meshreg: epselector supports instance ip blacklist

[believening]

backgrounds

• For instance filtering, we designed the interface based on the Kubernetes standard label selector. However, simply using labels to filter instances is not sufficient to cover all scenarios, such as filtering based on IP blacklists. Therefore, we need to extend the endpoint selector API to support more filtering configurations.
• There are two levels of scope for endpoint selectors: source-scoped and service-scoped. In the previous API, we agreed that once an instance matches the service-scoped endpoint selector, the source-scoped endpoint selector will be automatically ignored. This convention results in a large amount of duplicate configuration and additional constraint merging calculations when there are many specialized service-scoped constraints and common source-scoped constraints. Therefore, we need to allow both source-scoped and service-scoped endpoint selectors to take effect while ensuring compatibility.

api design

• We used a custom data structure called EndpointSelector for endpoint selectors, which embeds the Kubernetes LabelSelector to ensure compatibility with existing configurations. We met the demand for extending filtering configurations by adding new field to EndpointSelector .
• We also added a new configuration option called AlwaysUseSourceScopedEpSelectors, which explicitly requires both service-scoped and source-scoped filtering configurations to be applied simultaneously.

usage

# example configuration:
ZookeeperSource:
  AlwaysUseSourceScopedEpSelectors: true 
  ServicedEndpointSelectors:
    "bar":
    - ExcludeIPRanges:
        IPs:
        - 1.1.1.1
  EndpointSelectors:
  - matchExpressions:
    - key: app
      operator: In
      values:
      - foo
      - bar

Using the example configuration, serviceentry will only be generated for foo and bar services, and if an instance ip of bar service is "1.1.1.1", the instance will not appear as an available ep of bar service in serviceentry.