docs(kubernetes-mcp-server): sync template standards updates

src/data/playground-configs.ts

@@ -1204,7 +1204,7 @@ export const chartConfigs: Record<string, ChartConfig> = {
           key: 'ingress.ingressClassName',
           type: 'select',
           default: 'traefik',
-          options: ['traefik', 'nginx'],
+          options: ['', 'traefik', 'nginx'],
           description: 'Ingress controller class',
         },
       ],
@@ -1229,6 +1229,20 @@ export const chartConfigs: Record<string, ChartConfig> = {
         },
       ],
     },
+    {
+      name: 'NetworkPolicy',
+      collapsible: true,
+      gateField: 'networkPolicy.enabled',
+      fields: [
+        {
+          label: 'API Egress Port',
+          key: 'networkPolicy.extraEgress[0].ports[0].port',
+          type: 'number',
+          default: '6443',
+          description: 'Additional Kubernetes API or proxy egress port',
+        },
+      ],
+    },
   ],
   'envoy-gateway': [
     {
@@ -8439,6 +8453,34 @@ export const chartConfigs: Record<string, ChartConfig> = {
         },
       ],
     },
+    {
+      name: 'DNS Egress',
+      collapsible: true,
+      gateField: 'networkPolicy.enabled',
+      fields: [
+        {
+          label: 'DNS Namespace',
+          key: 'networkPolicy.dnsEgressPeers[0].namespaceSelector.matchLabels.kubernetes\\.io/metadata\\.name',
+          type: 'text',
+          default: 'kube-system',
+          description: 'Namespace label for cluster DNS pods',
+        },
+        {
+          label: 'DNS Pod Label',
+          key: 'networkPolicy.dnsEgressPeers[0].podSelector.matchLabels.k8s-app',
+          type: 'text',
+          default: 'kube-dns',
+          description: 'Pod label for cluster DNS',
+        },
+        {
+          label: 'API Egress Port',
+          key: 'networkPolicy.extraEgress[0].ports[0].port',
+          type: 'number',
+          default: '6443',
+          description: 'Additional Kubernetes API egress port',
+        },
+      ],
+    },
   ],
   'fastmcp-server': [
     {

src/pages/docs/charts/kubernetes-mcp-server.mdx

@@ -10,7 +10,7 @@ Deploy [Kubernetes MCP Server](https://github.com/containers/kubernetes-mcp-serv
 
 ## Overview
 
-The HelmForge chart uses the official `ghcr.io/containers/kubernetes-mcp-server:v0.0.62` image and serves HTTP on port `8080`.
+The HelmForge chart uses the official `ghcr.io/containers/kubernetes-mcp-server:v0.0.63` image and serves HTTP on port `8080`.
 This workload is a control-plane bridge: its effective permissions are the Kubernetes RBAC permissions granted to its ServiceAccount.
 
 Defaults are inspection-oriented:
@@ -47,16 +47,21 @@ Storage and scaling:
 - `persistence.enabled`: optional data volume. The server is stateless by default.
 - `persistence.size`, `persistence.storageClass`, `persistence.accessModes`: generated PVC settings.
 - `persistence.existingClaim`, `persistence.mountPath`: existing claim and mount path.
-- `replicaCount > 1` with persistence requires `ReadWriteMany` or `persistence.enabled=false`.
+- `replicaCount > 1` with chart-created persistence requires `ReadWriteMany` or `persistence.enabled=false`.
+  When `persistence.existingClaim` is set, the external claim controls access modes.
 
 Exposure and operations:
 
 - `serviceAccount.create`, `serviceAccount.name`, `serviceAccount.annotations`, `serviceAccount.automountServiceAccountToken`.
 - `service.type`, `service.port`, `service.annotations`, `service.ipFamilyPolicy`, `service.ipFamilies`.
-- `ingress.enabled`, `ingress.ingressClassName`, `ingress.annotations`, `ingress.hosts`, `ingress.tls`.
+- `ingress.enabled`, `ingress.ingressClassName`, `ingress.annotations`, `ingress.hosts`, `ingress.tls`. Set
+  `ingress.ingressClassName: ""` to omit `spec.ingressClassName`.
 - `gateway.enabled`, `gateway.parentRefs`, `gateway.hostnames`, `gateway.path`, `gateway.pathType`.
 - `pdb.enabled`, `pdb.minAvailable`.
-- `networkPolicy.enabled`, `networkPolicy.ingressFrom`.
+- `networkPolicy.enabled`, `networkPolicy.ingressFrom`, `networkPolicy.dnsEgressPeers`, `networkPolicy.extraEgress`.
+  Enabling only `networkPolicy.enabled` creates an ingress-only policy.
+  Setting `networkPolicy.enabled=true` enables egress isolation with built-in DNS and HTTPS allowances; `networkPolicy.extraEgress` appends the supplied rules.
+  `networkPolicy.dnsEgressPeers` defaults to kube-system/kube-dns and can be changed for clusters with different DNS labels.
 - `probes.startup`, `probes.liveness`, `probes.readiness`: enable flags and timing values.
 - `resources`, `podSecurityContext`, `securityContext`, `nodeSelector`, `tolerations`, `affinity`.
 - `topologySpreadConstraints`, `priorityClassName`, `terminationGracePeriodSeconds`.

src/pages/playground.astro

@@ -24,6 +24,7 @@ const siteSyncPlaygroundConfigs: Record<string, string> = {
   'adguard-home': 'src/data/playground-configs.ts',
   booklore: 'src/data/playground-configs.ts',
   changedetection: 'src/data/playground-configs.ts',
+  'kubernetes-mcp-server': 'src/data/playground-configs.ts',
   medikeep: 'src/data/playground-configs.ts',
   memcached: 'src/data/playground-configs.ts',
   notediscovery: 'src/data/playground-configs.ts',