Signed-off-by: Joe Stringer <joe@cilium.io>

This preparatory commit introduces a new Cell for each Swagger API
Specification in order to allow reuse earlier on during the agent
initialization / lifecycle. No functional changes intended.

Signed-off-by: Joe Stringer <joe@cilium.io>

Use the autogenerated API specifications in order to populate "allowed
APIs" flags in the api specification objects for each API. This code
will be hooked in for usage in subsequent commits.

Signed-off-by: Joe Stringer <joe@cilium.io>

Now that there's dedicated cells to provide the API specs for each API,
each server can now directly depend on those rather than doing their own
swagger spec instantiation.

Signed-off-by: Joe Stringer <joe@cilium.io>

Add new flag(s) to the daemon which restrict the ability for API clients
to call certain API endpoints. The new option is an allowlist of
Pascalized API endpoints that may be allowed, or optionally a Prefix
followed by the '*' character in order to allow a wildcard of API
endpoints, for example "*" for all API endpoints, or "Get*" for all GET
endpoints.

Set the default to allow all ("*") API modifications so that there is no
change in behaviour for existing deployments.

Signed-off-by: Joe Stringer <joe@cilium.io>

The newly added API access flags are very flexible in the APIs that they
allow to be administratively disabled, but there are some options that
are really required for any standard Cilium operations. Add some basic
sanity checking before applying the user configuration in these cases,
as it could lead to unexpected results such as inability to keep the
Cilium agent running or inability to deploy new endpoints.

Signed-off-by: Joe Stringer <joe@cilium.io>

pkg/api will be used in an upcoming commit, so rename the variable in
this function to avoid that conflict.

Signed-off-by: Joe Stringer <joe@cilium.io>

Similar to the recent commit to administratively enable/disable support for
agent API endpoints, extend this support to the cilium-health API
exposed by nodes as well.

Signed-off-by: Joe Stringer <joe@cilium.io>

Signed-off-by: Joe Stringer <joe@cilium.io>

For now this is not particularly important as the operator only has a
/healthz API to get the health of the operator. However, if we ever
extend this API in future then it could become useful to consistently
apply API restrictions via the new flag.

Signed-off-by: Joe Stringer <joe@cilium.io>