From 24fa95525ab3f9424c8efedbca276dca4f744bd6 Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Fri, 7 Nov 2025 19:27:38 +0300
Subject: [PATCH] feat(templates): add NetworkPolicy template with
 ingress/egress rules

Add comprehensive NetworkPolicy support for Jellyfin pod with:
- Ingress rules: configurable external access or namespace/pod selectors
- Egress rules: DNS resolution, metadata providers, custom rules
- Automatic Prometheus integration when metrics are enabled
- DLNA/hostNetwork detection with fail-safe error message
- Support for restrictedEgress mode for high-security environments

The NetworkPolicy is disabled by default to maintain backward compatibility.
When enabled, it provides fine-grained control over network traffic:
- Who can access Jellyfin (ingress)
- What external connections Jellyfin can make (egress)

NetworkPolicy requires CNI plugin support (Calico, Cilium, etc.) and
cannot be used with hostNetwork mode (DLNA). The template includes
validation to prevent misconfiguration.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 charts/jellyfin/templates/networkpolicy.yaml | 109 +++++++++++++++++++
 1 file changed, 109 insertions(+)
 create mode 100644 charts/jellyfin/templates/networkpolicy.yaml

diff --git a/charts/jellyfin/templates/networkpolicy.yaml b/charts/jellyfin/templates/networkpolicy.yaml
new file mode 100644
index 0000000..5af3206
--- /dev/null
+++ b/charts/jellyfin/templates/networkpolicy.yaml
@@ -0,0 +1,109 @@
+{{- if .Values.networkPolicy.enabled }}
+{{- if or .Values.jellyfin.enableDLNA .Values.podPrivileges.hostNetwork }}
+{{- fail "NetworkPolicy cannot be enabled when hostNetwork is enabled (DLNA mode or podPrivileges.hostNetwork). NetworkPolicy does not apply to pods using hostNetwork. Please set networkPolicy.enabled=false or disable hostNetwork." }}
+{{- end }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "jellyfin.fullname" . }}
+  labels:
+    {{- include "jellyfin.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "jellyfin.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    {{- toYaml .Values.networkPolicy.policyTypes | nindent 4 }}
+
+  {{- if has "Ingress" .Values.networkPolicy.policyTypes }}
+  ingress:
+    # Allow traffic to Jellyfin HTTP port
+    - ports:
+        - protocol: TCP
+          port: http
+      {{- if not .Values.networkPolicy.ingress.allowExternal }}
+      from:
+        {{- if or .Values.networkPolicy.ingress.podSelector .Values.networkPolicy.ingress.namespaceSelector }}
+        - podSelector:
+            {{- toYaml .Values.networkPolicy.ingress.podSelector | nindent 12 }}
+          {{- if .Values.networkPolicy.ingress.namespaceSelector }}
+          namespaceSelector:
+            {{- toYaml .Values.networkPolicy.ingress.namespaceSelector | nindent 12 }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+
+    {{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
+    # Allow Prometheus metrics scraping
+    - ports:
+        - protocol: TCP
+          port: {{ .Values.metrics.serviceMonitor.port }}
+      from:
+        - podSelector:
+            {{- toYaml .Values.networkPolicy.metrics.podSelector | nindent 12 }}
+          {{- if .Values.networkPolicy.metrics.namespace }}
+          namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Values.networkPolicy.metrics.namespace }}
+          {{- end }}
+    {{- end }}
+
+    {{- with .Values.networkPolicy.ingress.customRules }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
+
+  {{- if has "Egress" .Values.networkPolicy.policyTypes }}
+  egress:
+    {{- if .Values.networkPolicy.egress.allowDNS }}
+    # Allow DNS resolution (required for Jellyfin operation)
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Values.networkPolicy.egress.dnsNamespace }}
+          podSelector:
+            matchLabels:
+              {{- toYaml .Values.networkPolicy.egress.dnsPodSelector | nindent 14 }}
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    {{- end }}
+
+    {{- if .Values.networkPolicy.egress.allowAllEgress }}
+    # Allow all egress traffic (metadata providers, subtitles, images, etc.)
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+    {{- else }}
+      {{- if .Values.networkPolicy.egress.restrictedEgress.allowMetadata }}
+    # Allow HTTPS for metadata providers (TMDB, TheTVDB, OpenSubtitles, etc.)
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - protocol: TCP
+          port: 443
+      {{- end }}
+
+      {{- if .Values.networkPolicy.egress.restrictedEgress.allowInCluster }}
+    # Allow pod-to-pod communication within the cluster
+    - to:
+        - podSelector: {}
+      {{- end }}
+
+      {{- range .Values.networkPolicy.egress.restrictedEgress.allowedCIDRs }}
+    # Custom CIDR egress rule
+    - to:
+        - ipBlock:
+            cidr: {{ . }}
+      {{- end }}
+    {{- end }}
+
+    {{- with .Values.networkPolicy.egress.customRules }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end }}