fix(nvca): backport intra-namespace NetworkPolicy isolation fix to 3.2 (#1256)

[rohithb-hub]

…2 (#1256)

(cherry picked from commit 1ad8682)

TL;DR

Backports #1256 to the 3.2 release branch: removes the two NVCA-owned NetworkPolicy rules that combined to let any pod in the shared nvcf-backend namespace reach any other pod in that namespace, on any port, plus the follow-up best-effort startup cleanup of any already-created copy of the leftover egress policy. Per-instance function/MiniService namespaces are unaffected — both rules stay there since they're needed for legitimate same-namespace pod-to-pod communication.

Additional Details (optional for docs, build, test, refactor, ci, chore, style, and revert PRs)

Clean cherry-pick of 1ad86826 (the squashed main commit for #1256) onto release-src/compute-plane-services/nvca/v3.2:

(cherry picked from commit 1ad8682)

No conflicts, no 3.2-specific adjustments needed — go build and go test pass unmodified on this branch.

For the Reviewer

• Single cherry-picked commit; see fix(nvca): remove leftover intra-namespace egress NetworkPolicy from nvcf-backend at startup #1256 for the full design discussion and review history (including the earlier back-and-forth on whether the leftover-policy cleanup belongs in NVCA at all).
• internal/util/k8sutil/netpol.go and pkg/nvca/backendk8scache.go are the core of the change.

For QA (optional for docs, build, test, refactor, ci, chore, style, and revert PRs)

• go build ./... — clean.
• go test ./internal/util/k8sutil/... ./pkg/nvca/... — all green.
• Not yet done: live verification against a 3.2 cluster.

Issues

NO-REF

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0012962d-1d09-49f3-a12a-c1b138c6c83b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-fix-nvca-backport-netpol-isolation-3-2.docs.buildwithfern.com/nvcf