Support externalTrafficPolicy on the client Service

Adds BindCluster.spec.service.externalTrafficPolicy so DNS LoadBalancers
can preserve client source IPs (Local), which the source-IP ACLs on the
authoritative/resolver need to actually restrict external clients (Cluster
SNATs everything to node IPs).

- api: ClusterServiceSpec.externalTrafficPolicy (enum Cluster;Local)
- set it on the client Service for LoadBalancer/NodePort types
- regenerate CRDs + install.yaml

internal/controller/bindcluster_controller.go

@@ -273,6 +273,10 @@ func (r *BindClusterReconciler) reconcileServices(ctx context.Context, c *bindv1
 			LoadBalancerIP: c.Spec.Service.LoadBalancerIP,
 		},
 	}
+	// externalTrafficPolicy is only valid for LoadBalancer/NodePort Services.
+	if svcType == corev1.ServiceTypeLoadBalancer || svcType == corev1.ServiceTypeNodePort {
+		client.Spec.ExternalTrafficPolicy = c.Spec.Service.ExternalTrafficPolicy
+	}
 	return r.upsertService(ctx, c, client)
 }
 

internal/controller/util.go

@@ -57,6 +57,7 @@ func (r *BindClusterReconciler) upsertService(ctx context.Context, c *bindv1alph
 	existing.Spec.Selector = desired.Spec.Selector
 	existing.Spec.Type = desired.Spec.Type
 	existing.Spec.LoadBalancerIP = desired.Spec.LoadBalancerIP
+	existing.Spec.ExternalTrafficPolicy = desired.Spec.ExternalTrafficPolicy
 	if desired.Annotations != nil {
 		if existing.Annotations == nil {
 			existing.Annotations = map[string]string{}