feat(helm): add networkPolicy.allowExternalEgress for managed datastores

The default policy allows 443 plus the bundled Postgres and Redis by pod
selector, so a managed datastore on another port needs a hand-written CIDR
rule — awkward when REDIS_URL arrives via a Secret the chart cannot inspect.

Adds an opt-in switch that drops the port restriction while still blocking the
cloud metadata endpoints. Defaults to false, keeping this chart stricter than
the common chart default of unrestricted egress.

Author: waleedlatif1

apps/docs/content/docs/en/platform/self-hosting/security.mdx

@@ -85,6 +85,16 @@ networkPolicy:
   This applies even when `REDIS_URL` reaches the pod through a Secret rather than `values.yaml` — the chart cannot see the host, so it cannot generate the rule. A deployment that accepts the URL but has no matching egress rule will fail to reach Redis with `networkPolicy.enabled: true`.
 </Callout>
 
+If maintaining CIDR lists is not worth it, drop the port restriction instead:
+
+```yaml
+networkPolicy:
+  enabled: true
+  allowExternalEgress: true
+```
+
+Cloud metadata endpoints stay blocked either way. This defaults to `false` because Sim's chart is deliberately stricter than the common chart default, which permits unrestricted egress.
+
 ### Pod Security Standards
 
 All workloads set `runAsNonRoot`, drop all Linux capabilities, disable privilege escalation, and use `seccompProfile: RuntimeDefault` — the four controls the `restricted` profile requires. Label the namespace to enforce it:

helm/sim/README.md

@@ -235,6 +235,8 @@ Before installing in production, confirm each of the following:
           - protocol: TCP
             port: 5432           # managed Postgres
   ```
+
+  If you would rather not maintain CIDR lists, `networkPolicy.allowExternalEgress: true` drops the port restriction entirely while still blocking the cloud metadata endpoints. It defaults to `false` — this chart is deliberately stricter than the common chart default of unrestricted egress.
 * **Network policy ingress** — `networkPolicy.ingressFrom` defaults to `[{}]` (an empty peer selector), which allows ingress traffic from **any pod in the cluster**, not just your ingress controller. This is a deliberate simple default, not a locked-down one. On a shared or multi-tenant cluster, scope it down, e.g. to the ingress-nginx namespace:
   ```yaml
   networkPolicy:

helm/sim/templates/networkpolicy.yaml

@@ -122,6 +122,17 @@ spec:
       port: 53
     - protocol: TCP
       port: 53
+  {{- if .Values.networkPolicy.allowExternalEgress }}
+  # Unrestricted egress (still excluding cloud metadata endpoints). Opt-in for
+  # deployments running managed datastores on non-443 ports.
+  - to:
+    - ipBlock:
+        cidr: 0.0.0.0/0
+        except:
+          {{- range (default (list "169.254.169.254/32" "169.254.170.2/32") .Values.networkPolicy.egressExceptCidrs) }}
+          - {{ . | quote }}
+          {{- end }}
+  {{- else }}
   # Allow HTTPS egress for external APIs (excludes cloud metadata endpoints)
   - to:
     - ipBlock:
@@ -133,6 +144,7 @@ spec:
     ports:
     - protocol: TCP
       port: 443
+  {{- end }}
   # Allow custom egress rules
   {{- with .Values.networkPolicy.egress }}
   {{- toYaml . | nindent 2 }}
@@ -214,6 +226,17 @@ spec:
       port: 53
     - protocol: TCP
       port: 53
+  {{- if .Values.networkPolicy.allowExternalEgress }}
+  # Unrestricted egress (still excluding cloud metadata endpoints). Opt-in for
+  # deployments running managed datastores on non-443 ports.
+  - to:
+    - ipBlock:
+        cidr: 0.0.0.0/0
+        except:
+          {{- range (default (list "169.254.169.254/32" "169.254.170.2/32") .Values.networkPolicy.egressExceptCidrs) }}
+          - {{ . | quote }}
+          {{- end }}
+  {{- else }}
   # Allow HTTPS egress for external APIs (excludes cloud metadata endpoints)
   - to:
     - ipBlock:
@@ -225,6 +248,7 @@ spec:
     ports:
     - protocol: TCP
       port: 443
+  {{- end }}
   # Allow custom egress rules
   {{- with .Values.networkPolicy.egress }}
   {{- toYaml . | nindent 2 }}

helm/sim/tests/networkpolicy_test.yaml

@@ -176,3 +176,40 @@ tests:
             ports:
               - protocol: TCP
                 port: 5432
+
+  - it: restricts egress to HTTPS by default
+    set:
+      <<: *defaults
+    documentIndex: 0
+    asserts:
+      - contains:
+          path: spec.egress
+          content:
+            to:
+              - ipBlock:
+                  cidr: 0.0.0.0/0
+                  except:
+                    - "169.254.169.254/32"
+                    - "169.254.170.2/32"
+            ports:
+              - protocol: TCP
+                port: 443
+
+  # Opt-in for managed datastores on non-443 ports. Metadata endpoints stay
+  # blocked either way — that exclusion is not negotiable.
+  - it: allows unrestricted egress when allowExternalEgress=true
+    set:
+      <<: *defaults
+      networkPolicy.allowExternalEgress: true
+    documentIndex: 0
+    asserts:
+      - contains:
+          path: spec.egress
+          content:
+            to:
+              - ipBlock:
+                  cidr: 0.0.0.0/0
+                  except:
+                    - "169.254.169.254/32"
+                    - "169.254.170.2/32"
+

helm/sim/values.yaml

@@ -1195,6 +1195,17 @@ networkPolicy:
     - "169.254.169.254/32"
     - "169.254.170.2/32"
 
+  # Allow egress to any destination and port instead of the default
+  # HTTPS-only rule set (cloud metadata endpoints stay blocked either way).
+  #
+  # Off by default: this chart is deliberately stricter than the common chart
+  # default, which permits unrestricted egress. Leave it false and enumerate
+  # what you need under `egress` below. Turn it on when you run managed
+  # datastores on non-443 ports (Redis, Postgres) and would rather not maintain
+  # CIDR lists — the bundled Postgres and Redis are already allowed by pod
+  # selector and do not need it.
+  allowExternalEgress: false
+
 # Shared storage for enterprise workflows requiring data sharing between pods
 sharedStorage:
   enabled: false