Adding service.externalTrafficPolicy to the Helm chart

[Phil Gran (philgran)]

Changes

• values.yaml — new service.externalTrafficPolicy value (default ""), with comments explaining when to use it and its trade-off.
• templates/service.yaml — renders externalTrafficPolicy in the Service spec, but only when the value is set and service.type is NodePort or LoadBalancer (the Kubernetes API rejects the field on ClusterIP services).
• README.md — documented the new parameter in the configuration table.
• Chart.yaml — bumped chart version 0.7.0 → 0.8.0.

Behavior before

The Service never set externalTrafficPolicy, so Kubernetes applied its default of Cluster. With an external passthrough load balancer (e.g. GKE Dataplane v2), traffic landing on a node without a firewall pod is SNATed when forwarded to another node, so the firewall sees a link-local address (e.g. 169.254.4.6) instead of the real client IP. The only workaround was patching the Service out-of-band, which the next helm upgrade would revert.

Behavior after

Unset (default), rendering is unchanged and existing deployments are unaffected. Setting service.externalTrafficPolicy: Local with a LoadBalancer or NodePort Service makes the load balancer route only to nodes running a firewall pod, eliminating the SNAT hop and preserving client source IPs. If set while service.type is ClusterIP, the field is silently omitted rather than producing an invalid manifest.

Verified with helm lint and helm template across default, LoadBalancer, NodePort, and ClusterIP configurations.