# Overlay for the NetworkPolicy render test (Gitea #5), applied last.
#
# This chart's policy has two branches that its own CI fixture never renders,
# and both carry a mistake worth catching mechanically.
#
# 1. THE NODEPORT BRANCH OF THE GAME-PORT RULE. The rule is OPEN when
#    server.service.type is NodePort - players arrive from the internet,
#    already masqueraded - and RESTRICTED to the namespace otherwise. The
#    install-test fixture uses ClusterIP (as all four releases in this cluster
#    do), so without this overlay the open branch was rendered NOWHERE: not by
#    the defaults, not by the fixture, not by lint. It is also the branch where
#    writing server.service.outwardPort instead of server.port would be the
#    classic NodePort mistake, and assertion 2 only sees a rule it has been
#    given.
#
# 2. THE RCON RULE, which is gated on server.rcon.enabled exactly as the
#    containerPort is. That pairing was wrong once while this chart was being
#    written - the rule had no gate, so it named a port the pod does not
#    declare - and assertion 2 caught it. Switching RCON on here keeps the
#    PAIR under test rather than just the gate.
#
# Note why this chart's overlay does NOT have to render a source-restricted
# probe rule, which is what the test demands of an overlay elsewhere: all three
# of this chart's probes are exec probes, so it has no probe rule at all and
# offers no networkPolicy.probeSources. The guard is conditional on that value
# for this reason.
server:
  service:
    type: NodePort
  rcon:
    enabled: true