InfluxDB 3 Enterprise Helm Chart: optional Calico NetworkPolicy template

Problem

Reported by @mdevy-influxdata

The customer couldn't edit the Project Calico v3 CRD via the Helm chart API version field
To work around it, the customer created a separate network policy outside the Helm chart.

The current chart creates standard Kubernetes NetworkPolicy objects:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy

in charts/influxdb3-enterprise/templates/networkpolicy.yaml. Calico supports these policies, so enabling networkPolicy.enabled works when Calico is the cluster’s CNI.

The issue arises when the desired policy uses Calico-native features. Calico’s native CRD has a different API and schema:

apiVersion: projectcalico.org/v3
kind: NetworkPolicy

It is not the same resource with only a different apiVersion. Its policy fields and supported features differ. So changing a Helm/chart API-version setting or switching that YAML line cannot safely convert this chart’s Kubernetes policy into a valid Calico-native policy.

Also, Helm chart apiVersion: v2 in Chart.yaml describes the Helm chart format; it does not control Kubernetes resource APIs. Helm’s API-capability checks can choose between compatible template variants, but this chart has no Calico-native template variant.

The workaround was sensible, but the separate policy is then outside Helm’s lifecycle: Helm upgrades and uninstalls will not modify or remove it.

Proposed solution

If the chart should support Calico-native policy, add a separate optional projectcalico.org/v3 NetworkPolicy template and matching values.

The chart should only create an instance after the CRD already exists.

Keep the modes mutually exclusive:

• Kubernetes mode: render existing networking.k8s.io/v1 policies.
• Calico-native mode: render projectcalico.org/v3 policies.
• Neither: render no policy.

Don’t render both by default: their restrictions combine, which can unintentionally block traffic. Guard the Calico template on the CRD being installed and fail clearly if a user enables it without Calico.

Reference

Project Calico v3 CRD: The native projectcalico.org/v3 CRDs are a recommended modern installation mode for Project Calico that eliminates the legacy aggregation API server by storing Calico resources directly as Kubernetes Custom Resource Definitions (CRDs).