feat(keycloak): networkPolicy.ingress.ambientMesh

Gitea #143. Additive, default false, so the render is byte-identical to the
previous release - proven by diffing both renders against origin/main rather
than asserted.

Switched on it adds 15008/TCP, ztunnel's HBONE tunnel, to the rule carrying
the probe port, and - inside that rule's source-restricted branch -
169.254.7.127/32, the address the kubelet's probes arrive from once the pod is
in the mesh. Ambient does not bypass NetworkPolicy enforcement, so without the
port a pod whose namespace has joined the mesh is unreachable.

The two halves are one value because the second is the one nobody thinks of:
15008 added by hand leaves a policy that passes review and drops every probe
the first time probeSources is narrowed, and a pod that never becomes Ready
reads as a broken application rather than as a policy.

Minor, not major: additive value, unchanged default, unchanged render.

keycloak/values.yaml

@@ -967,6 +967,57 @@ networkPolicy:
     namespace: kube-system
     podLabels:
       app.kubernetes.io/name: rke2-traefik
+
+  # The policy's INBOUND side. Mind the three names that overlap as substrings,
+  # because a search for "ingress" matches all of them and they are different
+  # things:
+  #
+  #   ingress                          (top level) the Ingress OBJECT this chart
+  #                                    renders - host, TLS, className
+  #   networkPolicy.ingress            this block: what the policy lets IN
+  #   networkPolicy.ingressController  the SOURCE SELECTOR for the ingress
+  #                                    controller's pods. A SIBLING of this block
+  #                                    and NO PART OF IT, despite the name.
+  ingress:
+    # Opens the pod for Istio's ambient mesh (Gitea #143). OFF by default and
+    # additive: while it is false this chart renders byte for byte as it did
+    # before the value existed.
+    #
+    # IT RENDERS TWO THINGS, and that they come together is the point:
+    #
+    #   1. 15008/TCP inbound - ztunnel's HBONE tunnel. Every inbound mesh
+    #      connection arrives on it, and ambient "does not and will never bypass
+    #      Kubernetes NetworkPolicy enforcement", so without this port a pod
+    #      whose namespace has joined the mesh is unreachable.
+    #   2. 169.254.7.127/32 as an additional peer - but ONLY where the rule
+    #      restricts sources at all, which here means probeSources is non-empty.
+    #      Inside the mesh the kubelet's probes are redirected and no longer come
+    #      from the worker node's address.
+    #
+    # WHY ONE SWITCH AND NOT TWO: point 2 is the one nobody thinks of. Whoever
+    # adds "15008" to a port list by hand writes a policy that passes review, and
+    # the first time probeSources is narrowed every probe is dropped - the pod
+    # never becomes Ready and the symptom reads as a broken application rather
+    # than as a policy. A switch whose halves can only be had together cannot be
+    # set halfway, which is why this is a named intention and not a port list.
+    #
+    # TWO THINGS IT DOES NOT PROVE:
+    #   - That 15008 alone is enough. That comes from Istio's documentation;
+    #     measured on this cluster is only which listeners ztunnel opens.
+    #     Provable at the first namespace to join the mesh - none carries
+    #     istio.io/dataplane-mode yet.
+    #   - That the probe-source half works. probeSources is empty in every chart
+    #     here, so no release reaches that branch. CI proves its render, not its
+    #     effect.
+    #
+    # Note where the port lands: it joins the rule that carries the probe port,
+    # so once probeSources restricts that rule, 15008 is restricted with it.
+    # Whether ztunnel needs a peer of its own is open - it runs with its own pod
+    # IPs in istio-system (measured: no hostNetwork on the DaemonSet, Istio
+    # 1.30.6), so if one proves necessary it is expressible as a
+    # namespaceSelector plus podSelector and needs no unknowable node CIDR.
+    ambientMesh: false
+
   egress:
     # Additional outbound TCP ports. DNS (UDP and TCP 53) is always allowed and
     # has no switch - a knob whose only other setting breaks every name lookup