# Overlay for the NetworkPolicy render test (Gitea #5), applied last.
#
# Two code paths this chart's own defaults never reach, and both are held
# against the four assertions on every pull request rather than checked once by
# hand:
#
# 1. networkPolicy.egress.remoteAssets: true - the named switch that lets
#    Chromium fetch over 80/443. Its default is OFF, so the rule it renders
#    existed in no render at all. It is an EGRESS rule, which is exactly why it
#    is worth asserting: assertions 2 and 3 look at INGRESS rules, so a mistake
#    on the egress side has no mechanical check except that the render still
#    parses and the policy still holds together.
#
# 2. The source-restricted probe rule, which only appears once probeSources is
#    non-empty - the same branch ci/networkpolicy/template-chart.yaml exists
#    for, and the one the overlay guard demands of any chart that offers the
#    value. It carries the expensive mistake: a namespaceSelector and a
#    podSelector written as two list entries instead of one would be an OR.
#
# Note what this overlay does NOT do: it changes no release. gotenberg's
# install-test uses ci/gotenberg/test-values.yaml, which this file does not
# touch - the policy installed there keeps the restrictive default, because
# that is the default the convention ships.
networkPolicy:
  egress:
    remoteAssets: true
  # Not the real node addresses of any cluster; documentation CIDRs
  # (RFC 5737 TEST-NET-1) so nobody can mistake these for something to copy.
  probeSources:
    - 192.0.2.11/32
  allowedNamespaces:
    - paperless-jk