Block access to link-local addresses from containers by default

[bgrant0607]

GCE and AWS expose local metadata servers on a link-local address (169.254.169.254). This compromises isolation of containers from hosts and from the cluster. As with host ports, host networking, host paths, etc., we shouldn't expose these addresses by default. Authorization should be required.

Sadly, Google API clients apparently require metadata access currently, as reported in #8512.

cc @thockin @erictune @evandbrown

[bgrant0607]

Actually, the GCE API doesn't require the metadata server. The client just needs to explicitly provide the credentials in that case.

[evandbrown]

They don't require it, but manually managing (distributing, revoking, and rotating) service accounts and their credentials is a big step back IMO. If the secrets API can be jiggered to help here, great, just anything to keep folks from including keys in their images.

[bgrant0607]

Dupe of #8867.