This patch adds a broader networkpolicy for system-upgrades namespace,
which should ensure network access within the namespace.

It's the 3rd update of kyverno and each time, things break in minor
version. This is no modi operandi for this setup. Things are supposed to
be stable and solid to work with. Kyverno is too unstable for this
use-case.

This time the installation of the pods failed due to wrong deployment
names. This is nothing we change or adjust.

Further the removal doesn't have any major impact on the platform, since
network policies are already deployed via gitops from the `shared/`
directory.

BREAKING CHANGE: Removing kyverno and related CRDs/APIs.

Turns out, doesn't work as expected.

This reverts commit c11ca652.

Turns out kyverno doesn't like its new version, since the deployments
have the wrong name. Needs some further investigation.

This reverts commit fca00b09.

This patch replaces the registry used to pull calico images with quay.io
since docker hub complaints about rate limits

Currently kyverno gets stuck in 'terminating' state when draining a
node, this is due unavailability for the addmission webhook that it
provides itself.

This patch pushes the replica count up and adds a PDB, which should help
to make sure it doesn't happen again.

To (temporarily) fix the situation you can delete the the
validationwebhookconfigurations for kyverno until the pod is terminated
and rollout kyverno with a higher replica count again.