# Overlay for the NetworkPolicy render test (Gitea #5), applied last.
#
# Its only job is to render a code path the chart's own defaults never reach:
# the SOURCE-RESTRICTED ingress rule. With probeSources empty - the default, and
# deliberately so - the probe port's rule carries no "from" at all, so the whole
# restricted branch of the template, the one containing the ingress-controller
# AND, the namespace list and the ipBlock peers, is never rendered and never
# checked. That branch is also the one with the expensive mistake in it: a
# namespaceSelector and a podSelector written as two list entries instead of one
# would be an OR, and would open the port to every pod in kube-system.
#
# ci/run-networkpolicy-test.sh FAILS a chart that has an overlay here and still
# renders no restricted rule. That guard is the point: without it the overlay
# could silently stop reaching the branch, and the test would stay green over a
# code path nobody entered.
#
# template-chart carries it rather than a real chart because it is installed
# nowhere (ci/excluded-charts.txt) - so the restricted form is exercised on
# every pull request with no release depending on these values.
networkPolicy:
  # Not the real node addresses of any cluster; a documentation CIDR
  # (RFC 5737 TEST-NET-1) so nobody can mistake these for something to copy.
  probeSources:
    - 192.0.2.11/32
    - 192.0.2.12/32
  allowedNamespaces:
    - monitoring
  egress:
    extraPorts:
      - 5432