docs(notediscovery): sync template standards updates

src/data/playground-configs.ts

@@ -8261,6 +8261,34 @@ export const chartConfigs: Record<string, ChartConfig> = {
         },
       ],
     },
+    {
+      name: 'Network Policy',
+      collapsible: true,
+      gateField: 'networkPolicy.enabled',
+      fields: [
+        {
+          label: 'Ingress Namespace',
+          key: 'networkPolicy.ingressFrom[0].namespaceSelector.matchLabels.kubernetes\\.io/metadata\\.name',
+          type: 'text',
+          default: 'ingress-system',
+          description: 'Namespace allowed to reach NoteDiscovery HTTP',
+        },
+        {
+          label: 'Extra Egress CIDR',
+          key: 'networkPolicy.extraEgress[0].to[0].ipBlock.cidr',
+          type: 'text',
+          default: '10.0.0.0/8',
+          description: 'Additional destination allowed after DNS and HTTPS baseline rules',
+        },
+        {
+          label: 'Extra Egress Port',
+          key: 'networkPolicy.extraEgress[0].ports[0].port',
+          type: 'number',
+          default: '8443',
+          description: 'Additional TCP egress port',
+        },
+      ],
+    },
   ],
   'github-mcp-server': [
     {

src/pages/docs/charts/notediscovery.mdx

@@ -53,7 +53,7 @@ Exposure and operations:
 - `gatewayAPI.enabled`, `gatewayAPI.httpRoutes`.
 - `externalSecrets.enabled`, `externalSecrets.items`: materialize complete config Secrets through External Secrets Operator.
 - `pdb.enabled`, `pdb.minAvailable`.
-- `networkPolicy.enabled`, `networkPolicy.ingressFrom`.
+- `networkPolicy.enabled`, `networkPolicy.ingressFrom`, `networkPolicy.extraEgress`.
 - `probes.startup`, `probes.liveness`, `probes.readiness`: enable flags and timing values.
 - `resources`, `podSecurityContext`, `securityContext`, `nodeSelector`, `tolerations`, `affinity`.
 - `topologySpreadConstraints`, `priorityClassName`, `terminationGracePeriodSeconds`.
@@ -99,6 +99,17 @@ ingress:
 
 networkPolicy:
   enabled: true
+  ingressFrom:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: ingress-system
+  extraEgress:
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/8
+      ports:
+        - protocol: TCP
+          port: 8443
 ```
 
 Because this example uses `auth.existingSecret`, put every runtime setting in the
@@ -193,6 +204,14 @@ externalSecrets:
 
 `config.yaml` should include all runtime settings, not only secret fields.
 
+## Network Policy
+
+`networkPolicy.enabled=true` restricts inbound HTTP traffic to the configured
+`networkPolicy.ingressFrom` peers, or to all namespaces when no ingress peers
+are set. Setting `networkPolicy.extraEgress` also enables egress isolation. The
+chart keeps DNS and HTTPS egress available before appending the custom egress
+rules.
+
 ## Backup
 
 Back up the PVC in every production deployment. The default `/app/data` directory contains notes and local application data.