feat: add externalip to rules api (#2099)

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

pkg/api/rules/enforce_services_types.go

@@ -23,6 +23,10 @@ type NamespaceRuleEnforceServicesBody struct {
 	// +optional
 	LoadBalancers *ServiceLoadBalancerRule `json:"loadBalancers,omitempty"`
 
+	// ExternalIPs defines constraints for spec.externalIPs.
+	// +optional
+	ExternalIPs *ServiceExternalIPRule `json:"externalIPs,omitempty"`
+
 	// ExternalNames defines additional constraints for Services of type ExternalName.
 	// +optional
 	ExternalNames *ServiceExternalNameRule `json:"externalNames,omitempty"`
@@ -50,6 +54,16 @@ type ServiceLoadBalancerRule struct {
 	CIDRs []string `json:"cidrs,omitempty"`
 }
 
+// +kubebuilder:object:generate=true
+type ServiceExternalIPRule struct {
+	// CIDRs restricts spec.externalIPs. Individual IP addresses are treated as
+	// host CIDRs (/32 for IPv4 and /128 for IPv6).
+	// For deny rules, empty means all external IPs are denied. For allow and
+	// audit rules, empty means no external IP restriction.
+	// +optional
+	CIDRs []string `json:"cidrs,omitempty"`
+}
+
 // +kubebuilder:object:generate=true
 type ServiceExternalNameRule struct {
 	// Hostnames restricts spec.externalName.

pkg/api/rules/zz_generated.deepcopy.go

@@ -214,6 +214,11 @@ func (in *NamespaceRuleEnforceServicesBody) DeepCopyInto(out *NamespaceRuleEnfor
 		*out = new(ServiceLoadBalancerRule)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.ExternalIPs != nil {
+		in, out := &in.ExternalIPs, &out.ExternalIPs
+		*out = new(ServiceExternalIPRule)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.ExternalNames != nil {
 		in, out := &in.ExternalNames, &out.ExternalNames
 		*out = new(ServiceExternalNameRule)
@@ -375,6 +380,26 @@ func (in *ResourceQuotaRule) DeepCopy() *ResourceQuotaRule {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ServiceExternalIPRule) DeepCopyInto(out *ServiceExternalIPRule) {
+	*out = *in
+	if in.CIDRs != nil {
+		in, out := &in.CIDRs, &out.CIDRs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceExternalIPRule.
+func (in *ServiceExternalIPRule) DeepCopy() *ServiceExternalIPRule {
+	if in == nil {
+		return nil
+	}
+	out := new(ServiceExternalIPRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ServiceExternalNameRule) DeepCopyInto(out *ServiceExternalNameRule) {
 	*out = *in