Enforcing Service external IPs

[prometherion]

Closes #159.

[bsctl]

@prometherion with the current implementation, omitting externalServiceIPs from tenant manifest, the admission control is not in place and all IPs are permitted.

It seems we have following options to block all IPs:

1. if the externalServiceIPs spec is not declared in the tenant, then no IPs are permitted at all, as stated in Policy to restrict External IPs in Services [CVE-2020-8554] #159. This will be an exception in the general approach where if a spec is not declared, the related admission controller is not applied, eg. IngressClasses. Actually, this different approach could be a bit confusing for the end user.

2. permit an empty value to the allowed list of IPS, for example

apiVersion: capsule.clastix.io/v1alpha1
kind: Tenant
spec:
  externalServiceIPs:
    allowed: []

Option 2 actually works. However, since externalServiceIPs is not mandatory, it is responsibility of the cluster admin to apply that spec in order to mitigate CVE-2020-8554.

Wonder to know your point of view. Thanks.

[prometherion]

omitting externalServiceIPs from tenant manifest, the admission control is not in place and all IPs are permitted.

This looks good to me, it's an expected behavior according to the current implementation and it reflects what we achieved with Storage and Ingress classes.

If CVE must be mitigated, a valid .spec.externalServiceIPs.allowed set of CIDR blocks has to be put in place.

[bsctl]

LGTM