Policy to restrict External IPs in Services [CVE-2020-8554]

[bsctl]

Describe the feature

We need to add a policy to restrict External IPs in services in order to mitigate CVE-2020-8554. Ref. here and here

What would the new user story look like?

1. CVE-2020-8554 affects multi-tenancy environments
2. The cluster admin creates a tenant specifying the allowed External IP CIDRs

apiVersion: capsule.clastix.io/v1alpha1
kind: Tenant
metadata:
  name: oil
spec:
  owner:
    kind: User
    name: alice
  externalServiceIPs:
     allowed:
     - 10.0.0.0/8
     - 192.168.0.0/16
    

3. This is going to be attached to the Tenant
4. The tenant owner creates a Service by specifying the External IPs: only listed IPs are allowed
5. If externalServiceIPs is not specified, then no External IPs in Services are allowed

Expected behavior

The cluster admin can mitigate CVE-2020-8554

[bsctl]

No mitigations are provided for LoadBalancer IPs since it is not recommend granting users patch service/status permission. If LoadBalancer IP restrictions are required, the approach for the external IP mitigations can be copied.