From 323c44d03dab8e8d01f0f02efd7bb2a8188ecfac Mon Sep 17 00:00:00 2001
From: Maicon Berlofa <maicon.berloffa@gmail.com>
Date: Fri, 3 Jul 2026 17:07:27 -0300
Subject: [PATCH 1/2] docs(notediscovery): sync template standards updates

---
 src/data/playground-configs.ts          | 28 +++++++++++++++++++++++++
 src/pages/docs/charts/notediscovery.mdx | 17 ++++++++++++++-
 2 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/src/data/playground-configs.ts b/src/data/playground-configs.ts
index ddd39839..94e7a0f0 100644
--- a/src/data/playground-configs.ts
+++ b/src/data/playground-configs.ts
@@ -8261,6 +8261,34 @@ export const chartConfigs: Record<string, ChartConfig> = {
         },
       ],
     },
+    {
+      name: 'Network Policy',
+      collapsible: true,
+      gateField: 'networkPolicy.enabled',
+      fields: [
+        {
+          label: 'Ingress Namespace',
+          key: 'networkPolicy.ingressFrom[0].namespaceSelector.matchLabels.kubernetes\\.io/metadata\\.name',
+          type: 'text',
+          default: 'ingress-system',
+          description: 'Namespace allowed to reach NoteDiscovery HTTP',
+        },
+        {
+          label: 'Extra Egress CIDR',
+          key: 'networkPolicy.extraEgress[0].to[0].ipBlock.cidr',
+          type: 'text',
+          default: '10.0.0.0/8',
+          description: 'Additional destination allowed after DNS and HTTPS baseline rules',
+        },
+        {
+          label: 'Extra Egress Port',
+          key: 'networkPolicy.extraEgress[0].ports[0].port',
+          type: 'number',
+          default: '8443',
+          description: 'Additional TCP egress port',
+        },
+      ],
+    },
   ],
   'github-mcp-server': [
     {
diff --git a/src/pages/docs/charts/notediscovery.mdx b/src/pages/docs/charts/notediscovery.mdx
index d8f8cd47..5ea0c1f2 100644
--- a/src/pages/docs/charts/notediscovery.mdx
+++ b/src/pages/docs/charts/notediscovery.mdx
@@ -53,7 +53,7 @@ Exposure and operations:
 - `gatewayAPI.enabled`, `gatewayAPI.httpRoutes`.
 - `externalSecrets.enabled`, `externalSecrets.items`: materialize complete config Secrets through External Secrets Operator.
 - `pdb.enabled`, `pdb.minAvailable`.
-- `networkPolicy.enabled`, `networkPolicy.ingressFrom`.
+- `networkPolicy.enabled`, `networkPolicy.ingressFrom`, `networkPolicy.extraEgress`.
 - `probes.startup`, `probes.liveness`, `probes.readiness`: enable flags and timing values.
 - `resources`, `podSecurityContext`, `securityContext`, `nodeSelector`, `tolerations`, `affinity`.
 - `topologySpreadConstraints`, `priorityClassName`, `terminationGracePeriodSeconds`.
@@ -99,6 +99,13 @@ ingress:
 
 networkPolicy:
   enabled: true
+  extraEgress:
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/8
+      ports:
+        - protocol: TCP
+          port: 8443
 ```
 
 Because this example uses `auth.existingSecret`, put every runtime setting in the
@@ -193,6 +200,14 @@ externalSecrets:
 
 `config.yaml` should include all runtime settings, not only secret fields.
 
+## Network Policy
+
+`networkPolicy.enabled=true` restricts inbound HTTP traffic to the configured
+`networkPolicy.ingressFrom` peers, or to all namespaces when no ingress peers
+are set. Setting `networkPolicy.extraEgress` also enables egress isolation. The
+chart keeps DNS and HTTPS egress available before appending the custom egress
+rules.
+
 ## Backup
 
 Back up the PVC in every production deployment. The default `/app/data` directory contains notes and local application data.

From b274f0599f59745f98f26174a5b8ad5aa4437e3c Mon Sep 17 00:00:00 2001
From: Maicon Berlofa <maicon.berloffa@gmail.com>
Date: Sun, 5 Jul 2026 21:17:03 -0300
Subject: [PATCH 2/2] docs(notediscovery): restrict production ingress example

---
 src/pages/docs/charts/notediscovery.mdx | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/pages/docs/charts/notediscovery.mdx b/src/pages/docs/charts/notediscovery.mdx
index 5ea0c1f2..608b0882 100644
--- a/src/pages/docs/charts/notediscovery.mdx
+++ b/src/pages/docs/charts/notediscovery.mdx
@@ -99,6 +99,10 @@ ingress:
 
 networkPolicy:
   enabled: true
+  ingressFrom:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: ingress-system
   extraEgress:
     - to:
         - ipBlock: