From 7688a2f82da19761b7e926aae5c20f2978a01d65 Mon Sep 17 00:00:00 2001
From: Pat Riehecky <riehecky@fnal.gov>
Date: Wed, 17 Jun 2026 11:52:23 -0500
Subject: [PATCH] feat(helm): Add optional networkPolicy

Signed-off-by: Pat Riehecky <riehecky@fnal.gov>
---
 .../reflector/templates/networkPolicy.yaml    | 22 ++++++++++++++++
 src/helm/reflector/values.yaml                | 25 ++++++++++++++++++-
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 src/helm/reflector/templates/networkPolicy.yaml

diff --git a/src/helm/reflector/templates/networkPolicy.yaml b/src/helm/reflector/templates/networkPolicy.yaml
new file mode 100644
index 00000000..d1d7bc3c
--- /dev/null
+++ b/src/helm/reflector/templates/networkPolicy.yaml
@@ -0,0 +1,22 @@
+{{- if .Values.networkPolicy.enabled }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "reflector.fullname" . }}
+  namespace: {{ include "reflector.namespace" . }}
+  labels:
+    {{- include "reflector.labels" . | nindent 4 }}
+
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "reflector.selectorLabels" . | nindent 6 }}
+  ingress:
+    {{- toYaml .Values.networkPolicy.ingress | nindent 4 }}
+  egress:
+    {{- toYaml .Values.networkPolicy.egress | nindent 4 }}
+  policyTypes:
+    - Ingress
+    - Egress
+{{- end }}
diff --git a/src/helm/reflector/values.yaml b/src/helm/reflector/values.yaml
index bb5cbc92..7847f38e 100644
--- a/src/helm/reflector/values.yaml
+++ b/src/helm/reflector/values.yaml
@@ -38,6 +38,29 @@ configuration:
 rbac:
   enabled: true
 
+networkPolicy:
+  enabled: false
+  # Ingress is disabled by default (all ingress traffic dropped)
+  ingress: []
+  # Egress permitted to any namespace on standard kubernetes service ports
+  egress:
+    # Allow DNS (53/udp and 53/tcp) - kubernetes DNS service
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    # Allow HTTP and HTTPS (80/tcp and 443/tcp) - kubernetes API services
+    - ports:
+        - protocol: TCP
+          port: 80
+        - protocol: TCP
+          port: 443
+    # Allow kubernetes API server (6443/tcp) - default kubernetes API server port
+    - ports:
+        - protocol: TCP
+          port: 6443
+
 serviceAccount:
   # Specifies whether a service account should be created
   create: true
@@ -123,4 +146,4 @@ priorityClassName: ""
 
 volumes: []
 
-volumeMounts: []
\ No newline at end of file
+volumeMounts: []