Support externalTrafficPolicy on the client Service

Adds BindCluster.spec.service.externalTrafficPolicy so DNS LoadBalancers
can preserve client source IPs (Local), which the source-IP ACLs on the
authoritative/resolver need to actually restrict external clients (Cluster
SNATs everything to node IPs).

- api: ClusterServiceSpec.externalTrafficPolicy (enum Cluster;Local)
- set it on the client Service for LoadBalancer/NodePort types
- regenerate CRDs + install.yaml

api/v1alpha1/bindcluster_types.go

@@ -33,6 +33,13 @@ type ClusterServiceSpec struct {
 	// +optional
 	LoadBalancerIP string `json:"loadBalancerIP,omitempty"`
 
+	// ExternalTrafficPolicy for a LoadBalancer/NodePort Service. Local preserves
+	// client source IPs (required for source-IP ACLs on the DNS servers) but
+	// only routes to nodes running a pod. Defaults to Cluster.
+	// +kubebuilder:validation:Enum=Cluster;Local
+	// +optional
+	ExternalTrafficPolicy corev1.ServiceExternalTrafficPolicy `json:"externalTrafficPolicy,omitempty"`
+
 	// Annotations added to the client-facing Service (e.g. PureLB/MetalLB hints).
 	// +optional
 	Annotations map[string]string `json:"annotations,omitempty"`