Inconsistent application wildcard behaviour in internal ingress/egress

[nicolst]

A wildcard in an outbound rule's application field results in the rule being skipped, while it behaves as expected in an inbound rule (empty labelselector). The rules in the following example are both presented in Nais console as allowing all traffic from namespace some-ns (though with incorrect wording for outbound rules), but only the inbound rule does so in reality:

apiVersion: nais.io/v1alpha1
kind: Application
...
spec:
  accessPolicy:
    inbound:
      rules:
        - application: '*'
          namespace: some-ns
    outbound:
      rules:
        - application: '*'
          namespace: some-ns

Outbound rules with application: '*' get skipped:

naiserator/pkg/resourcecreator/networkpolicy/networkpolicy.go

Lines 95 to 101 in 301e746

	if outbound.Application == "" || outbound.Application == "*" || !outbound.MatchesCluster(cfg.GetClusterName()) {
	continue
	}
	peer := networkingv1.NetworkPolicyPeer{
	PodSelector: labelSelector("app", outbound.Application),
	}

While they get included as an empty labelselector for inbound rules:

naiserator/pkg/resourcecreator/networkpolicy/networkpolicy.go

Lines 236 to 241 in 301e746

	peer := networkingv1.NetworkPolicyPeer{}
	if rule.Application == "*" {
	peer.PodSelector = &metav1.LabelSelector{}
	} else {
	peer.PodSelector = labelSelector("app", rule.Application)
	}