Sync chart from pieced-threema-gateway 0.1.11

deploy/helm/pieced-threema-gateway/templates/networkpolicy.yaml

@@ -6,13 +6,15 @@
 #   1. The cluster Ingress controller (nginx-ingress) — for Threema webhooks
 #      hitting us through the LB.
 #   2. The portal namespace — calls /admin and reads /metrics.
-#   3. Tenant namespaces (managed by pieced-operator) — call /api/send.
+#   3. Tenant namespaces (managed by pieced-operator) — call /api/*.
+#   4. networkPolicy.extraClients namespaces (e.g. personal Hermes) — /api/*.
 #
 # Egress:
 #   - DNS (kube-system)
 #   - Threema Gateway: msgapi.threema.ch:443 (FQDN-pinned)
 #   - Postgres in same namespace
-#   - HTTPS to tenant OpenClaw services in tenant namespaces (port 18789)
+#   - HTTP to tenant OpenClaw services in tenant namespaces (port 18790)
+#   - HTTP to extraClients namespaces on their configured port
 # =============================================================================
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
@@ -50,6 +52,16 @@ spec:
         - ports:
             - port: "8080"
               protocol: TCP
+    {{- range .Values.networkPolicy.extraClients }}
+    # Extra client: {{ .namespace }}
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": {{ .namespace | quote }}
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    {{- end }}
   egress:
     # DNS — with the proxy interceptor on so toFQDNs rules below
     # actually work.
@@ -112,4 +124,14 @@ spec:
         - ports:
             - port: "18790"
               protocol: TCP
+    {{- range .Values.networkPolicy.extraClients }}
+    # Extra client delivery: {{ .namespace }} (targetPort of its Service)
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": {{ .namespace | quote }}
+      toPorts:
+        - ports:
+            - port: {{ .port | quote }}
+              protocol: TCP
+    {{- end }}
 {{- end }}