feat(helm): NetworkPolicy default-deny + Pod Security Standards "restricted" baseline (ADR-0930)

[lusoris]

Summary

Updates deploy/helm/vmafx/ so the chart's default render satisfies the
Kubernetes pod-security.kubernetes.io/enforce=restricted admission profile
out of the box, and adds an opt-in NetworkPolicy bundle for clusters with a
NetworkPolicy-aware CNI.

• Aligns UID/GID to the distroless nonroot baked into every production image (65532, ADR-0878), eliminates pod/container drift on runAsNonRoot + seccomp, and refactors operator-deployment.yaml and tests/test-connection.yaml to inherit security blocks from .Values.
• Ships templates/networkpolicy.yaml with a default-deny baseline plus narrow allow-rules (controller -> node gRPC, node -> object store HTTPS, operator -> apiserver, DNS, in-namespace HTTP ingress), all gated by networkPolicy.enabled=false so existing installs are unaffected.
• Surfaces the PSA namespace-labelling command in NOTES.txt and documents the full NetworkPolicy matrix in docs/development/k8s-deployment.md.

Type

• feat — new feature (NetworkPolicy template + values block)
• chore / build — Helm template hardening

Checklist

• Commits follow Conventional Commits (feat(helm): prefix; commit-msg hook passed).
• helm lint deploy/helm/vmafx --strict green; helm template ... | kubectl create --dry-run=client accepts every emitted resource.
• No SIMD/GPU code path touched.
• No new .c / .cpp / .cu / .h / .hpp files.
• No breaking change at the libvmaf level. Helm values podSecurityContext.runAsUser flips from 65534 to 65532; release note + ADR call out the migration.
• ADR row lives in docs/adr/_index_fragments/0930-helm-networkpolicy-pss.md and the slug is appended to _order.txt; docs/adr/README.md regenerated via scripts/docs/concat-adr-index.sh --write.

Bug-status hygiene (ADR-0165)

• docs/state.md updated — row T-HELM-NETWORKPOLICY-PSS-2026-05-31 added under ## Recently closed.

Netflix golden-data gate (ADR-0024)

• I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests.

Deep-dive deliverables (ADR-0108)

• Research digest — docs/research/0930-helm-networkpolicy-pss.md (before/after surface inventory, PSA restricted requirement table, NetworkPolicy matrix, validation evidence).
• Decision matrix — ## Alternatives considered in docs/adr/0930-helm-networkpolicy-pss.md (6 alternatives weighed: NP default-on, BYO CNI policy, UID 65534, inline security blocks, PSP, seccompProfile.type=Localhost).
• AGENTS.md invariant note — no rebase-sensitive invariants: deploy/helm/vmafx/ is a fork-local directory (Netflix upstream ships no Helm chart) and deploy/ has no AGENTS.md. Touched files: chart templates + values + fork-local docs only.
• Reproducer / smoke-test command — pasted below under "Reproducer".
• CHANGELOG fragment — changelog.d/added/helm-networkpolicy-pss.md.
• Rebase note — entry ADR-0930 — Helm NetworkPolicy + PSS baseline — 2026-05-31 added to docs/rebase-notes.md (no rebase impact: REASON — fork-local chart, fork-local docs only).

Reproducer

# Default render — no NetworkPolicy resources, pods pass PSA `restricted`.
helm lint deploy/helm/vmafx --strict

# Full render with operator + node + NetworkPolicy enabled —
# 8 NetworkPolicy resources + every workload kind validates clean.
helm template deploy/helm/vmafx \
  --set networkPolicy.enabled=true \
  --set operator.enabled=true \
  --set node.enabled=true \
  --set node.image.repository=ghcr.io/vmafx/vmafx-node \
  | kubectl create --dry-run=client --validate=false -f -

# Expected: 8 networkpolicy.networking.k8s.io/... created (dry run)
#   release-name-vmafx-default-deny
#   release-name-vmafx-operator-default-deny
#   release-name-vmafx-node-default-deny
#   release-name-vmafx-allow-http-ingress
#   release-name-vmafx-allow-controller-to-node
#   release-name-vmafx-allow-node-egress-object-store
#   release-name-vmafx-allow-operator-to-apiserver
#   release-name-vmafx-allow-dns-egress

# Verify no NetworkPolicies render by default:
helm template deploy/helm/vmafx | grep -c NetworkPolicy  # -> 0

ADR

• New: ADR-0930 — Helm chart NetworkPolicy default-deny + Pod Security Standards "restricted" baseline
• Citing: ADR-0699 — Helm chart, ADR-0709 — Phase 4b platform, ADR-0719 — rclone integration, ADR-0878 — Trivy DS-0002 (distroless nonroot UID 65532)

Migration

Installs that hard-coded --set podSecurityContext.runAsUser=65534 should
drop the override or flip it to 65532 to keep file ownership consistent
with the distroless nonroot baked into every production image since
ADR-0878. No other override surface changes.

Known follow-ups

• When a dedicated vmafx-controller Service ships, retarget the
  controller-to-node allow-rule from "any pod in namespace" to
  component=controller.
• Track Kubernetes appArmorProfile (1.31+) for per-backend AppArmor.
• Tighten nodeEgressObjectStore.cidrs in the production values overlay
  once a VPC topology guide ships.

🤖 Generated with Claude Code

[lusoris]

Superseded by master after the 117-PR merge marathon of 2026-05-31. Diff-extract produced empty rebase (AHEAD=0), indicating intended content already landed via sibling merges.