In the course of T360428, I have tried to have a "new-style" network policy for Cassandra clients on k8s being able to talk to off-k8s Cassandra clusters.

This is an initial change I came up with: https://gerrit.wikimedia.org/r/c/operations/puppet/+/1020194/1

Unfortunately, this does not work, since profile::cassandra::instances is not in-scope for the deployment server.

I want to make this change useful beyond just ML/LW services (and hard-coding IPs is contrary to the intent of the new-style network policies).

One option might be to do it similar to the Redis ext service in the same file, but I haven't tried that approach yet.