Add accessPolicy field to Server CRD

Followup to #12844, branched off of alpeb/policy-audit-option

This new field defines the default policy for Servers, i.e. if a request doesn't match the policy associated to a Server then this policy applies.
The values are the same as for `proxy.defaultInboundPolicy` and the `config.linkerd.io/default-inbound-policy` annotation (all-unauthenticated, all-authenticated, cluster-authenticated, cluster-unauthenticated, deny), plus a new value "audit".
The default is "deny", thus remaining backwards-compatible. For this same reason no new version of the CRD is required.

This field is also exposed as an additional printer column.

charts/linkerd-crds/templates/policy/server.yaml

@@ -148,6 +148,11 @@ spec:
                 - required: [podSelector]
                 - required: [externalWorkloadSelector]
               properties:
+                accessPolicy:
+                  type: string
+                  default: deny
+                  description: >-
+                    Default access policy to apply when the traffic doesn't match any of the policy rules.
                 podSelector:
                   type: object
                   description: >-
@@ -220,3 +225,7 @@ spec:
         type: string
         description: The protocol of the server
         jsonPath: .spec.proxyProtocol
+      - name: Access Policy
+        type: string
+        description: The default access policy applied when the traffic doesn't match any of the policy rules
+        jsonPath: .spec.accessPolicy

controller/gen/apis/server/v1beta2/types.go

@@ -29,6 +29,7 @@ type Server struct {
 
 // ServerSpec specifies a Server resource.
 type ServerSpec struct {
+	AccessPolicy             string                `json:"accessPolicy,omitempty"`
 	PodSelector              *metav1.LabelSelector `json:"podSelector,omitempty"`
 	ExternalWorkloadSelector *metav1.LabelSelector `json:"externalWorkloadSelector,omitempty"`
 	Port                     intstr.IntOrString    `json:"port,omitempty"`