Add NetworkPolicy for accessing the Seed Kubernetes API

[embik]

What this PR does / why we need it:

In #12450, I moved the etcd-running check from a plain script to etcd-launcher. However, etcd-launcher needs to fetch information from the Seed's Kubernetes API (mainly from the Cluster object).

Since the kube-apiserver Pod is locked down by the NetworkPolicies feature that is on by default, this can cause problems with i/o timeouts caused by NetworkPolicies blocking access.

This PR discovers IPs and FQDNs in the EndpointSlices for the kubernetes.default service and creates a corresponding NetworkPolicy object in the user cluster namespace so that the etcd-running InitContainer can successfully fetch information to discover the etcd cluster.

Which issue(s) this PR fixes:

Fixes #

What type of PR is this?
/kind regression

Special notes for your reviewer:

Does this PR introduce a user-facing change? Then add your Release Note here:

Create a NetworkPolicy for user cluster kube-apiserver to access the Seed Kubernetes API

Documentation:

NONE

[embik]

/retest

[xrstf]

/approve

[kubermatic-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: embik, xrstf

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/controller/OWNERS [embik,xrstf]
• pkg/resources/OWNERS [embik,xrstf]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kubermatic-bot]

LGTM label has been added.

Git tree hash: b3fbc07a8a1e5e3a120a12af9457fb6a8198db26