Add NetworkPolicy to allow mediawiki → mariadb traffic (port 3306)

[Copilot]

Cilium was dropping egress TCP/3306 from the mediawiki pod to the mariadb pod despite both being in the same namespace, due to an implicit deny policy with no explicit allow rules in the chart.

Changes

• values.yaml: Add networkPolicy.enabled: true toggle
• deployment.yaml: Add app.kubernetes.io/component: mediawiki label to pod template, enabling NetworkPolicy selectors to distinguish app pods from mariadb pods (which already carry component: mariadb)
• templates/networkpolicy.yaml (new): NetworkPolicy for the mediawiki pod — ingress on 80, egress to mariadb on 3306, egress DNS on 53
• templates/mariadb-networkpolicy.yaml (new): NetworkPolicy for the mariadb pod — ingress from mediawiki on 3306 only, egress DNS on 53
• README.md: Document networkPolicy parameters

Rendered output (internal MariaDB)

# mediawiki pod
egress:
  - to:
      - podSelector:
          matchLabels:
            app.kubernetes.io/component: mariadb
    ports:
      - port: 3306

# mariadb pod
ingress:
  - from:
      - podSelector:
          matchLabels:
            app.kubernetes.io/component: mediawiki
    ports:
      - port: 3306

When using an external database (mariadb.internal.enabled: false), the mariadb NetworkPolicy is skipped and the mediawiki egress rule opens port 3306 to all destinations.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Network policy mediawiki</issue_title>
<issue_description>Au sein du namespace mediawiki, il semble que le flux entre le pod de l'application et la base de donnée mariaDB soit dropped. Au sein d'un même namespace les communications sont autorisées.

low Details
Timestamp
2026-03-18T17:26:38.174Z
Verdict
dropped
Drop reason
Policy denied
Traffic direction
egress
TCP flags
SYN
Source pod
mediawiki-65598b5bc8-5p565
Source identity
677232
Source labels
instance=mediawiki
name=mediawiki
io.cilium.k8s.namespace.labels.ifpen.fr/dev-team=DIFF-F064-CHARTE
io.cilium.k8s.namespace.labels.ifpen.fr/env=PROD
io.cilium.k8s.namespace.labels.ifpen.fr/po-team=DIFF-F064-PLUS
io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mediawiki
io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/name=apps-prod
io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/namespace=flux-system
io.cilium.k8s.policy.cluster=dataprod
io.cilium.k8s.policy.serviceaccount=default
namespace=mediawiki
Source IP
10.245.17.225
Destination pod
mediawiki-mariadb-7c6b9bbb57-x6l2x
Destination identity
668514
Destination labels
component=mariadb
instance=mediawiki
name=mediawiki
io.cilium.k8s.namespace.labels.ifpen.fr/dev-team=DIFF-F064-CHARTE
io.cilium.k8s.namespace.labels.ifpen.fr/env=PROD
io.cilium.k8s.namespace.labels.ifpen.fr/po-team=DIFF-F064-PLUS
io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mediawiki
io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/name=apps-prod
io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/namespace=flux-system
io.cilium.k8s.policy.cluster=dataprod
io.cilium.k8s.policy.serviceaccount=default
namespace=mediawiki
Destination IP
10.245.12.227
Destination port • protocol
3306 • TCP</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Network policy mediawiki #37

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[github-actions]

🏷️ Version RC publiée

Chart RC	3.6.2-rc.2
Version finale prévue	3.6.2
FileSender	3.6

Installation pour test

helm repo update ifpen
helm install filesender-rc ifpen/filesender --version 3.6.2-rc.2

Vérification

helm search repo ifpen/filesender --versions --devel

⚠️ Cette version RC sera remplacée par la version stable 3.6.2 lors du merge.

[velghea]

pourquoi ajouter des network policiy ? par défaut, le namespace est ouvert.