feat: Migrate sys applications to helmfile

Move most of helmfiles into temp to test only velero.

File structure:

```bash
/
├── helmfile.d/                                                 # Helmfiles, *.yaml.gotmpl
├── charts/                                                     # Our own charts, e.g `Atlantis`
├── values                                                      # Values for helmfiles
│   ├── <chart>
│   │   ├── values.yaml.gotmpl                                  # Values to be templated in `values/`
│   │   ├── kustomize                                           # Kustomizations per environment
│   │   ├── manifests                                           # Raw manifests
│   │   │   ├── <chart>.yaml                                    # Argo App for bootstrap
│   │   │   ├── dashboards                                      # Grafana dashboards
│   │   │   │   └── <chart>-metrics.yaml
│   │   │   └── policies                                        # Cilium and Kyverno policies
│   │   │       ├── CiliumNetworkPolicy-allow-api-server.yaml
│   │   │       └── KyvernoPolicy-regred-secret.yaml
│   │   └── values                                              # Values for each environment
│   │       ├── <chart>-staging.yaml.gotmpl                     # Values for staging environment
│   │       ├── <chart>-prod.yaml.gotmpl                        # Values for prod environment
│   │       └── <chart>.yaml.gotmpl                             # Standard values for all environments
│   │
│   ├── values.yaml                                             # Standard values for all cluster
│   ├── values-oceanbox.yaml                                    # Values overrides for oceanbox
│   ├── values-ekman.yaml                                       # Values overrides for ekman
```

values/ingress-nginx/manifests/ingress-nginx.yaml

@@ -21,6 +21,9 @@ spec:
           value: {{ .Values.clusterConfig.cluster }}
   project: sys
   syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: sys
     syncOptions:
     - ServerSideApply=true
     {{- if .Values.nginx.autosync }}

values/ingress-nginx/manifests/policies/CiliumNetworkPolicy-allow-host-traffic.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-host-traffic
+  namespace: ingress-nginx
+spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+        - host
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: ingress-nginx

values/ingress-nginx/manifests/policies/CiliumNetworkPolicy-allow-hubble-traffic.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-hubble-traffic
+  namespace: ingress-nginx
+spec:
+  egress:
+    - toFQDNs:
+        - matchPattern: hubble.*.*.*
+        - matchPattern: hubble.*.*.*.*
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: ingress-nginx

values/ingress-nginx/manifests/policies/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -0,0 +1,17 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-prometheus-metrics
+  namespace: ingress-nginx
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: ingress-nginx
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+    - toPorts:
+        - ports:
+            - port: "9913"
+              protocol: TCP

values/ingress-nginx/manifests/policies/CiliumNetworkPolicy-allow-s3-traffic.yaml

@@ -0,0 +1,19 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-s3-traffic
+  namespace: ingress-nginx
+spec:
+  egress:
+    - toCIDR:
+        - 10.139.2.10/32
+    - toCIDR:
+        - 10.139.2.11/32
+    - toCIDR:
+        - 10.139.2.20/32
+    - toCIDR:
+        - 10.139.2.21/32
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: ingress-nginx

values/ingress-nginx/manifests/policies/CiliumNetworkPolicy-allow-world-to-ingress-nginx.yaml

@@ -0,0 +1,19 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-world-to-ingress-nginx
+  namespace: ingress-nginx
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: ingress-nginx
+  ingress:
+    - fromEntities:
+        - world
+    - toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+            - port: "443"
+              protocol: TCP