Test serverless with strict central network policies

[kwiatekus]

Description

Reviewer should read this first

Changes proposed in this pull request:

• apply extra fixture with strict network policies in integration tests
• label operators with networking.kyma-project.io/to-apiserver: allowed
• label webhook (legacy) with networking.kyma-project.io/from-seed: allowed

Related issue(s)
#1530

[kwiatekus]

TODO: enable policy for jobs to push into serverless-docker-registry.kyma-system.svc.cluster.local:5000

Tests show that function build job fails with

error checking push permissions -- make sure you entered the correct tag name, and that you are authenticated correctly, and try again: checking push permission for "serverless-docker-registry.kyma-system.svc.cluster.local:5000/default-fn:eb2f4eeb161602519b3f5510c262c3372f6c8bcedabbcc40dcc72c92532fda77": creating push check transport for serverless-docker-registry.kyma-system.svc.cluster.local:5000 failed: Get "https://serverless-docker-registry.kyma-system.svc.cluster.local:5000/v2/": dial tcp 10.43.172.190:5000: connect: connection refused; Get "http://serverless-docker-registry.kyma-system.svc.cluster.local:5000/v2/": dial tcp 10.43.172.190:5000: connect: connection refused

[kwiatekus]

Serverless needs an egress policy targeting the serverless controller enabling all egress traffic, so that serverless can fetch from git repositories.