NYS2AWS-43 refine controls on netpols & cilium netpols

[RVanhuysseXenit]

cilium netpolls were tied to a 'cni' variable, which was not correct, given that cilium can be chained to other cnis (as is the case for aws)

[gert-glassee]

I do not understand the need for this. Is there a specific need to have cilium network policies disabled when the cni=cilium? or to have them enabled when cni=aws?
In case of dsny isn't it enough to set cni=cilium to get both types of network rules applied?

[RVanhuysseXenit]

We can run it as is, but I think we're setting ourselves up for failure in the future.
Usage of cilium netpols is not tied to usage of the cilium cni, and using the cilium cni does not mean we want to enable the corresponding netpols immediately.

[vierbergenlars]

I think the general.cni value should be removed completely and replaced with networkPolicies.cilium.enabled.

At this point, it only affects if there are cilium network policies enabled or not, and that setting can better be moved to a more explicit networkPolicies.cilium.enabled.

The choice of CNI itself should not really affect any other part of the software, only the existence of cilium network policies.

[thijslemmens]

how is this different from general.networkPolicies.enabled if cni is cilium?
I think this is only disabling the Cilium specific ones? Why would you use cilium as general.cni and disable the cilium policies?