feat(kuma-cp): update default policies to use new rules api instead of deprecated from

[Automaat]

Motivation

We should update our default policies to use new api

[Automaat]

Looking at this code, I am afraid that this is not enough as we will have duplicate timeouts, if old defaults are present.

Also, simply removing old defaults feels shady, what if someone updated defaults but left the default name?

[lukidzi]

I think we create these resources only during mesh creation. They shouldn't be created when upgrading to the new version.

[lukidzi]

One more issue. What about zones running older versions? These policies won't work on zones

[Automaat]

@lukidzi can we protect ourselves from this? some flag on kds or something like this?

[lukidzi]

It might be possible using a KDS flag, but we would need to translate it to a compatible format at the KDS sync level. That’s a bit tricky, and the global control plane would still display the new version. Since policies are created on the global control plane and it doesn't have awareness of the zone version, it's not possible to determine how to generate the default policy correctly.

[Automaat]

so should we then wait until we remove support for from entirely?

[github-actions]

Reviewer Checklist

🔍 Each of these sections need to be checked by the reviewer of the PR 🔍:
If something doesn't apply please check the box and add a justification if the reason is non obvious.

• Is the PR title satisfactory? Is this part of a larger feature and should be grouped using > Changelog?
• PR description is clear and complete. It Links to relevant issue as well as docs and UI issues
• This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as an image registry)
• IPv6 is taken into account (.e.g: no string concatenation of host port)
• Tests (Unit test, E2E tests, manual test on universal and k8s)
  • Don't forget ci/ labels to run additional/fewer tests
• Does this contain a change that needs to be notified to users? In this case, UPGRADE.md should be updated.
• Does it need to be backported according to the backporting policy? (this GH action will add "backport" label based on these file globs, if you want to prevent it from adding the "backport" label use no-backport-autolabel label)