Add network policy in helm chart

charts/nginx-ingress/templates/controller-networkpolicy.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "nginx-ingress.fullname" . }}-network-policy
+  labels:
+    {{- include "nginx-ingress.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    {{- toYaml .Values.networkPolicy.podSelector | nindent 4 }}
+  policyTypes:
+    {{- toYaml .Values.networkPolicy.policyTypes | nindent 4 }}
+
+  {{- if has "Ingress" .Values.networkPolicy.policyTypes }}
+  ingress:
+    {{- toYaml .Values.networkPolicy.ingress | nindent 4 }}
+  {{- end }}
+
+  {{- if has "Egress" .Values.networkPolicy.policyTypes }}
+  egress:
+    {{- toYaml .Values.networkPolicy.egress | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/nginx-ingress/values.schema.json

@@ -2681,6 +2681,78 @@
           ]
         }
       }
+    },
+    "networkPolicy": {
+      "type": "object",
+      "default": {
+        "enabled": false
+      },
+      "title": "Configuration for NetworkPolicy",
+      "required": [
+        "enabled"
+      ],
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "default": false,
+          "title": "Enable NetworkPolicy",
+          "examples": [
+            false,
+            true
+          ]
+        },
+        "policyTypes": {
+          "type": "array",
+          "default": [
+            "Ingress",
+            "Egress"
+          ],
+          "title": "Types of policy to create",
+          "$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.33.1/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicySpec/properties/policyTypes"
+        },
+        "podSelector": {
+          "type": "object",
+          "default": {},
+          "title": "Label selector for pods (defaults to ingress controller pods)",
+          "$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.33.1/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector"
+        },
+        "ingress": {
+          "type": "array",
+          "default": [
+            {
+              "from": [],
+              "ports": [
+                {
+                  "protocol": "TCP",
+                  "port": 80
+                },
+                {
+                  "protocol": "TCP",
+                  "port": 443
+                }
+              ]
+            }
+          ],
+          "title": "Ingress rules",
+          "$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.33.1/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicySpec/properties/ingress"
+        },
+        "egress": {
+          "type": "array",
+          "default": [
+            {
+              "to": [],
+              "ports": [
+                {
+                  "protocol": "UDP",
+                  "port": 53
+                }
+              ]
+            }
+          ],
+          "title": "Egress rules",
+          "$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.33.1/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicySpec/properties/egress"
+        }
+      }
     }
   },
   "examples": [

charts/nginx-ingress/values.yaml

@@ -766,3 +766,35 @@ nginxAgent:
     processorBufferSize: 50000
   ## The name of a custom ConfigMap to use instead of the one provided by default
   customConfigMap: ""
+
+## Configure Kubernetes NetworkPolicy for the ingress controller pods
+networkPolicy:
+  ## Enable creation of a NetworkPolicy resource for the ingress controller pods
+  enabled: false
+
+  ## List of NetworkPolicy types to apply (Ingress, Egress, or both)
+  policyTypes:
+    - Ingress
+    - Egress
+
+  ## Label selector for pods the NetworkPolicy applies to (defaults to all pods in the same namespace)
+  podSelector: {}
+  ##  matchLabels:
+  ##    app.kubernetes.io/name: nginx-ingress
+  ##    app.kubernetes.io/instance: nginx-ingress
+
+  ## List of ingress rules for allowed sources and ports
+  ingress:
+    - from: []
+      ports:
+        - protocol: TCP
+          port: 80
+        - protocol: TCP
+          port: 443
+
+  ## List of egress rules for allowed destinations and ports
+  egress:
+    - to: []
+      ports:
+        - protocol: UDP
+          port: 53