ClusterProxy: support declarative access policy

[LuukBlankenstijn]

Currently ClusterProxy registers a proxy peer in Netbird but has no way to declare who should be able to use it. The controller creates a SetupKey with no AutoGroups, so the proxy peer only joins the All group. There is no Netbird side policy auto-created either so a freshly applied ClusterProxy is unreachable until a group + policy are added to Netbird by some other way. I'm trying to use this with Flux and would love to have the controller to create a policy.

I would propose something similar as NBResource by adding the following to ClusterProxy.

# +optional
policySourceGroups: []GroupReference
# +optional
policyFriendlyName: string

The behavior when policySourceGroups is set will then be:

1. Create (or reconsile) a group named `clusterproxy- owner by the cluster proxy. This is the destination group for the proxy peer.
2. Patch the setup key to add this group to the AutoGroups array
3. Resolve policySourceGroups to NB group IDs (via netbirdutil.GetGroupIDs) and create an NBPolicy with sources = resolved IDs, destinations = [], protocol = tcp, ports = [443].
4. Gate on the existing AllowAutomaticPolicyCreation flag, same as NBResource.

If this sounds good, I would be willing to implement this

[phillebaba]

A group reference was added in #297 and was a part of the latest release. That should fix the initial problems when groups and policies already exist. As you have seen #308 would enable configuration of policies, which means that everything could in theory be managed in a Kubernetes cluster.

I am personally against automatic resource creation for policy and groups. While it may make things simpler in the short term it adds a lot of complexity in the operator. Along with the fact that it hides this complexity from new users.

[LuukBlankenstijn]

To be honest i agree with this reasoning. With the ability to reference an existing group I don't have to manually create the link, which is enough for my usecase.