Enforcing Service external IPs (#161)

api/v1alpha1/tenant_types.go

@@ -43,6 +43,13 @@ type ContainerRegistriesSpec struct {
 	AllowedRegex string       `json:"allowedRegex,omitempty"`
 }
 
+// +kubebuilder:validation:Pattern="^([0-9]{1,3}.){3}[0-9]{1,3}(/([0-9]|[1-2][0-9]|3[0-2]))?$"
+type AllowedIp string
+
+type ExternalServiceIPs struct {
+	Allowed []AllowedIp `json:"allowed"`
+}
+
 // TenantSpec defines the desired state of Tenant
 type TenantSpec struct {
 	Owner OwnerSpec `json:"owner"`
@@ -59,6 +66,7 @@ type TenantSpec struct {
 	LimitRanges            []corev1.LimitRangeSpec          `json:"limitRanges,omitempty"`
 	ResourceQuota          []corev1.ResourceQuotaSpec       `json:"resourceQuotas,omitempty"`
 	AdditionalRoleBindings []AdditionalRoleBindings         `json:"additionalRoleBindings,omitempty"`
+	ExternalServiceIPs     *ExternalServiceIPs              `json:"externalServiceIPs,omitempty"`
 }
 
 type AdditionalRoleBindings struct {

api/v1alpha1/zz_generated.deepcopy.go

@@ -96,6 +96,26 @@ func (in *ContainerRegistriesSpec) DeepCopy() *ContainerRegistriesSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalServiceIPs) DeepCopyInto(out *ExternalServiceIPs) {
+	*out = *in
+	if in.Allowed != nil {
+		in, out := &in.Allowed, &out.Allowed
+		*out = make([]AllowedIp, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalServiceIPs.
+func (in *ExternalServiceIPs) DeepCopy() *ExternalServiceIPs {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalServiceIPs)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in IngressClassList) DeepCopyInto(out *IngressClassList) {
 	{
@@ -347,6 +367,11 @@ func (in *TenantSpec) DeepCopyInto(out *TenantSpec) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.ExternalServiceIPs != nil {
+		in, out := &in.ExternalServiceIPs, &out.ExternalServiceIPs
+		*out = new(ExternalServiceIPs)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TenantSpec.