so a replica dialling its peer is subject to this policy too, and
without it the bus would be open inbound and blocked outbound - a cluster that
never forms, with two nodes that each look healthy.

THE BLAST RADIUS IS WRITTEN INTO THE CHART, because nothing in CI can catch it:
this release is the cluster's identity provider, no ingress controller runs in
the install-test, and the probes use 9000 - so the pod becomes Ready whether or
not the http rule is right. NOTES.txt therefore asks for two checks after the
first upgrade: log in, and look at whether any consumer uses the in-cluster
Service address instead of the public issuer URL (those namespaces need
allowedNamespaces). Not allowed at all, and named as the likely first surprise:
SMTP, because the mail server is configured per realm where the chart cannot
see it.

The test's overlay guard is tightened in the same commit, and keycloak is why.
It counted any source-restricted rule, and this chart restricts two of them in
its own defaults - so the guard would have been satisfied while the probe
branch, the only branch an overlay exists to reach, was never rendered. It now
counts restricted PROBE rules. All twelve failure paths were re-run against the
change.

Part of #5

ci/run-networkpolicy-test.sh

@@ -392,6 +392,11 @@ offers_probe_sources = bool(re.search(r"^\s*probeSources\s*:", values_yaml, re.M
 notes_warns = bool(re.search(r"never becomes? ready", notes, re.I)) and "probeSources" in notes
 
 RESTRICTED_RULES = 0
+# Counted separately from RESTRICTED_RULES, and the overlay guard uses THIS one:
+# a chart like keycloak restricts other rules by source in its own defaults, so
+# "some rule has a from" would satisfy the guard without the probe branch ever
+# being rendered - which is the only branch an overlay exists to reach.
+PROBE_RESTRICTED = 0
 
 # --- Assertion 0: the chart ships a policy at all ---------------------------
 if not policies:
@@ -668,6 +673,7 @@ for policy in policies:
                % (tag, port_number, ", ".join(who)))
             continue
         if offers_probe_sources and notes_warns:
+            PROBE_RESTRICTED += 1
             ok("%s restricts probe port %d (%s) by source in ingress[%s], and the "
                "chart carries what the convention requires with it: "
                "networkPolicy.probeSources in values.yaml and the consequence "
@@ -722,6 +728,7 @@ if policies:
            "reasoning stayed in template comments")
 
 print("RESTRICTED|%d" % RESTRICTED_RULES)
+print("PROBERESTRICTED|%d" % PROBE_RESTRICTED)
 for line in lines:
     print(line)
 PY
@@ -739,6 +746,7 @@ PY
   CHART_OK=0
   CHART_SKIP=0
   CHART_RESTRICTED=0
+  CHART_PROBE_RESTRICTED=0
   while IFS='|' read -r VERDICT DETAIL; do
     case "$VERDICT" in
       OK)
@@ -752,6 +760,9 @@ PY
       RESTRICTED)
         CHART_RESTRICTED="$DETAIL"
         ;;
+      PROBERESTRICTED)
+        CHART_PROBE_RESTRICTED="$DETAIL"
+        ;;
       FAIL)
         CHART_FAIL=1
         echo "  FAIL   $DETAIL"
@@ -770,20 +781,20 @@ PY
     FAILED="$FAILED $CHART"
     SUMMARY_ROWS="${SUMMARY_ROWS}| \`$CHART\` | **failed** | $CHART_OK | $CHART_SKIP |"$'\n'
     echo "$CHART: FAILED"
-  elif [ -n "$HAS_OVERLAY" ] && [ "$CHART_RESTRICTED" -eq 0 ]; then
+  elif [ -n "$HAS_OVERLAY" ] && [ "$CHART_PROBE_RESTRICTED" -eq 0 ]; then
     # The overlay's ONE job is to render a code path the chart's defaults do not
     # reach - above all the RESTRICTED probe rule, which only appears once
     # probeSources is non-empty. If no restricted rule came out, this test is
     # vacuum-green for the very chart the overlay was written for.
     FAILED="$FAILED $CHART"
     SUMMARY_ROWS="${SUMMARY_ROWS}| \`$CHART\` | **failed** | $CHART_OK | $CHART_SKIP |"$'\n'
-    echo "::error title=networkpolicy $CHART::$CHART has an overlay at ci/networkpolicy/$CHART.yaml but rendered no source-restricted ingress rule, so the restricted branch - the one the chart's own defaults never reach - was not checked. That overlay exists for exactly this; either it no longer sets networkPolicy.probeSources where the chart reads it, or the template stopped rendering the restricted form. A green tick here would be a tick for a check that ran over nothing."
-    echo "$CHART: FAILED (overlay present, no restricted rule rendered)"
+    echo "::error title=networkpolicy $CHART::$CHART has an overlay at ci/networkpolicy/$CHART.yaml but rendered no source-restricted PROBE rule, so the restricted branch - the one the chart's own defaults never reach - was not checked. That overlay exists for exactly this; either it no longer sets networkPolicy.probeSources where the chart reads it, or the template stopped rendering the restricted form. A green tick here would be a tick for a check that ran over nothing."
+    echo "$CHART: FAILED (overlay present, no restricted probe rule rendered)"
   else
     CHECKED="$CHECKED $CHART"
     [ "$CHART_SKIP" -gt 0 ] && WITH_GAPS="$WITH_GAPS $CHART"
     SUMMARY_ROWS="${SUMMARY_ROWS}| \`$CHART\` | ok | $CHART_OK | $CHART_SKIP |"$'\n'
-    echo "$CHART: ok ($CHART_OK assertion(s) held, $CHART_SKIP not checked, $CHART_RESTRICTED source-restricted rule(s))"
+    echo "$CHART: ok ($CHART_OK assertion(s) held, $CHART_SKIP not checked, $CHART_RESTRICTED source-restricted rule(s), $CHART_PROBE_RESTRICTED of them on a probe port)"
   fi
 done