[Feature] non-k8s resource authz expansion

[weilaaa]

Why do we need non-k8s resource authz expansion?

Assumed that we have a bookinfo server and we want to make a decision who can access bookinfo and by how?

How to expand authz of non-k8s resource?

Introduce new crd ExternalResource for mapping non-k8s resource so that we can use it as general k8s resource to rbac

apiVersion: extension.kubecube.io/v1
kind: ExternalResource
metadata:
  name: bookinfo
spec:
  namespaced: false
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: platform-admin
rules:
  ...
  - apiGroups:
      - "extension.kubecube.io/v1"
    resources:
      - externalresources
    resourceNames:
      - bookinfo
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - deletecollection
      - patch
      - update