Kustomize packaging about onepanel

[rushtehrani]

• default network policy to limit access to onepanel namespace - note that this needs to be updated to run in onepanel namespace and we should change the label as well.

Regarding this, we can use app.kubernetes.io/part-of: onepanel for the label:

  - from:
    - namespaceSelector:
        matchLabels:
          app.kubernetes.io/part-of: onepanel

This label will be under commonLabels in kustomization.yaml for all the components in the system.

We may also need to add this NetworkPolicy to all system namespaces.

[rushtehrani]

Also see Istio installer