From 956e110cc6f91ded8a4067116d65aae0d1ca2974 Mon Sep 17 00:00:00 2001
From: codens-agent <agent@codens.ai>
Date: Sun, 28 Jun 2026 09:46:15 +0000
Subject: [PATCH] chore: Add helm/templates/networkpolicy.yaml (DB/Redis/MinIO
 traffic restriction) and helm/templates/servicemonitor.yaml (Prometheus
 scraping)

---
 helm/templates/networkpolicy.yaml  | 73 ++++++++++++++++++++++++++++++
 helm/templates/servicemonitor.yaml | 20 ++++++++
 2 files changed, 93 insertions(+)
 create mode 100644 helm/templates/networkpolicy.yaml
 create mode 100644 helm/templates/servicemonitor.yaml

diff --git a/helm/templates/networkpolicy.yaml b/helm/templates/networkpolicy.yaml
new file mode 100644
index 00000000..33a0e06d
--- /dev/null
+++ b/helm/templates/networkpolicy.yaml
@@ -0,0 +1,73 @@
+{{- if .Values.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "open-git.fullname" . }}-backend-egress
+  labels:
+    {{- include "open-git.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "open-git.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: backend
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: postgresql
+              app.kubernetes.io/instance: {{ .Release.Name }}
+      ports:
+        - protocol: TCP
+          port: 5432
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: redis
+              app.kubernetes.io/instance: {{ .Release.Name }}
+      ports:
+        - protocol: TCP
+          port: 6379
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: minio
+              app.kubernetes.io/instance: {{ .Release.Name }}
+      ports:
+        - protocol: TCP
+          port: 9000
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "open-git.fullname" . }}-postgresql-ingress
+  labels:
+    {{- include "open-git.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: postgresql
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- include "open-git.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: backend
+        - podSelector:
+            matchLabels:
+              {{- include "open-git.selectorLabels" . | nindent 14 }}
+              app.kubernetes.io/component: worker
+      ports:
+        - protocol: TCP
+          port: 5432
+{{- end }}
diff --git a/helm/templates/servicemonitor.yaml b/helm/templates/servicemonitor.yaml
new file mode 100644
index 00000000..0c7e27fa
--- /dev/null
+++ b/helm/templates/servicemonitor.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "open-git.fullname" . }}-backend
+  labels:
+    {{- include "open-git.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "open-git.name" . }}
+      app.kubernetes.io/component: backend
+  endpoints:
+    - port: http
+      path: /metrics
+      interval: 30s
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+{{- end }}