docs(notediscovery): sync template standards updates

[mberlofa]

Summary

• Document networkPolicy.extraEgress for the NoteDiscovery chart.
• Update the production example with an extra egress rule.
• Add NoteDiscovery NetworkPolicy controls to the playground config.

Related

Chart PR: helmforgedev/charts#672

Validation

• make site-sync-check CHART=notediscovery: passed
• npm run lint: passed
• npm run format:check: passed
• npm run build: passed
• make release-check REPO=site: passed
• make attribution-check REPO=site: passed

Summary by CodeRabbit

• New Features
  • Added a new “Network Policy” section to the NoteDiscovery chart configuration, including editable options for allowed ingress namespace, extra egress CIDR, and extra egress port.
  • Expanded the NoteDiscovery chart documentation with the new network policy settings, updating the production example and clarifying how network policy affects inbound HTTP access and egress isolation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 464b466e-5e3c-4d22-82d5-2934464b5a22

📥 Commits

Reviewing files that changed from the base of the PR and between 323c44d and b274f05.

📒 Files selected for processing (1)

• src/pages/docs/charts/notediscovery.mdx

✅ Files skipped from review due to trivial changes (1)

• src/pages/docs/charts/notediscovery.mdx

---

📝 Walkthrough

Walkthrough

Adds a new Network Policy configuration section to the notediscovery playground chart config, introducing ingress namespace, extra egress CIDR, and extra egress port fields with defaults. Updates the notediscovery documentation with corresponding reference entries, an extended example, and an explanatory section.

Changes

Network Policy Config and Documentation

Layer / File(s)	Summary
Network Policy playground config fields src/data/playground-configs.ts	Adds a gated, collapsible "Network Policy" section to the notediscovery chart config with ingress namespace allowlist, extra egress CIDR, and extra egress port fields and defaults.
Network Policy documentation updates src/pages/docs/charts/notediscovery.mdx	Adds networkPolicy.extraEgress to the config reference, extends the production YAML example with an egress rule, and adds a new "Network Policy" explanatory section.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is related to the docs update, but "sync template standards updates" is too vague to clearly identify the main change.	Rename it to mention the NoteDiscovery networkPolicy docs update, e.g. "docs(notediscovery): document networkPolicy.extraEgress".

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	It covers the summary, related reference, and validation results, though it doesn't follow the template headings exactly.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/notediscovery-template-standards-sync

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

src/pages/docs/charts/notediscovery.mdx (1)

100-109: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Production example leaves ingress unrestricted despite "Network Policy" guidance.

The new Network Policy section explains that without networkPolicy.ingressFrom peers, ingress falls back to allowing all namespaces. The "Production Example" only sets extraEgress and doesn't configure ingressFrom, so it demonstrates tightened egress but permissive (all-namespace) ingress — a bit inconsistent for a production-hardening example.

📝 Suggested addition to the production example

 networkPolicy:
   enabled: true
+  ingressFrom:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: ingress-system
   extraEgress:
     - to:
         - ipBlock:
             cidr: 10.0.0.0/8
       ports:
         - protocol: TCP
           port: 8443

Also applies to: 203-210

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/pages/docs/charts/notediscovery.mdx` around lines 100 - 109, The
Production Example in notediscovery.mdx shows only networkPolicy.enabled and
extraEgress, which leaves ingress permissive and inconsistent with the Network
Policy guidance. Update the example in the production section to also configure
networkPolicy.ingressFrom using the same policy pattern described in the Network
Policy section so it demonstrates a fully hardened setup. Use the existing
networkPolicy block in the docs as the anchor when editing.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/pages/docs/charts/notediscovery.mdx`:
- Around line 100-109: The Production Example in notediscovery.mdx shows only
networkPolicy.enabled and extraEgress, which leaves ingress permissive and
inconsistent with the Network Policy guidance. Update the example in the
production section to also configure networkPolicy.ingressFrom using the same
policy pattern described in the Network Policy section so it demonstrates a
fully hardened setup. Use the existing networkPolicy block in the docs as the
anchor when editing.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 02bc722a-1c32-41ee-804e-2db02b300a8e

📥 Commits

Reviewing files that changed from the base of the PR and between 365449a and 323c44d.

📒 Files selected for processing (2)

• src/data/playground-configs.ts
• src/pages/docs/charts/notediscovery.mdx

[mberlofa]

Addressed the CodeRabbit review-body feedback.

Changes:

• Updated the NoteDiscovery production example so networkPolicy.enabled includes an explicit ingressFrom namespace selector.
• Kept the existing extraEgress example, so the production snippet now demonstrates both restricted ingress and explicit egress hardening.

Validation:

• npm run lint passed
• npm run build passed
• make site-sync-check CHART=notediscovery passed
• make release-check REPO=site passed
• make attribution-check REPO=site passed
• git diff --check passed

Note: this CodeRabbit item was posted in the review summary/body, not as an active review thread, so there is no thread ID to reply to or resolve.