Enforce default deny for calico-system

[pasanw]

Description

Renders a default deny in the calico-system namespace. This change also fixes issues with NodeLocal DNSCache through the inclusion of calico-system in the Tigera namespace selector.

Change was tested in a MCM setup with NodeLocal DNSCache and L7 logging enabled (for CSI validation) in both management and managed clusters.

The following calico components are in the calico-system namespace and were tested*:

• kube-controllers: flows are policed, existing policy needed an additional ingress rule based on flow logs.
• es-kube-controllers: flows are policed, no new rules required based on flow logs.
• CSI daemonset: does not require networking (driver communicates with kubelet via UDS, also confirmed no flows in flow logs)
• Windows upgrader daemon set: not tested*, but appears to not require networking to install/upgrade.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.