feat(netpols): ship the Harbor database allow-rule

[aweingarten]

📌 Summary

Third of #3387, after #3470 (ESO webhook) and #3473 (cert-manager-webhook-linode).

Under default-deny the CloudNativePG operator can't poll the Harbor Postgres instances for status (8000) or metrics (9187) across namespaces, so the replica never starts and the stack stalls: Instance Status Extraction Error → ClusterIsNotReady → Degraded. As with the other gaps, nothing in that symptom points at a NetworkPolicy.

Adds netpols.harborDb, driven by apps.harbor.networkPolicies.enabled (default false), rendered only when harbor is enabled.

🔍 Reviewer Notes

• Scoped to the database pods, not the namespace — deliberately. The gitea policy uses podSelector: {} for its whole namespace, and I did not copy that here. Harbor's component surface is wide (core, jobservice, registry, trivy, exporter, redis) and a namespace-wide Ingress policy would have to enumerate every legitimate flow correctly or take the registry down. The documented gap is the database, so cnpg.io/cluster: harbor-otomi-db is what this selects.
• The extra two rules are there to avoid trading one silent breakage for another. Creating an Ingress policy on the DB pods denies everything not listed, so allowing only cnpg-system would cut Harbor's own components off from Postgres. The policy therefore also allows the harbor namespace (components → 5432, instances → each other for replication) and prometheus on 9187.
• The harbor-namespace rule is intentionally not port-restricted, matching how the existing gitea policy treats intra-namespace and cnpg-system traffic. Happy to narrow it to 5432/8000 if you'd rather be strict — I erred toward not breaking the registry.
• Names verified in-repo rather than assumed: release harbor-otomi-db in namespace harbor (helmfile-03.databases.yaml.gotmpl), consumed as harbor-otomi-db-rw.harbor.svc.cluster.local (values/harbor/harbor.gotmpl); operator namespace cnpg-system (helmfile-02.init.yaml.gotmpl).
• Verified renders with the flag on, nothing with it off, helm lint clean both ways.

Remaining #3387 gaps after this

1. Istio sidecar egress to istiod (15010/15012/15014). I'd like your steer before writing this one: the failure mode is the nastiest of the set (when Envoy dies the iptables redirect stays, so it takes all pod egress with it, including kube-apiserver), and an egress policy that's wrong is far more destructive than an ingress one that's wrong.
2. LKE-E apiserver egress on 6443 — not a rule but a constraint on every policy that talks to the apiserver: the in-cluster kubernetes Service maps 443→targetPort 6443 and Cilium evaluates policy after kube-proxy-replacement DNAT, so a rule allowing only 443 is silently dropped. Probably its own issue rather than part of this series.

🧹 Checklist

• Code is readable, maintainable, and robust.
• Unit tests added/updated — n/a, chart-template change; verified via helm lint/helm template

[Copilot]

🟡 Not ready to approve

The new Harbor DB NetworkPolicy currently allows all ports from some sources due to missing ports fields, which broadens access beyond what the comments describe and should be tightened or clarified before merge.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Adds an opt-in NetworkPolicy allow-rule to unblock CloudNativePG’s cross-namespace access to Harbor’s Postgres instances when clusters run default-deny policies, aligning with the ongoing effort to close known default-deny gaps.

Changes:

• Introduces netpols.harborDb toggle, driven by apps.harbor.networkPolicies.enabled and gated on Harbor being enabled.
• Extends the values schema and defaults to include apps.harbor.networkPolicies.
• Adds a Harbor DB–scoped NetworkPolicy template allowing CNPG operator polling and Prometheus metrics scraping.

File summaries

File	Description
values/apl-network-policies/apl-network-policies.gotmpl	Adds netpols.harborDb flag derived from Harbor enablement + networkPolicies toggle.
values-schema.yaml	Allows apps.harbor.networkPolicies via appNetworkPolicyConfig.
helmfile.d/snippets/defaults.yaml	Sets Harbor networkPolicies.enabled: false by default.
charts/apl-network-policies/values.yaml	Documents the new Harbor DB allow-rule behavior and gating.
charts/apl-network-policies/templates/networkpolicies/harbor-db.yaml	New NetworkPolicy scoped to CNPG Harbor DB pods to permit operator/metrics access under default-deny.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

🟢 Ready to approve

The changes are small, consistent with existing apl-network-policies patterns (namespace label selectors, per-app toggles), and implement the described allow-rule without expanding policy scope beyond the Harbor DB pods.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.