feat(helm): allow to configure exposed app container port

Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>

functions/kubernetes/charts/shuffle/templates/orborus/orborus-dpl.yaml

@@ -88,6 +88,8 @@ spec:
               value: "true"
             - name: SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME
               value: {{ include "shuffle.worker.serviceAccount.name" . }}
+            - name: SHUFFLE_APP_EXPOSED_PORT
+              value: {{ .Values.app.exposedContainerPort | quote }}
             - name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME
               value: {{ include "shuffle.app.serviceAccount.name" . }}
             {{- if .Values.orborus.extraEnvVars }}

functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml

@@ -44,17 +44,18 @@ spec:
     {{- end }}
     {{- end }}
   ingress:
-    {{- if .Values.app.networkPolicy.allowExternal }}
-    - {}
-    {{- else }}
-    # Allow access from workers. Apps will typicaly use port 80/TCP, but this is not enforced.
-    - from:
+    - ports:
+        - port: {{ .Values.app.exposedContainerPort }}
+          protocol: TCP
+      {{- if not .Values.app.networkPolicy.allowExternal }}
+      # Allow traffic from workers
+      from:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: {{ .Release.Namespace }}
           podSelector:
             matchLabels: {{ include "shuffle.worker.matchLabels" . | nindent 14 }}
-    {{- end }}
+      {{- end }}
     {{- if .Values.app.networkPolicy.extraIngress }}
     {{- include "common.tplvalues.render" ( dict "value" .Values.app.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
     {{- end }}