From 6da9484fa3455c70ed7d5bf551fda41eaf6bdb95 Mon Sep 17 00:00:00 2001
From: Kosmos <kosmos@vhaudiquet.fr>
Date: Mon, 24 Aug 2026 19:51:04 +0000
Subject: [PATCH] openclaw: add egress NetworkPolicy for Radicale CalDAV

Allow the openclaw pod to reach the Radicale CalDAV/CardDAV server
(namespace: radicale, port 5232) so Kosmos can read/write Valentin's
calendar via the in-cluster service. Mirrors networkpolicy-mail-egress.yaml.

Workaround for spec.networkPolicy.additionalEgress not being in the CRD
bundled with operator chart 0.39.0 yet (silently pruned).
---
 .../personal/openclaw/kustomization.yaml      |  1 +
 .../networkpolicy-radicale-egress.yaml        | 25 +++++++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100644 kubernetes/personal/openclaw/networkpolicy-radicale-egress.yaml

diff --git a/kubernetes/personal/openclaw/kustomization.yaml b/kubernetes/personal/openclaw/kustomization.yaml
index c6dc919..87ed777 100644
--- a/kubernetes/personal/openclaw/kustomization.yaml
+++ b/kubernetes/personal/openclaw/kustomization.yaml
@@ -6,3 +6,4 @@ resources:
   - openclaw-secrets.yaml
   - networkpolicy.yaml
   - networkpolicy-mail-egress.yaml
+  - networkpolicy-radicale-egress.yaml
diff --git a/kubernetes/personal/openclaw/networkpolicy-radicale-egress.yaml b/kubernetes/personal/openclaw/networkpolicy-radicale-egress.yaml
new file mode 100644
index 0000000..d2f210b
--- /dev/null
+++ b/kubernetes/personal/openclaw/networkpolicy-radicale-egress.yaml
@@ -0,0 +1,25 @@
+# Supplementary egress policy: the operator's managed default-deny NetworkPolicy
+# only allows DNS + TCP 443 outbound, which blocks HTTP/CalDAV to Radicale.
+# The CR field spec.networkPolicy.additionalEgress would be the native fix,
+# but it is not in the CRD bundled with chart 0.39.0 yet (silently pruned).
+# Revisit after upgrading the operator.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: openclaw-radicale-egress
+  namespace: openclaw
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: openclaw
+      app.kubernetes.io/name: openclaw
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: radicale
+      ports:
+        - port: 5232
+          protocol: TCP
\ No newline at end of file