Allows specifying "global namespaces" when using namespace isolation

[dougbtv]

When using namespaceIsolation -- we have only allowed for referring to the default namespace from any given namespace. This enhancement adds a configuration option globalNamespaces which allows one to specify any additional namespaces which they would like to refer to "globally" -- that is, from any given namespace (as opposed to "locally" -- from the same namespace in which a pod resides, which is the core functionality of namespaceIsolation).

The globalNamespaces parameter works only when namespaceIsolation is set to true. When globalNamespaces is unset, it is implied that default will still be allowed globally.

cc: @rohan47

Fixes #567

[coveralls]

Pull Request Test Coverage Report for Build 336454369

• 23 of 24 (95.83%) changed or added relevant lines in 2 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage increased (+0.3%) to 71.317%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
k8sclient/k8sclient.go	13	14	92.86%

Totals
Change from base Build 332121316:	0.3%
Covered Lines:	1099
Relevant Lines:	1541

---

💛 - Coveralls

[rohan47]

@dougbtv If I understand correct, globalNamespaces needs to be specified in the multus config and can't be specified through net-attach-defs right?

[dougbtv]

@matrohon that's correct -- so in the case of OpenShift, we'll specify the globalNamespaces using the cluster-network-operator.

I want to allow some flexibility of configuration to allow using some namespaces globally, but, if we allowed it in net-attach-defs then it opens the door for unprivileged users to be able to specify it (the namespace isolation feature is intended to disallow some class of user from accessing networks that are considered "more privileged").

[matrohon]

you probably meant @rohan47 ?

[dougbtv]

(sorry for the bad autocomplete Mathieu!) Yes, @rohan47 above ^^^ :)

[s1061123]

LGTM, thanks!