Fix connection from within notebooks to the notebooks public endpoint

The problem has been on clusters with public IP addresses on the nodes. The
added policy will explicitly allow connecting to cluster ingress service.

Needed for testing from within notebooks and for collaborative feature.

cesnet-central/deployments/fullhub.yaml

@@ -39,6 +39,15 @@ singleuser:
     limit: 2
     guarantee: .02
   defaultUrl: "/lab"
+  networkPolicy:
+    egress:
+      - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          serviceSelector:
+            matchLabels:
+              k8s-app: cluster-ingress
   image:
     name: eginotebooks/single-user-eosc
     tag: "sha-dea4fa2"

common/deployments/hub-production.yaml

@@ -39,6 +39,15 @@ singleuser:
     limit: 2
     guarantee: .2
   defaultUrl: "/lab"
+  networkPolicy:
+    egress:
+      - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          serviceSelector:
+            matchLabels:
+              k8s-app: cluster-ingress
   image:
     name: eginotebooks/single-user-eosc
     tag: "sha-dea4fa2"

common/deployments/hub-staging.yaml

@@ -39,6 +39,15 @@ singleuser:
     limit: 2
     guarantee: .2
   defaultUrl: "/lab"
+  networkPolicy:
+    egress:
+      - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          serviceSelector:
+            matchLabels:
+              k8s-app: cluster-ingress
   image:
     name: eginotebooks/single-user-eosc
     tag: "sha-dea4fa2"

testing/deployments/hub.yaml

@@ -40,6 +40,15 @@ singleuser:
     limit: 2
     guarantee: .2
   defaultUrl: "/lab"
+  networkPolicy:
+    egress:
+      - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          serviceSelector:
+            matchLabels:
+              k8s-app: cluster-ingress
   image:
     name: eginotebooks/single-user-eosc
     tag: "sha-dea4fa2"