Adjust connection controller and how it handles the license and network policy

[tmjd]

Description

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

[pasanw]

The current implementation gates whether or not we try to render network policy based on whether the tier is present. I'm wondering if we should just change this so that it gates based on whether the license is present.

I think this achieves the same result as what you've suggested, but the code would read a bit simpler. We would switch the tier check and the license check, e.g.

	includeV3NetworkPolicy := false
	if license, err := utils.FetchLicenseKey(ctx, r.Client); err != nil {
		if !k8serrors.IsNotFound(err) {
                   // error
		}	
	} else {
		includeV3NetworkPolicy = true


		if err := r.Client.Get(ctx, client.ObjectKey{Name: networkpolicy.TigeraComponentTierName}, &v3.Tier{}); err != nil {
			// error
		}

		if egressAccessControlRequired(managementClusterConnection.Spec.ManagementClusterAddr, r.resolvedPodProxies, log) {
			if !utils.IsFeatureActive(license, common.EgressAccessControlFeature) {
				// error
			}
		}
	}