apps/tenant renders Cilium policies unguarded, breaking installs without Cilium (isp-hosted) #3387

Symptom

On any Cozystack install whose CNI is not Cilium — in particular the isp-hosted platform variant — the tenant-root HelmRelease fails to render with no matches for kind "CiliumNetworkPolicy" in version "cilium.io/v2". Because cozystack.backupstrategy-controller declares dependsOn: cozystack.cozystack-basics, the failure cascades and the platform never fully converges.

Mechanism

packages/apps/tenant/templates/networkpolicy.yaml renders 14 cilium.io/v2 objects with no capability guard. The only conditionals in that file gate on .Values.ingress, .Values.etcd and .Values.monitoring; there is no .Capabilities.APIVersions.Has check anywhere in it.

packages/system/cozystack-basics/templates/tenant-root.yaml installs the root tenant from exactly this chart (chartRef.name: cozystack-tenant-application-default-tenant). On the isp-hosted variant, templates/bundles/system.yaml selects the noop variant of cozystack.networking, and packages/core/platform/sources/networking.yaml defines that variant as components: [] — so Cilium is never installed and the cilium.io/v2 CRDs never exist.

The correct pattern already exists elsewhere in the tree: packages/system/monitoring-agents/templates/networkpolicy.yaml opens with {{- if .Capabilities.APIVersions.Has "cilium.io/v2/CiliumClusterwideNetworkPolicy" }}.

This has been latent rather than visible because the isp-hosted preset shipped with its system bundle disabled and therefore never installed cozystack-basics at all (#3376). Restoring that bundle exposes this.

Suggested fix

Guard the Cilium objects the same way monitoring-agents does, or introduce an explicit toggle for CNI-backed tenant policies.

Worth deciding deliberately rather than copying the monitoring-agents pattern by reflex: these policies implement tenant network isolation, so silently skipping them on a non-Cilium cluster leaves tenants without the isolation an operator would reasonably assume is present. An explicit value (defaulting to autodetect, with the ability to force-require) may be safer than a silent skip, and the chosen behaviour should be documented for the hosted topology.

Notes

Found while reviewing the fix for #3376. That PR deliberately does not address this — it restores the dependency closure only.