Description
Chart companion to OPN-0011 (which fixes the raw manifest): an opt-in NetworkPolicy template covering scrape ingress plus syslog, Zenarmor (9200/TCP) and NetFlow (2055/UDP), each toggled with its receiver’s enablement so an enabled receiver is never silently CNI-dropped.
Acceptance Criteria
- #1 Template gated by a values toggle; receiver ports open iff the matching receiver is enabled in values
- #2 helm-validate/kubeconform clean with real schemas
Definition of Done
- #1 just check
- #2 just gen (if any generated artifact changed) and the diff committed
Implementation Notes
Landed the opt-in Helm NetworkPolicy and chart contract coverage in 1c3b37123c682b0037c7173e6fcf82060a66b772. CodeRabbit completed with zero findings.
Final Summary
Added an opt-in Helm NetworkPolicy whose receiver ports follow the matching enablement values. Helm validation, kubeconform, and just check passed; exact-head CI run 33586622286 succeeded at 1c3b37123c682b0037c7173e6fcf82060a66b772.