Fix calico etcd mode networkpolicy RBAC (#12587)

Co-authored-by: Chad Swenson <chadswen@gmail.com>

roles/kubernetes-apps/policy_controller/calico/templates/calico-kube-cr.yml.j2

@@ -6,19 +6,26 @@ metadata:
   namespace: kube-system
 rules:
 {% if calico_datastore == "etcd"  %}
-  - apiGroups:
+  # Pods are monitored for changing labels.
-    - ""
+  # The node controller monitors Kubernetes nodes.
-    - extensions
+  # Namespace and serviceaccount labels are used for policy.
+  - apiGroups: [""]
     resources:
       - pods
-      - namespaces
-      - networkpolicies
       - nodes
+      - namespaces
       - serviceaccounts
     verbs:
       - watch
       - list
       - get
+  # Watch for changes to Kubernetes NetworkPolicies.
+  - apiGroups: ["networking.k8s.io"]
+    resources:
+      - networkpolicies
+    verbs:
+      - watch
+      - list
 {% elif calico_datastore == "kdd" %}
   # Nodes are watched to monitor for deletions.
   - apiGroups: [""]