Add optional NetworkPolicy templates for namespace isolation

[p-rog]

Adds a default-deny NetworkPolicy and per-pod allow rule templates for keycloak, postgresql-db, and rhbk-operator pods. All disabled by default — patterns opt in via values. The RHBK operator-managed ingress policy is left untouched; the keycloak template covers egress only.

[p-rog]

@minmzzhang @sabre1041 @mhjacks can you please review this and merge if no objections?

It's a part of ZTVP network policies improvements and overall VP project improvements.

[mlorenzofr]

LGTM

PTAL to the documentation, in case we want to add the egress rule for the operator

[mlorenzofr]

I'm not including it as a change in the review, because we still need to make this chart more generic and it will be something specific to layered-zero-trust, but in the NetworkPolicy we will have to add an egress rule so that the realm import job (label: job-name=ztvp-realm-import) can connect to the database

[p-rog]

I'm not including it as a change in the review, because we still need to make this chart more generic and it will be something specific to layered-zero-trust, but in the NetworkPolicy we will have to add an egress rule so that the realm import job (label: job-name=ztvp-realm-import) can connect to the database

The realm import job runs at sync-wave 41 (same as Keycloak), and on a fresh deployment, it runs during initial setup before network policies are applied (since policies come via extraValueFiles which are applied at the same sync-wave). But in case of any re-sync, you are right, we need to add it to the ZTVP keycloak network policies.

[p-rog]

I'm not including it as a change in the review, because we still need to make this chart more generic and it will be something specific to layered-zero-trust, but in the NetworkPolicy we will have to add an egress rule so that the realm import job (label: job-name=ztvp-realm-import) can connect to the database

The realm import job runs at sync-wave 41 (same as Keycloak), and on a fresh deployment, it runs during initial setup before network policies are applied (since policies come via extraValueFiles which are applied at the same sync-wave). But in case of any re-sync, you are right, we need to add it to the ZTVP keycloak network policies.

@mlorenzofr I just added a generic networkPolicy.realmImport section to the rhbk-chart with a configurable pod selector label and egress rules via networkPolicy.realmImport.
In the layered-zero-trust pattern there will be exact NetworkPolicy rules.