This patch fixes the unexpected change in bahaviour. When using a
namespace selector that selects one or multiple namespaces, there will
be two labels. `namespace`, where the podMonitor lives, and
`exported_namespace`, where the target pods is. When using a podMonitor
that scans any namespace, there is only a `namespace` label.

If no namespace selector is sepcified, it will only search in the
current namespace. This is not intended for this podMonitor, therefore a
config to explicitly search all namespaces is required.

References:
https://github.com/prometheus-operator/prometheus-operator/blob/615162d6d35314f94cb9c69f51bc47d62b81f154/Documentation/api.md#namespaceselector

When adjusting the variables, some of the queries broke. This patch
fixes the queries and should resolve the currently empty dashboard
issue.

This renames some labels used in queries to match the results from the
podMonitor instead of relying on additional labels set by the exporter.

This patch moves the setup of the sidecar containers and the podMonitor
to the `postgres-system` namespace, providing monitoring for all
namespaces, not just for some. Reduces the copy-paste work and should
allow nice insights into all postgres clusters.

This patch adds a sashboard to monitor postgresql instances on the
cluster. Currently the instance need to specify the sidecar container
themselves along with a pod monitor. See matrix for reference.

References:
https://git.shivering-isles.com/shivering-isles/infrastructure-gitops/-/blob/3c6b1410b0e0edfa1d331f96e1a8836b33590d57/apps/base/matrix/database.yaml#L31-76

The upgrade from postgresql-operator 1.7.1 to 1.8.0 failed due to
missing settings for CRD upgrades. This patch fixes it, but explicitly
configuring flux to allow CRD upgrades.

This patch makes sure that a PostgreSQL cluster doesn't end up on a single
node. This is done by defaulting to a pod anti-affinity based on the
kubernetes hostname label, that should make sure, that all stateful sets
are distributed properly.

This patch fulfils the previous's promises and puts the right port
string in place. 

This patch puts the port definitions into the right place and uses the
key `port` instead of `containerPort` as expected by NetworkPolicy
objects.

This patch thightens up the network policy that is deployed to all
namespaces, to limit access to the postgres-operator managed pods.

This patch enables read-only filesystems and no-new-privileges for all
postgres databases managed by the zalando postgres operator.

This patch should allow to automate network policies better, by adding a
label with the namespace name to the postgres namespace

This patch enables the namespace-configuration-operator, which allows
to deploy object template into all namespaces matching a selector,
making it very useful for management of basic namespace infrastructure.
It also enforces the existence of these objects.