Add networkPolicy section to values.yaml with comprehensive configuration options:
- enabled: boolean flag to enable/disable NetworkPolicy (default: false)
- policyTypes: configure Ingress and/or Egress policies
- ingress: control which pods/namespaces can access Jellyfin
- allowExternal: permit access from any namespace (default: true)
- podSelector/namespaceSelector: restrict access to specific pods/namespaces
- customRules: advanced ingress rules for complex scenarios
- egress: control outbound connections from Jellyfin
- allowDNS: permit DNS resolution (default: true, required)
- allowAllEgress: permit all internet access (default: true)
- restrictedEgress: high-security mode with HTTPS-only metadata access
- customRules: advanced egress rules
- metrics: automatic Prometheus integration configuration
All parameters include detailed documentation explaining:
- Purpose and usage
- Default values and recommended settings
- Examples for common scenarios
- Security implications
The configuration supports use cases from simple deployments to
zero-trust environments while maintaining sensible defaults.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Add comprehensive NetworkPolicy support for Jellyfin pod with:
- Ingress rules: configurable external access or namespace/pod selectors
- Egress rules: DNS resolution, metadata providers, custom rules
- Automatic Prometheus integration when metrics are enabled
- DLNA/hostNetwork detection with fail-safe error message
- Support for restrictedEgress mode for high-security environments
The NetworkPolicy is disabled by default to maintain backward compatibility.
When enabled, it provides fine-grained control over network traffic:
- Who can access Jellyfin (ingress)
- What external connections Jellyfin can make (egress)
NetworkPolicy requires CNI plugin support (Calico, Cilium, etc.) and
cannot be used with hostNetwork mode (DLNA). The template includes
validation to prevent misconfiguration.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
