Docs: sync upstream clickhouse-operator docs updates

[mintlify]

Changelog category (leave one):

• Documentation (changelog entry is not required)

Summary

Syncs the Kubernetes operator docs with the latest upstream copies from clickhouse/clickhouse-operator, picking up the new managed cluster NetworkPolicy documentation.

Changes

• docs/products/kubernetes-operator/guides/network-policies.mdx: adds cluster-level spec.networkPolicy docs (managed policies for ClickHouse/Keeper, allowing clients and monitoring, ENABLE_NETWORK_POLICY cluster-wide opt-out) and restructures the page into cluster vs. operator pod policies.
• docs/products/kubernetes-operator/reference/api-reference.mdx: adds ClickHouseNetworkPolicySpec, KeeperNetworkPolicySpec, and NetworkPolicyPolicy API reference entries.

Files copied verbatim from upstream docs/. All other operator doc pages are already in sync.

Context

Triggered by ClickHouse/clickhouse-operator#305 (test: add max CRD size check, add version probe job retries). That PR's listed diff only touches the Makefile and controller code; the docs drift synced here comes from the upstream docs/ tree at the same commit (54fdb01), which was ahead of the copies in this repo.

Note: upstream pages use slug: /clickhouse-operator/... frontmatter while internal links target /products/kubernetes-operator/.... This matches the existing convention in this repo, so it was preserved as-is. If that's unintended, it should be fixed upstream first.

cc @GrigoryPervakov for review (author of the upstream docs commit).

---

Workflow [PR]
Sync PR [sync-upstream/pr/116384]

[clickhouse-gh]

Workflow [PR], commit [661f77d]

Summary: ✅

---

AI Review

Summary

This PR syncs the Kubernetes operator docs for managed cluster NetworkPolicy support and the corresponding API reference entries from upstream clickhouse-operator. The new CRD fields, ports, labels, and Helm/env switches match the upstream operator sources, but one of the new guide examples overstates how to re-enable client traffic: as written, it only works for same-namespace clients.

Findings

⚠️ Majors

• [docs/products/kubernetes-operator/guides/network-policies.mdx:79] The example meant to show how to reopen client ingress uses only from.podSelector. In Kubernetes that selector is namespace-local, so clients or Prometheus running in a different namespace remain blocked even if they carry the shown label. Either add namespaceSelector to make the example work for cross-namespace clients, or explicitly state that the snippet is same-namespace only.

Final Verdict

⚠️ Needs a doc fix before merge.

[clickhouse-gh]

from.podSelector only matches source pods in the same namespace as this NetworkPolicy. The surrounding text presents this as the general way to re-allow client traffic, but for the common case where application pods or Prometheus run in a different namespace this rule still blocks them. Please either add a namespaceSelector (or a combined namespaceSelector + podSelector) or explicitly say this example is same-namespace only.