kyverno: Introduce system namespace label

bootstrap/kyverno/namespace.yaml

@@ -4,3 +4,4 @@ metadata:
   name: kyverno
   labels:
     name: kyverno
+    kyverno.shivering-isles.com/class: "system"

infrastructure/cert-manager/namespace.yaml

@@ -4,3 +4,4 @@ metadata:
   name: cert-manager
   labels:
     name: cert-manager
+    kyverno.shivering-isles.com/class: "system"

infrastructure/ingress-nginx/namespace.yaml

@@ -4,3 +4,4 @@ metadata:
   name: nginx-system
   labels:
     name: nginx-system
+    kyverno.shivering-isles.com/class: "system" 

infrastructure/kyverno/allow-from-same-namespace-network-policies.yaml

@@ -9,21 +9,24 @@ spec:
       resources:
         kinds:
         - Namespace
+      selector:
+        matchExpressions:
+          - {key: kyverno.shivering-isles.com/class operator: NotIn, values: [system]}
     exclude:
       resources:
         namespaces:
         - '*-system'
         - default
         - kube-public
-        - kyverno
+        - tigera-operator
     generate:
-      apiVersion: networking.k8s.io/v1
       kind: NetworkPolicy
-      metadata:
-        name: allow-from-same-namespace-managed
-        namespace: "{{request.object.metadata.name}}"
-      spec:
-        podSelector: {}
-        ingress:
-        - from:
-          - podSelector: {}
+      name: allow-from-same-namespace-managed
+      namespace: "{{request.object.metadata.name}}"
+      data:
+        apiVersion: networking.k8s.io/v1
+        spec:
+          podSelector: {}
+          ingress:
+          - from:
+            - podSelector: {}

infrastructure/postgres/namespace.yaml

@@ -4,3 +4,4 @@ metadata:
   name: zalando-postgres
   labels:
     name: zalando-postgres
+    kyverno.shivering-isles.com/class: "system"

infrastructure/prometheus/namespace.yaml

@@ -4,3 +4,4 @@ metadata:
   name: monitoring
   labels:
     name: monitoring
+    kyverno.shivering-isles.com/class: "system"

infrastructure/rook/namespace.yaml

@@ -4,3 +4,4 @@ metadata:
   name: rook-ceph
   labels:
     name: rook-ceph
+    kyverno.shivering-isles.com/class: "system"