Bugfix: fix frontend netpol egress (#5464)

* add istiod pod and dns queries to allowed egress

* enable netpols in kustomization

* remove frontend to api path in netpols

k8s/apps/bases/api/kustomization.yaml

@@ -6,5 +6,5 @@ resources:
   - deployment.yaml
   - service.yaml
   - virtual-service.yaml
-#  - network-policy.yaml
+  - network-policy.yaml
   - domain-cleanup-cronjob.yaml

k8s/apps/bases/api/network-policy.yaml

@@ -17,9 +17,3 @@ spec:
           namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: istio-system
-        - podSelector:
-            matchLabels:
-              app: tracker-frontend
-          namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: frontend

k8s/apps/bases/frontend/kustomization.yaml

@@ -6,6 +6,6 @@ resources:
   - deployment.yaml
   - service.yaml
   - virtual-service.yaml
-#  - network-policy.yaml
+  - network-policy.yaml
   - maintenance-deployment.yaml
   - maintenance-service.yaml

k8s/apps/bases/frontend/network-policy.yaml

@@ -22,7 +22,13 @@ spec:
     - to:
         - podSelector:
             matchLabels:
-              app: tracker-api
+              app: istiod
           namespaceSelector:
             matchLabels:
-              kubernetes.io/metadata.name: api
+              kubernetes.io/metadata.name: istio-system
+    # DNS queries also need to be allowed
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53