fix(opencut): align template standards

charts/opencut/README.md

@@ -72,6 +72,15 @@ gateway:
     - opencut.example.com
 ```
 
+NetworkPolicy can append full custom web egress rules while keeping the generated
+DNS, database, Redis HTTP bridge, and HTTPS egress rules:
+
+```yaml
+networkPolicy:
+  enabled: true
+  extraEgress: []
+```
+
 ## Documentation
 
 - [Design](DESIGN.md)
@@ -113,10 +122,10 @@ helm unittest charts/opencut
 kubeconform -strict -summary rendered.yaml
 ```
 
-### 🟢 Security Scan: `opencut`
+### Security Scan: `opencut`
 
 | Framework | Score |
-|---|---|
+| --- | --- |
 | MITRE + NSA + SOC2 | **92.85354%** |
 
-> ✅ Security posture acceptable.
+Security posture: acceptable.

charts/opencut/ci/ci-values.yaml

@@ -7,10 +7,9 @@ opencut:
   freesoundApiKey: ci-api-key
 
 service:
-  ipFamilyPolicy: PreferDualStack
+  ipFamilyPolicy: SingleStack
   ipFamilies:
     - IPv4
-    - IPv6
 
 ingress:
   enabled: true

charts/opencut/templates/NOTES.txt

@@ -1,9 +1,6 @@
 {{/* SPDX-License-Identifier: Apache-2.0 */}}
-=============================================================================
-OpenCut deployed successfully!
-=============================================================================
+1. Access
 
-ACCESS:
 {{- if .Values.ingress.enabled }}
   {{- range .Values.ingress.hosts }}
    {{ ternary "https" "http" (eq (include "opencut.ingressHostHasTls" (dict "root" $ "host" .host)) "true") }}://{{ .host }}
@@ -17,12 +14,14 @@ ACCESS:
    Open: http://localhost:3000
 {{- end }}
 
-SERVICE:
+2. Service
+
    Internal: {{ include "opencut.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}
    Health:   /api/health
    Image:    {{ include "opencut.image" . }}
 
-DATABASE:
+3. Database
+
 {{- if .Values.postgresql.enabled }}
    PostgreSQL: bundled HelmForge subchart
    Service: {{ include "opencut.databaseHost" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ dig "service" "port" 5432 .Values.postgresql }}
@@ -31,7 +30,8 @@ DATABASE:
    Host: {{ .Values.database.external.host }}:{{ .Values.database.external.port }}
 {{- end }}
 
-REDIS:
+4. Redis
+
 {{- if .Values.redisHttp.enabled }}
   {{- if .Values.redis.enabled }}
    Redis: bundled HelmForge subchart
@@ -46,20 +46,23 @@ REDIS:
    Redis HTTP endpoint: external ({{ .Values.redisHttp.external.url }})
 {{- end }}
 
-OPERATIONS:
+5. Operations
+
    Run Helm tests:
      helm test {{ .Release.Name }} -n {{ .Release.Namespace }}
 
    Inspect pods:
      kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
      kubectl logs -n {{ .Release.Namespace }} deploy/{{ include "opencut.fullname" . }}
 
-PRODUCTION REMINDERS:
+6. Production Reminders
+
    1. Set opencut.siteUrl and opencut.betterAuthSecret explicitly.
    2. Use existingSecret or External Secrets for database and Redis credentials.
    3. Enable persistence, resources, NetworkPolicy, and external TLS before exposing publicly.
 
-DOCUMENTATION:
+7. Documentation
+
    Chart: https://helmforge.dev/docs/charts/opencut
    Source: https://github.com/helmforgedev/charts/tree/main/charts/opencut
    OpenCut: https://github.com/OpenCut-app/OpenCut

charts/opencut/templates/networkpolicy.yaml

@@ -38,6 +38,9 @@ spec:
     {{- with .Values.networkPolicy.egress }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with .Values.networkPolicy.extraEgress }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 {{- if .Values.redisHttp.enabled }}
 ---
 apiVersion: networking.k8s.io/v1

charts/opencut/tests/networkpolicy_test.yaml

@@ -157,6 +157,32 @@ tests:
           value: 8443
         documentIndex: 0
 
+  - it: should append extra web egress rules to the defaults
+    set:
+      networkPolicy.enabled: true
+      networkPolicy.extraEgress:
+        - to:
+            - ipBlock:
+                cidr: 10.80.0.0/16
+          ports:
+            - protocol: TCP
+              port: 443
+    asserts:
+      - contains:
+          path: spec.egress[0].ports
+          content:
+            protocol: UDP
+            port: 53
+        documentIndex: 0
+      - equal:
+          path: spec.egress[2].to[0].ipBlock.cidr
+          value: 10.80.0.0/16
+        documentIndex: 0
+      - equal:
+          path: spec.egress[2].ports[0].port
+          value: 443
+        documentIndex: 0
+
   - it: should append custom web ingress rules without dropping the default web port
     set:
       networkPolicy.enabled: true

charts/opencut/values.schema.json

@@ -185,7 +185,16 @@
         "pathType": { "type": "string", "enum": ["Exact", "PathPrefix", "RegularExpression"] }
       }
     },
-    "networkPolicy": { "type": "object" },
+    "networkPolicy": {
+      "type": "object",
+      "additionalProperties": true,
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "ingress": { "type": "array", "items": { "type": "object" } },
+        "egress": { "type": "array", "items": { "type": "object" } },
+        "extraEgress": { "type": "array", "items": { "type": "object" } }
+      }
+    },
     "autoscaling": { "type": "object" },
     "pdb": { "type": "object" },
     "probes": { "type": "object" },

charts/opencut/values.yaml

@@ -398,6 +398,8 @@ networkPolicy:
   ingress: []
   # -- Additional egress rules appended to the OpenCut web policy.
   egress: []
+  # -- Additional full egress rules appended to the OpenCut web policy.
+  extraEgress: []
 
 # =============================================================================
 # Autoscaling and Availability