bug: Allow project namespaces to communicate with datashield

[Alwin-K-Thomas]

• Added datashield namespace to the project-isolation CiliumNetworkPolicy template
  • Without this, project namespace pods were blocked from reaching opal

[Copilot]

Pull request overview

This PR updates the per-project CiliumNetworkPolicy template so pods in project namespaces can communicate with services in the datashield namespace (e.g., Opal), avoiding unintended isolation blocks.

Changes:

• Added datashield to the list of allowed “infrastructure namespaces” in the policy documentation.
• Allowed ingress from datashield to project namespaces.
• Allowed egress to datashield from project namespaces.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[vvcb]

Only projects that are using DataSHIELD for federation should have access to the DataSHIELD namespace. Not all projects should have access.

[Alwin-K-Thomas]

Only projects that are using DataSHIELD for federation should have access to the DataSHIELD namespace. Not all projects should have access.

Thanks @vvcb for the feedback. I've updated the metamodel to add datashield as a resource type (alongside jupyter, VDI), and the UI now exposes it as a selectable option in the deployment. The operator now derives the namespace based on the datashield resource presence, so the network policy is created with datashield access based on the enable flag, if not, it's excluded entirely.
I'll hold off merging until we wrap up the federated demo next week