anyone know of a good generic way to create a portable cross-cluster netpol that allows containers access to the kube-apiserver in rke2?