fix(tenant): allow egress to vlogs in parent tenants

Combine vminsert and vlogs egress rules using matchExpressions
to reduce code duplication. This allows Fluent Bit in nested
Kubernetes clusters to send logs to VLogs in parent tenants.

Without this fix, logs from nested clusters timeout because Cilium
blocks traffic to vlogs pods while metrics to vminsert work fine.

Fixes #1970

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

packages/apps/tenant/templates/networkpolicy.yaml

@@ -46,13 +46,20 @@ spec:
     {{- $parts := splitList "-" .Release.Namespace }}
     {{- range $i, $v := $parts }}
     {{- if ne $i 0 }}
-    - matchLabels:
-        "k8s:app.kubernetes.io/name": "vminsert"
-        "k8s:io.kubernetes.pod.namespace": {{ join "-" (slice $parts 0 (add $i 1)) }}
+    - matchExpressions:
+      - key: "k8s:io.kubernetes.pod.namespace"
+        operator: "In"
+        values:
+        - {{ join "-" (slice $parts 0 (add $i 1)) | quote }}
+      - key: "k8s:app.kubernetes.io/name"
+        operator: "In"
+        values:
+        - "vminsert"
+        - "vlogs"
     {{- end }}
     {{- end }}
     {{- end }}
-  {{- end }}    
+  {{- end }}
   {{- if ne (include "tenant.name" .) "tenant-root" }}
   - toEndpoints:
     {{- if hasPrefix "tenant-" .Release.Namespace }}