fix(immich): align template standards

charts/immich/README.md

@@ -91,6 +91,20 @@ ingress:
           pathType: Prefix
 ```
 
+## NetworkPolicy
+
+```yaml
+networkPolicy:
+  enabled: true
+  extraEgress:
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/8
+      ports:
+        - protocol: TCP
+          port: 443
+```
+
 ## Documentation
 
 - [Design](DESIGN.md)
@@ -108,10 +122,10 @@ helm unittest --with-subchart=false charts/immich
 helm template immich charts/immich -f charts/immich/ci/ci-values.yaml
 ```
 
-### 🟢 Security Scan: `immich`
+### Security Scan: `immich`
 
 | Framework | Score |
 |---|---|
 | MITRE + NSA + SOC2 | **88.61111%** |
 
-> ✅ Security posture acceptable.
+Security posture acceptable.

charts/immich/templates/NOTES.txt

@@ -1,37 +1,31 @@
 {{/* SPDX-License-Identifier: Apache-2.0 */}}
-=============================================================================
-Immich deployed successfully!
-=============================================================================
+1. Summary
+   Immich has been deployed successfully.
+   Image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+   Service: {{ include "immich.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}
 
-ACCESS:
+2. Access
 {{- if .Values.ingress.enabled }}
   {{- range .Values.ingress.hosts }}
-   http{{ if $.Values.ingress.tls }}s{{ end }}://{{ .host }}
+   URL: http{{ if $.Values.ingress.tls }}s{{ end }}://{{ .host }}
   {{- end }}
 {{- else if and .Values.gateway.enabled .Values.gateway.hostnames }}
   {{- range .Values.gateway.hostnames }}
-   https://{{ . }}
+   URL: https://{{ . }}
   {{- end }}
 {{- else }}
    kubectl port-forward svc/{{ include "immich.fullname" . }} -n {{ .Release.Namespace }} 2283:{{ .Values.service.port }}
    Open: http://localhost:2283
 {{- end }}
 
-SERVICE:
-   Internal: {{ include "immich.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}
-   Health:   {{ .Values.probes.path }}
-   Image:    {{ .Values.image.repository }}:{{ .Values.image.tag }}
-
-DATABASE:
+3. Data Services
 {{- if .Values.postgresql.enabled }}
    PostgreSQL: bundled HelmForge subchart with Immich VectorChord image
    Service: {{ .Release.Name }}-postgresql.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.postgresql.service.port | default 5432 }}
 {{- else }}
    PostgreSQL: external
    Host: {{ .Values.database.external.host }}:{{ .Values.database.external.port }}
 {{- end }}
-
-CACHE:
 {{- if .Values.valkey.internal.enabled }}
    Redis-compatible cache: bundled HelmForge Redis subchart aliased as valkey
    Service: {{ include "immich.valkeyHost" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.valkey.service.ports.redis | default 6379 }}
@@ -41,24 +35,26 @@ CACHE:
 {{- end }}
 
 {{- if .Values.machineLearning.enabled }}
-MACHINE LEARNING:
+4. Machine Learning
    Service: {{ include "immich.fullname" . }}-machine-learning.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.machineLearning.service.port }}
 {{- end }}
 
-OPERATIONS:
+5. Validation
+   Health path: {{ .Values.probes.path }}
    Run Helm tests:
-     helm test {{ .Release.Name }} -n {{ .Release.Namespace }}
+   helm test {{ .Release.Name }} -n {{ .Release.Namespace }}
 
+6. Troubleshooting
    Inspect pods:
-     kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
-     kubectl logs -n {{ .Release.Namespace }} deploy/{{ include "immich.fullname" . }}
+   kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
+   kubectl logs -n {{ .Release.Namespace }} deploy/{{ include "immich.fullname" . }}
 
-PRODUCTION REMINDERS:
+7. Production Reminders
    1. Use explicit Secrets or External Secrets for PostgreSQL and cache credentials.
    2. Keep upload persistence on durable storage and use ReadWriteMany before scaling server replicas.
    3. Configure HTTPS through Ingress or Gateway API before exposing Immich publicly.
 
