adding egressFirewall

[JacobTanenbaum]

- What this PR does and why is it needed

This PR adds an egressFirewall object that works on a namespace and allows a cluster administrator to allow or deny traffic to external resources as specified by the cidr selector.

for example:

kind: EgressFirewall
apiVersion: k8s.ovn.org/v1
metadata:
  name: default
spec:
  egress:
  - type: Deny
    ports:
      - protocol: sctp
    to:
      cidrSelector: 0.0.0.0/0

will deny all sctp traffic leaving from all pods on the namespace it was applied to

- Special notes for reviewers

This will be followed up with the option to allow rules to a dns name, adding the dns name resolution code will require a decent amount more code and it would be beneficial to get this reviewed and on the path to merging as this is the base functionality.

In the future there will need to be an admission controller that validates that there is only one in a namespace, for now the egressFirewall logs an error if the attempt is made to add a second egressFirewall to namespace.

- How to verify it

included is a full set of unit tests

manually test functionality:
build a cluster
apply the crd
create an egressfirewall rule
attempt to curl the specified cidr address

- Description for the changelog
adding the egressfirewall crd that will allow a cluster admin to restrict traffic leaving the cluster

[coveralls]

Coverage increased (+0.6%) to 58.99% when pulling 81ae98f on JacobTanenbaum:egressFirewall into 36c4740 on ovn-org:master.

[dcbw]

For anyone playing along at home, Girish asked for some documentation on the EgressFirewall feature which Jacob will write and add to this PR.

[alexanderConstantinescu]

@JacobTanenbaum : you should add a config parameter for this. I don't suspect everyone using ovn-kubernetes to use egress firewall, so this code should not impact them. Could you add a config parameter, as done here: 8801fe5 and then enable that parameter for testing, as done here: 627aac7

I will go over your PR in detail later on. But I saw this and wanted to tell you

[danwinship]

The field name and the json name should match. It's too confusing otherwise.

[danwinship]

as with the comments I made on the egress IP bug this doesn't seem like a very clean / future-feature-friendly way of doing this. (And this PR is going to end up conflicting with the egress IP one here).

Though in contrast to that PR, this one does a much better job of keeping the egress-firewall-specific controller code separate from the generic controller code

[JacobTanenbaum]

there is an issue to address this and make a generic APIClient in the future #1528