fix(jupyterhub): align template standards

charts/jupyterhub/README.md

@@ -9,6 +9,10 @@ user pods, optional user PVCs, Gateway API, Ingress, dual-stack Service,
 NetworkPolicy, ExternalSecret, ServiceMonitor, PodDisruptionBudget, schema, and
 Helm tests.
 
+NetworkPolicy supports `networkPolicy.extraEgress` for appending Hub egress
+rules without replacing the default DNS, HTTPS, same-namespace, and
+`networkPolicy.hub.egress` rules.
+
 ## Install
 
 ```bash

charts/jupyterhub/templates/NOTES.txt

@@ -1,24 +1,24 @@
 {{/* SPDX-License-Identifier: Apache-2.0 */}}
 JupyterHub deployed successfully!
 
-ACCESS:
+1. Access
    kubectl port-forward svc/{{ include "jupyterhub.proxyName" . }} -n {{ .Release.Namespace }} 8080:{{ .Values.service.port }}
    Open: http://localhost:8080{{ .Values.hub.baseUrl }}
 
-SERVICES:
+2. Services
    Proxy: {{ include "jupyterhub.proxyName" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}
    Proxy API: {{ include "jupyterhub.proxyApiName" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.proxyApiPort }}
    Hub: {{ include "jupyterhub.hubName" . }}.{{ .Release.Namespace }}.svc.cluster.local:8081
 
-AUTHENTICATION:
+3. Authentication
    Auth type: {{ .Values.auth.type }}
 {{- if and (eq .Values.auth.type "dummy") (not .Values.auth.dummyPassword) }}
    Dummy password: empty
 {{- else if eq .Values.auth.type "dummy" }}
    Dummy password: configured
 {{- end }}
 
-PERSISTENCE:
+4. Persistence
 {{- if .Values.hub.persistence.enabled }}
    Hub PVC: {{ include "jupyterhub.hubDataClaimName" . }}
 {{- else }}
@@ -30,7 +30,7 @@ PERSISTENCE:
    Single-user PVCs: disabled
 {{- end }}
 
-NETWORKING:
+5. Networking
 {{- if .Values.ingress.enabled }}
    Ingress: enabled
    Class: {{ .Values.ingress.ingressClassName | default "(cluster default)" }}
@@ -43,21 +43,22 @@ NETWORKING:
 {{- else }}
    Gateway API: disabled
 {{- end }}
+   NetworkPolicy: {{ ternary "enabled" "disabled" .Values.networkPolicy.enabled }}
 
-OPERATIONS:
+6. Operations
    Run Helm tests:
      helm test {{ .Release.Name }} -n {{ .Release.Namespace }}
 
    Inspect pods:
      kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
      kubectl logs -n {{ .Release.Namespace }} deploy/{{ include "jupyterhub.hubName" . }}
 
-SECURITY REMINDERS:
+7. Security Reminders
    1. Do not expose DummyAuthenticator publicly without auth.dummyPassword.
    2. Use a real authenticator through hub.extraConfig for production.
    3. Keep the proxy token in an existing Secret or ExternalSecret for GitOps.
 
-DOCUMENTATION:
+8. Documentation
    Chart: https://helmforge.dev/docs/charts/jupyterhub
    Source: https://github.com/helmforgedev/charts/tree/main/charts/jupyterhub
    JupyterHub: https://jupyter.org/hub

charts/jupyterhub/templates/networkpolicy.yaml

@@ -85,7 +85,7 @@ spec:
           port: 443
     - to:
         - podSelector: {}
-    {{- with .Values.networkPolicy.hub.egress }}
+    {{- with (concat .Values.networkPolicy.hub.egress .Values.networkPolicy.extraEgress) }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
 ---

charts/jupyterhub/tests/networkpolicy-extra-egress-values.yaml

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: Apache-2.0
+networkPolicy:
+  enabled: true
+  extraEgress:
+    - to:
+        - ipBlock:
+            cidr: 10.60.0.0/16
+      ports:
+        - protocol: TCP
+          port: 443

charts/jupyterhub/tests/networkpolicy_test.yaml

@@ -158,3 +158,18 @@ tests:
               - protocol: TCP
                 port: 5432
         documentIndex: 1
+
+  - it: should append extra Hub egress rules
+    values:
+      - networkpolicy-extra-egress-values.yaml
+    asserts:
+      - contains:
+          path: spec.egress
+          content:
+            to:
+              - ipBlock:
+                  cidr: 10.60.0.0/16
+            ports:
+              - protocol: TCP
+                port: 443
+        documentIndex: 1

charts/jupyterhub/values.schema.json

@@ -77,7 +77,15 @@
       }
     },
     "gateway": { "type": "object", "additionalProperties": true },
-    "networkPolicy": { "type": "object", "additionalProperties": true },
+    "networkPolicy": {
+      "type": "object",
+      "additionalProperties": true,
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "hub": { "type": "object", "additionalProperties": true },
+        "extraEgress": { "type": "array", "items": { "type": "object" } }
+      }
+    },
     "serviceAccount": { "type": "object", "additionalProperties": true },
     "rbac": { "type": "object", "additionalProperties": true },
     "metrics": {

charts/jupyterhub/values.yaml

@@ -186,6 +186,8 @@ networkPolicy:
   hub:
     # -- Additional Hub egress rules appended after the default DNS, HTTPS, and same-namespace rules. Use this for external PostgreSQL/MySQL databases or private endpoints.
     egress: []
+  # -- Additional Hub egress rules appended after networkPolicy.hub.egress.
+  extraEgress: []
 
 serviceAccount:
   # -- Create a dedicated ServiceAccount.