In packages/apps/tenant/templates/networkpolicy.yaml around lines 23 to 27, the
endpointSelector is matching labels but the VM/VM template currently sets
policy.cozystack.io/allow-external-communication as an annotation, so the
selector never excludes those VMs; update the VM template (vm.yaml) to set
policy.cozystack.io/allow-external-communication as a pod/VM label (preferred)
and keep the endpointSelector.matchExpressions as-is, OR if you cannot change
vm.yaml, replace the selector logic to a mechanism that matches annotations
(noting Cilium generally matches labels) to ensure the “false” value takes
effect; additionally change the selector semantics to require explicit opt-in
(e.g., use In ["true"]) so unlabeled pods are denied by default; apply this
change together with the vm.yaml update.

In packages/apps/virtual-machine/templates/service.yaml around lines 31 to 53,
the CiliumNetworkPolicy renders an empty toPorts block when
.Values.externalMethod == "PortList" but .Values.externalPorts is empty and also
only applies ports to ingress; update the template to (1) guard the toPorts
section with a length check so it is emitted only when .Values.externalPorts |
len > 0 (avoiding an invalid empty toPorts), and (2) mirror the same guarded
toPorts block under egress so outbound traffic is restricted when using
PortList; ensure YAML indentation and templating whitespace are preserved.

In packages/apps/virtual-machine/templates/vm.yaml around lines 65-66 (and also
apply same change to lines 67-69), the key
policy.cozystack.io/allow-external-communication is placed under annotations but
the tenant NetworkPolicy selects on a label; move this key from annotations into
the metadata.labels section (remove it from annotations) and ensure its value
remains "false" so the NetworkPolicy selector will match correctly.

In packages/apps/vm-instance/templates/service.yaml around lines 31 to 53, the
CiliumNetworkPolicy currently emits an empty toPorts block when
.Values.externalMethod == "PortList" and does not restrict egress ports; change
the conditional so toPorts is rendered only when .Values.externalMethod ==
"PortList" AND .Values.externalPorts is non-empty, and when using "PortList"
also add a matching egress toPorts section that enumerates the same
.Values.externalPorts to tighten egress; implement this by wrapping the toPorts
block in an additional if (len .Values.externalPorts | gt 0) and adding a
corresponding egress toPorts with the same port range under the egress stanza
when .Values.externalMethod == "PortList".

In scripts/migrations/18 around where appVersion literals are defined (update
the two entries referenced by packages/apps/versions_map line 168), change the
appVersion for the virtualmachines migration from "1.14.0" to "0.14.0" and
change the appVersion for the vminstances migration from "1.12.0" to "0.12.0" so
they match the HEAD markers in packages/apps/versions_map; locate the two
appVersion string literals in that migration file and replace them with the new
values, run tests or lint to ensure no formatting issues.

In scripts/migrations/18 around lines 1 to 3, enable strict mode and add a
preflight check for kubectl: add a shell strictness setting (use set -eu to fail
on errors and unset variables but do not add pipefail), then verify kubectl is
available (use command -v kubectl >/dev/null 2>&1 and exit with a clear error
message if missing) so the script fails fast on unset vars and missing kubectl
while remaining /bin/sh compatible.

In scripts/migrations/18 around lines 5 to 7, the kubectl loop can consume the
literal "No resources found" and mis-parse output; change the kubectl output to
use -o jsonpath to emit only namespace/name pairs (and nothing when empty), pipe
into while read -r to avoid backslash mangling, and ensure the script fails fast
on any patch error (e.g., check kubectl patch exit status or set -e) so a failed
patch aborts the migration; also skip iterations when either NAMESPACE or NAME
is empty.

In scripts/migrations/18 around lines 10 to 12, the virtualmachines loop uses a
simple kubectl get piped into while read which is brittle; update it to mirror
the tenants pattern by using kubectl get with a jsonpath that emits namespace
and name per line, read each line with IFS= read -r NAMESPACE NAME (or use read
-r -d '' if tenants uses NUL), and ensure the script fails fast by enabling set
-euo pipefail (or explicitly check and exit on kubectl/patch errors). Replace
the current pipe-while with the jsonpath + read -r pattern and add fail-fast
behavior so any kubectl failure aborts the migration.

In scripts/migrations/18 around lines 10 to 12, the migration patches use
incorrect appVersion literals "1.14.0" and "1.12.0"; change those two
occurrences to the correct 0.x values used by the charts — replace "1.14.0" with
"0.14.0" for virtual-machine and replace "1.12.0" with "0.12.0" for vm-instance
so the patch uses the correct appVersion strings.

In scripts/migrations/18 around lines 13 to 15, the vm-instance loop should be
made robust like the tenants loop: replace the get command output with a
jsonpath that emits "namespace name" pairs (e.g. kubectl get ... -A -o
jsonpath='{range .items[*]}{.metadata.namespace}{"
"}{.metadata.name}{"\n"}{end}') piped into while read -r NAMESPACE NAME; do ...;
done, and inside the loop check the kubectl patch exit status and exit the
script with a non-zero code if the patch fails (e.g. if ! kubectl patch ...;
then echo "patch failed for $NAMESPACE/$NAME" >&2; exit 1; fi).