Initial proposal of "allow-from-router" NetworkPolicy

[danwinship]

For SDN-1340. Proposes changes to ovn-kubernetes and CNO (and maybe openshift-sdn, and maybe maybe cluster-ingress-operator) to make it easier for customers to create policies to allow traffic from routers, regardless of network plugin and router configuration.

/cc @trozet
for ovn-kubernetes thoughts
/cc @Miciah
for router thoughts (feel free to hand off to someone else if I picked badly)
/cc @squeed @knobunc @dcbw
for general thoughts

[abhat]

Overall it makes sense to me. The implementation details for ovn-k need to be figured out in the context of the changes we are making to the topology to avoid multiple SNATs (if that's at all relevant here, I don't think it is, but I may be missing some nuances from the recent discussions).

[squeed]

I think this make sense, and is ripe for implementation.

/lgtm
(someone else needs to approve).

[russellb]

/approve

Nicely written enhancement, thanks

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: russellb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [russellb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[danwinship]

/retest

[russellb]

/lgtm