[Rylon]

Summary

With fileServer.s3.enabled, the file server's NetworkPolicy doesn't allow egress to S3 on port 443, or to STS for IRSA, so every upload and download fails when S3 is enabled. The policy only seems to open egress to MinIO, when minio.enabled is true.

Similar to the networkPolicy.redis.externalCIDRs policy, we default to allowing egress to any destination on 443, as standard NetworkPolicy cannot target the S3 and STS endpoints by DNS name.

I also added networkPolicy.fileServer.s3CIDRs which can limit egress to certain CIDR ranges if people want that, for example you could restrict to the CIDR range of your S3 and STS VPC endpoints.

This seems like an acceptable change as it matches how we handle the same issue with Redis, and the S3 feature doesn't work without the policy change anyway, but we could also make this "opt-in" so it's explicit instead of implicit?

Testing

• helm template with values-local.yaml renders identically before and after this change.
• With fileServer.s3.enabled=true, the fileServer policy allows egress on 443 to any destination. With s3CIDRs set, we add one rule per CIDR range instead.
• This only applies when fileServer.s3.enabled is true. MinIO installs are unaffected.