Introduce NetworkPolicy for core component workloads.

[RFC](https://docs.google.com/document/d/10MZ4t2XgRydGa-NRs4uXFNVoTHH9SPKd7mV9IwT_i7M/edit?usp=sharing)

Signed-off-by: Per G. da Silva <[email protected]>

Author: anik120

deploy/chart/templates/0000_50_olm_01-networkpolicies.yaml

@@ -0,0 +1,102 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: default-deny-all-traffic
+ namespace: {{ .Values.namespace }}
+spec:
+ podSelector: {}
+ policyTypes:
+ - Ingress
+ - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: olm-operator
+ namespace: {{ .Values.namespace }}
+spec:
+ podSelector:
+   matchLabels:
+     app: olm-operator
+ ingress:
+ - ports:
+   - protocol: TCP
+     port: 8080
+ egress:
+ - ports:
+   - protocol: TCP
+     port: 6443  # kube-api service
+   - protocol: TCP
+     port: 53  # DNS
+   - protocol: UDP
+     port: 53  # DNS
+ policyTypes:
+ - Ingress
+ - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: catalog-operator
+ namespace: {{ .Values.namespace }}
+spec:
+ podSelector:
+   matchLabels:
+     app: catalog-operator
+ ingress:
+ - ports:
+   - protocol: TCP
+     port: metrics
+ egress:
+ - ports:
+   - protocol: TCP
+     port: 6443  # kube-api server
+   - protocol: TCP
+     port: 50051  # catalog service
+   - protocol: TCP
+     port: 53  # DNS
+   - protocol: UDP
+     port: 53  # DNS
+ policyTypes:
+ - Ingress
+ - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: packageserver
+ namespace: {{ .Values.namespace }}
+spec:
+ podSelector:
+   matchLabels:
+     app: packageserver
+ ingress:
+ - ports:
+   - protocol: TCP
+     port: {{ .Values.package.service.internalPort }}
+ egress:
+   - ports:
+       - protocol: TCP
+         port: 50051  # catalog service
+       - protocol: TCP
+         port: 53  # DNS
+       - protocol: UDP
+         port: 53  # DNS
+ policyTypes:
+ - Ingress
+ - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-allow-all
+  namespace: {{ .Values.operator_namespace }}
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - {}
+  egress:
+    - {}