feat(netpols): ship the ESO webhook allow-rule

[aweingarten]

📌 Summary

First of #3387 — and the specific rule @j-zimnowoda asked for in #3389 ("Could you provide an netpol spec that is missing to support ESO's webhook?").

apl-core ships default-deny NetworkPolicies for the namespaces it manages, but not the allow-rules its own bundled components need. Under default-deny those components fail with symptoms that give no hint a NetworkPolicy is the cause. External Secrets is the clearest case: the apiserver can't reach the validating/conversion webhook on 10250, so every ClusterSecretStore/ExternalSecret create or update times out against the webhook and the secrets stack never converges.

This adds an opt-in policy for the ESO webhook, following the per-app pattern already in apl-network-policies:

• netpols.externalSecrets, driven by apps.external-secrets.networkPolicies.enabled (new, via the existing appNetworkPolicyConfig definition)
• ingress on 10250 scoped by port, not by source — see below
• ingress on 8080 from po-prometheus, so turning the policy on doesn't silently cut metrics scraping

🔍 Reviewer Notes

• Why the webhook rule has no from. The apiserver is off the pod network on a managed control plane (LKE/LKE-E) and has no address a namespaceSelector or ipBlock can pin down, so an ingress rule with ports only is the portable way to express "let the apiserver in". If you'd rather pin it to the LKE control-plane range, say which and I'll switch — I didn't want to bake an assumption about the address space into the chart.
• Default is false, deliberately. The policy is pod-scoped and Ingress-typed, so creating it makes the webhook pods deny any ingress not listed. That's only the intent on a cluster already running default-deny; on a cluster without it, enabling this tightens rather than loosens. appNetworkPolicyConfig already defaults enabled to false.
• Selector verified against the rendered chart, not assumed: helm template charts/external-secrets produces pod labels app.kubernetes.io/name: external-secrets-webhook and container ports 10250 (webhook), 8080 (metrics), 8081 (ready) in namespace external-secrets.
• Probe port 8081 is deliberately not allowed. Kubelet→pod probe traffic isn't subject to NetworkPolicy under Cilium on LKE, and the existing gitea/otomi-api policies don't allow it either — I followed the convention rather than diverge. Flagging it since it would matter under a CNI that does enforce host→pod.
• Verified helm template renders the policy with the flag on and nothing with it off, and helm lint passes both ways.

Remaining #3387 gaps

Keeping this to one component so it's reviewable. The other rules from the issue are each their own PR, and I'd rather land them one at a time than in a batch:

1. cert-manager-webhook-linode aggregated APIService — also needs a selector fix: that pod is labeled app=cert-manager-webhook-linode with no app.kubernetes.io/name, so the chart's generic webhook policy (charts/cert-manager/templates/networkpolicy-webhooks.yaml) doesn't match it at all.
2. CNPG operator → Harbor DB (8000 instance status, 9187 metrics), cross-namespace.
3. Istio sidecar egress to istiod (15010/15012/15014) — the nasty one, since a dead Envoy takes all pod egress with it.
4. LKE-E apiserver egress on 6443 — cross-cutting rather than a single rule: the in-cluster kubernetes Service maps 443→targetPort 6443 and Cilium evaluates policy after kube-proxy-replacement DNAT, so every policy that talks to the apiserver must allow 6443 or all API calls hang.

🧹 Checklist

• Code is readable, maintainable, and robust.
• Unit tests added/updated — n/a, chart-template change; covered by helm lint/helm template and verified against the rendered ESO chart

[Copilot]

Pull request overview

Adds an opt-in allow-rule to apl-network-policies so External Secrets’ webhook continues to work on clusters with default-deny NetworkPolicies, by permitting API server ingress to the webhook port and preserving Prometheus metrics scraping.

Changes:

• Introduces apps.external-secrets.networkPolicies.enabled (schema + defaults) and wires it into netpols.externalSecrets.
• Adds a dedicated NetworkPolicy for the external-secrets webhook pods allowing ingress on 10250 (any source) and 8080 (Prometheus).
• Documents the new behavior in the apl-network-policies chart values commentary.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
values/apl-network-policies/apl-network-policies.gotmpl	Maps apps.external-secrets.networkPolicies.enabled to netpols.externalSecrets.
values-schema.yaml	Adds networkPolicies to the apps.external-secrets schema via appNetworkPolicyConfig.
helmfile.d/snippets/defaults.yaml	Sets default apps.external-secrets.networkPolicies.enabled: false.
charts/apl-network-policies/values.yaml	Documents the new external-secrets webhook policy behavior and intent.
charts/apl-network-policies/templates/networkpolicies/external-secrets.yaml	Implements the webhook-scoped NetworkPolicy allowing apiserver ingress on 10250 and Prometheus scraping on 8080.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

charts/apl-network-policies/templates/networkpolicies/external-secrets.yaml:6

• NetworkPolicy names in this chart consistently use the *-platform-policy suffix (e.g., gitea-platform-policy, otomi-api-platform-policy). For consistency and easier grepping, consider renaming this resource to follow the same pattern.

  name: external-secrets-webhook-policy

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.