fix(metrics-server): align template standards

charts/metrics-server/README.md

@@ -89,6 +89,7 @@ This avoids ownership conflicts while still deploying the Metrics Server workloa
 | `service.ipFamilyPolicy` | `~` | Optional Service IP family policy |
 | `pdb.enabled` | `false` | Render PodDisruptionBudget |
 | `networkPolicy.enabled` | `false` | Render NetworkPolicy |
+| `networkPolicy.egress.extraEgress` | `[]` | Append full custom NetworkPolicy egress rules when `networkPolicy.egress.enabled=true` |
 | `serviceMonitor.enabled` | `false` | Render Prometheus Operator ServiceMonitor |
 
 ## References

charts/metrics-server/templates/NOTES.txt

@@ -1,28 +1,29 @@
 {{/* SPDX-License-Identifier: Apache-2.0 */}}
-=============================================================================
-Metrics Server deployed successfully!
-=============================================================================
+1. Service
 
-SERVICE:
    Internal URL: https://{{ include "metrics-server.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}
    Secure port: {{ include "metrics-server.securePort" . }}
 
-IMAGE:
+2. Image
+
    {{ include "metrics-server.image" . }}
 
-METRICS API:
+3. Metrics API
+
    APIService created: {{ ternary "yes" "no" .Values.apiService.create }}
    APIService TLS verification skipped: {{ ternary "yes" "no" .Values.apiService.insecureSkipTLSVerify }}
    Kubelet insecure TLS: {{ ternary "yes" "no" .Values.metricsServer.kubelet.insecureTLS }}
    Metric resolution: {{ .Values.metricsServer.metricResolution }}
 
-NETWORKING:
+4. Networking
+
    Host network: {{ ternary "enabled" "disabled" .Values.hostNetwork.enabled }}
    Service type: {{ .Values.service.type }}
    NetworkPolicy: {{ ternary "enabled" "disabled" .Values.networkPolicy.enabled }}
    ServiceMonitor: {{ ternary "enabled" "disabled" .Values.serviceMonitor.enabled }}
 
-OPERATIONS:
+5. Operations
+
    Check the APIService:
      kubectl get apiservice v1beta1.metrics.k8s.io
 
@@ -36,7 +37,8 @@ OPERATIONS:
      kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
      kubectl logs -n {{ .Release.Namespace }} deploy/{{ include "metrics-server.fullname" . }}
 
-SECURITY REMINDERS:
+6. Security Reminders
+
 {{- if .Values.metricsServer.kubelet.insecureTLS }}
    1. Kubelet TLS verification is disabled. Use this only for local clusters whose kubelet serving certificates do not include usable SANs.
 {{- else }}
@@ -45,7 +47,8 @@ SECURITY REMINDERS:
    2. Keep RBAC enabled when APIService is managed by this chart.
    3. Prefer a caBundle for APIService TLS verification in production.
 
-DOCUMENTATION:
+7. Documentation
+
    Chart: https://helmforge.dev/docs/charts/metrics-server
    Source: https://github.com/helmforgedev/charts/tree/main/charts/metrics-server
    Metrics Server: https://github.com/kubernetes-sigs/metrics-server

charts/metrics-server/templates/networkpolicy.yaml

@@ -39,7 +39,9 @@ spec:
     []
     {{- end }}
   {{- if .Values.networkPolicy.egress.enabled }}
+  {{- $allowEgress := or .Values.networkPolicy.egress.allowDNS .Values.networkPolicy.egress.allowAPIServer .Values.networkPolicy.egress.allowKubelet .Values.networkPolicy.egress.extraTo .Values.networkPolicy.egress.extraEgress }}
   egress:
+    {{- if $allowEgress }}
     {{- if .Values.networkPolicy.egress.allowDNS }}
     - to:
         - namespaceSelector: {}
@@ -73,5 +75,11 @@ spec:
     - to:
         {{- toYaml . | nindent 8 }}
     {{- end }}
+    {{- with .Values.networkPolicy.egress.extraEgress }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- else }}
+    []
+    {{- end }}
   {{- end }}
 {{- end }}

charts/metrics-server/tests/operations_test.yaml

@@ -4,7 +4,6 @@ templates:
   - templates/pdb.yaml
   - templates/networkpolicy.yaml
   - templates/servicemonitor.yaml
-  - templates/tests/test-connection.yaml
 release:
   name: test
   namespace: metrics
@@ -82,6 +81,29 @@ tests:
             ipBlock:
               cidr: ::/0
 
+  - it: should append custom NetworkPolicy egress rules
+    template: templates/networkpolicy.yaml
+    set:
+      networkPolicy.enabled: true
+      networkPolicy.egress.enabled: true
+      networkPolicy.egress.allowDNS: false
+      networkPolicy.egress.allowAPIServer: false
+      networkPolicy.egress.allowKubelet: false
+      networkPolicy.egress.extraEgress:
+        - to:
+            - ipBlock:
+                cidr: 10.80.0.0/16
+          ports:
+            - protocol: TCP
+              port: 443
+    asserts:
+      - equal:
+          path: spec.egress[0].to[0].ipBlock.cidr
+          value: 10.80.0.0/16
+      - equal:
+          path: spec.egress[0].ports[0].port
+          value: 443
+
   - it: should render deny-all ingress when no sources are allowed
     template: templates/networkpolicy.yaml
     set:
@@ -110,15 +132,3 @@ tests:
       - equal:
           path: spec.endpoints[0].port
           value: https
-
-  - it: should render Helm test pod
-    template: templates/tests/test-connection.yaml
-    asserts:
-      - isKind:
-          of: Pod
-      - equal:
-          path: metadata.annotations["helm.sh/hook"]
-          value: test
-      - matchRegex:
-          path: spec.containers[0].args[0]
-          pattern: /readyz

charts/metrics-server/values.schema.json

@@ -99,7 +99,24 @@
     "livenessProbe": { "$ref": "#/definitions/probe" },
     "readinessProbe": { "$ref": "#/definitions/probe" },
     "pdb": { "type": "object" },
-    "networkPolicy": { "type": "object" },
+    "networkPolicy": {
+      "type": "object",
+      "additionalProperties": true,
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "ingress": { "type": "object" },
+        "egress": {
+          "type": "object",
+          "additionalProperties": true,
+          "properties": {
+            "extraEgress": {
+              "type": "array",
+              "items": { "type": "object" }
+            }
+          }
+        }
+      }
+    },
     "serviceMonitor": { "type": "object" },
     "podLabels": { "type": "object" },
     "podAnnotations": { "type": "object" },

charts/metrics-server/values.yaml

@@ -192,6 +192,7 @@ networkPolicy:
       - 0.0.0.0/0
       - ::/0
     allowDNS: true
+    extraEgress: []
     extraTo: []
 
 # -- Prometheus Operator ServiceMonitor configuration