[lbarrosby]

Description of the change

The NetworkPolicy ingress rule used service.port and metrics.service.port. NetworkPolicy ports are matched against the port on the pod (after the Service translates it), so they need to be the container ports. This switches the rule to containerPorts.http and containerPorts.metrics, with the same 8080/8081 fallbacks the Deployment uses.

Benefits

With networkPolicy.enabled: true:

• service.port: 80 (or any Service port other than 8080) rendered port: 80 in the policy, so traffic to the controller on 8080 was dropped and kubeseal could not reach it.
• Changing containerPorts.http/containerPorts.metrics was never reflected in the policy.

Possible drawbacks

None expected. With default values the rendered policy is identical (8080/8081 either way).

Applicable issues

• Follow-up to NetworkPolicy ingress port is not configurable #1220 / Fix networkpolicy port + add egress #1243, which made the port configurable but picked the Service port.

Additional information

Checked with helm template:

• defaults, egress enabled, and policy disabled render identically before and after
• service.port=80,metrics.service.port=9000: policy had 80/9000, now 8080/8081 (matching the Deployment's containerPorts)
• containerPorts.http=9090,containerPorts.metrics=9091: policy now has 9090/9091

helm lint and kubeconform -strict pass.