docs(memos): sync template standards updates

src/data/playground-configs.ts

@@ -8401,7 +8401,7 @@ export const chartConfigs: Record<string, ChartConfig> = {
           key: 'ingress.ingressClassName',
           type: 'select',
           default: 'traefik',
-          options: ['traefik', 'nginx'],
+          options: ['', 'traefik', 'nginx'],
           description: 'Ingress controller class',
         },
         {
@@ -8421,6 +8421,34 @@ export const chartConfigs: Record<string, ChartConfig> = {
         },
       ],
     },
+    {
+      name: 'Network Policy',
+      collapsible: true,
+      gateField: 'networkPolicy.enabled',
+      fields: [
+        {
+          label: 'Egress Isolation',
+          key: 'networkPolicy.egressIsolation',
+          type: 'toggle',
+          default: 'false',
+          description: 'Render baseline DNS and HTTPS egress rules',
+        },
+        {
+          label: 'HTTPS IPv4 CIDR',
+          key: 'networkPolicy.httpsEgress[0].ipBlock.cidr',
+          type: 'text',
+          default: '0.0.0.0/0',
+          description: 'IPv4 HTTPS egress destination',
+        },
+        {
+          label: 'HTTPS IPv6 CIDR',
+          key: 'networkPolicy.httpsEgress[1].ipBlock.cidr',
+          type: 'text',
+          default: '::/0',
+          description: 'IPv6 HTTPS egress destination',
+        },
+      ],
+    },
   ],
   notediscovery: [
     {

src/pages/docs/charts/memos.mdx

@@ -49,10 +49,18 @@ Exposure and operations:
 
 - `serviceAccount.create`, `serviceAccount.name`, `serviceAccount.annotations`, `serviceAccount.automountServiceAccountToken`.
 - `service.type`, `service.port`, `service.annotations`, `service.ipFamilyPolicy`, `service.ipFamilies`.
-- `ingress.enabled`, `ingress.ingressClassName`, `ingress.annotations`, `ingress.hosts`, `ingress.tls`.
+- `ingress.enabled`, `ingress.ingressClassName`, `ingress.annotations`, `ingress.hosts`, `ingress.tls`. Set
+  `ingress.ingressClassName: ""` to omit `spec.ingressClassName`.
 - `gateway.enabled`, `gateway.parentRefs`, `gateway.hostnames`, `gateway.path`, `gateway.pathType`.
 - `pdb.enabled`, `pdb.minAvailable`.
-- `networkPolicy.enabled`, `networkPolicy.ingressFrom`.
+- `networkPolicy.enabled`, `networkPolicy.ingressFrom`, `networkPolicy.egressIsolation`, `networkPolicy.dnsEgress`,
+  `networkPolicy.httpsEgress`, `networkPolicy.extraEgress`.
+  Enabling only `networkPolicy.enabled` creates an ingress-only policy.
+  Set `networkPolicy.egressIsolation=true` for baseline DNS and HTTPS egress rules without custom rules.
+  `networkPolicy.dnsEgress` defaults to `kube-system` pods labeled `k8s-app: kube-dns` and can be overridden for different DNS labels.
+  `networkPolicy.httpsEgress` defaults to IPv4 and IPv6 internet destinations on port 443 and can be overridden for restricted webhook or
+  integration destinations.
+  Setting `networkPolicy.extraEgress` also enables egress isolation and appends the supplied rules.
 - `probes.startup`, `probes.liveness`, `probes.readiness`: enable flags and timing values.
 - `resources`, `podSecurityContext`, `securityContext`, `nodeSelector`, `tolerations`, `affinity`.
 - `topologySpreadConstraints`, `priorityClassName`, `terminationGracePeriodSeconds`.
@@ -100,6 +108,7 @@ networkPolicy:
 ```
 
 Set `memos.instanceUrl` when Memos is behind Ingress, Gateway API, or another reverse proxy.
+Set `networkPolicy.egressIsolation=true` when outbound DNS and HTTPS should be explicitly allowed by the chart-managed NetworkPolicy.
 
 ## External Database
 

src/pages/playground.astro

@@ -51,6 +51,7 @@ const siteSyncPlaygroundConfigs: Record<string, string> = {
   'kubernetes-mcp-server': 'src/data/playground-configs.ts',
   langflow: 'src/data/playground-configs.ts',
   medikeep: 'src/data/playground-configs.ts',
+  memos: 'src/data/playground-configs.ts',
   memcached: 'src/data/playground-configs.ts',
   notediscovery: 'src/data/playground-configs.ts',
   poznote: 'src/data/playground-configs.ts',