-DOCUMENTATION:
+8. Resources
    Chart: https://helmforge.dev/docs/charts/immich
    Source: https://github.com/helmforgedev/charts/tree/main/charts/immich
    Immich: https://immich.app

charts/immich/templates/networkpolicy.yaml

@@ -21,8 +21,9 @@ spec:
         - namespaceSelector: {}
     {{- end }}
   egress:
-    {{- if .Values.networkPolicy.egress }}
-    {{- toYaml .Values.networkPolicy.egress | nindent 4 }}
+    {{- $egress := .Values.networkPolicy.egress | default (list (dict)) }}
+    {{- with concat $egress (.Values.networkPolicy.extraEgress | default list) }}
+    {{- toYaml . | nindent 4 }}
     {{- else }}
     - {}
     {{- end }}

charts/immich/tests/networkpolicy-extra-egress-values.yaml

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: Apache-2.0
+networkPolicy:
+  enabled: true
+  extraEgress:
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/8
+      ports:
+        - protocol: TCP
+          port: 443

charts/immich/tests/networkpolicy_test.yaml

@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: Apache-2.0
+suite: NetworkPolicy
+templates:
+  - templates/networkpolicy.yaml
+release:
+  name: test
+tests:
+  - it: should render default ingress and egress when enabled
+    set:
+      networkPolicy.enabled: true
+    asserts:
+      - isKind:
+          of: NetworkPolicy
+      - equal:
+          path: spec.policyTypes[0]
+          value: Ingress
+      - equal:
+          path: spec.policyTypes[1]
+          value: Egress
+      - equal:
+          path: spec.ingress[0].from[0].namespaceSelector
+          value: {}
+      - equal:
+          path: spec.egress[0]
+          value: {}
+
+  - it: should append extra egress rules
+    values:
+      - networkpolicy-extra-egress-values.yaml
+    asserts:
+      - equal:
+          path: spec.egress[0]
+          value: {}
+      - equal:
+          path: spec.egress[1].to[0].ipBlock.cidr
+          value: 10.0.0.0/8
+      - equal:
+          path: spec.egress[1].ports[0].port
+          value: 443
+
+  - it: should append extraEgress after base egress rules
+    set:
+      networkPolicy.enabled: true
+      networkPolicy.egress[0].to[0].ipBlock.cidr: 172.16.0.0/12
+      networkPolicy.extraEgress[0].to[0].ipBlock.cidr: 10.0.0.0/8
+    asserts:
+      - equal:
+          path: spec.egress[0].to[0].ipBlock.cidr
+          value: 172.16.0.0/12
+      - equal:
+          path: spec.egress[1].to[0].ipBlock.cidr
+          value: 10.0.0.0/8

charts/immich/tests/test_connection_test.yaml

@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: Apache-2.0
+suite: Helm Test
+templates:
+  - templates/tests/test-connection.yaml
+release:
+  name: test
+  namespace: default
+tests:
+  - it: should render the Helm test hook pod
+    asserts:
+      - isKind:
+          of: Pod
+      - equal:
+          path: metadata.name
+          value: test-immich-test
+      - equal:
+          path: metadata.annotations["helm.sh/hook"]
+          value: test

charts/immich/values.schema.json

@@ -140,7 +140,16 @@
         "pathType": { "type": "string", "enum": ["Exact", "PathPrefix", "RegularExpression"] }
       }
     },
-    "networkPolicy": { "type": "object" },
+    "networkPolicy": {
+      "type": "object",
+      "additionalProperties": true,
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "ingress": { "type": "array" },
+        "egress": { "type": "array" },
+        "extraEgress": { "type": "array" }
+      }
+    },
     "autoscaling": { "type": "object" },
     "pdb": { "type": "object" },
     "probes": { "type": "object" },

charts/immich/values.yaml

@@ -346,6 +346,8 @@ networkPolicy:
   ingress: []
   # -- Additional egress rules. Defaults allow all egress for database, cache, machine-learning, and external API compatibility.
   egress: []
+  # -- Additional egress rules appended after networkPolicy.egress.
+  extraEgress: []
 
 autoscaling:
   # -- Enable HorizontalPodAutoscaler for the Immich server.