Allow the user to set the level of netpol permissiveness

[zivnevo]

Some options:

• Only allow connections identified by the algorithm
• If a service exists, but no incoming connections detected, open the service to the whole namespace
• If a service exists, but no incoming connections detected, open the service to the whole cluster
• If a service exists, open the service to the whole cluster

[zivnevo]

Proposed format:

# The provided deployment catalogue in namespace sock-shop can connect to the provided deployment catalogue-db in the same NS using any protocol
sock-shop/deployment/catalogue -> sock-shop/deployment/catalogue-db

# The provided deployment orders in NS sock-shop can connect to the provided service catalogue in the same NS using TCP:80
sock-shop/deployment/orders    -> sock-shop/service/catalogue       | TCP:80

# # The provided deployment orders in NS sock-shop can connect to external IPs 59.48.20.0/24 using TCP:443
sock-shop/deployment/orders -> 59.48.20.0/24 | TCP:443

# The deployment catalogue-db in NS sock-shop may receive incoming traffic from all external IPs
0.0.0.0/0 -> sock-shop/deployment/catalogue-db

# Known workloads in NS sock-shop, can connect to known workloads in NS sock-shop, named session-db
sock-shop/_/_ -> sock-shop/_/session-db

# All known workloads (in any NS), can connect to known workloads named session-db (in any NS)
_/_/_ -> _/_/session-db

# All workloads in NS ns1, can connect to the deployment shipping in NS sock-shop
ns1/*/* -> sock-shop/deployment/shipping

# All workloads in the cluster, can connect to the deployment catalogue-db in NS sock-shop
*/*/* -> sock-shop/deployment/orders


# ns1/*/session-db # not supported
# ns1/deployment/* # not supported
# */deployment/*   # not supported
# */deployment/session-db # not supported