Add a ValidatingAdmissionPolicy blocking ServiceCIDR changes

OCP does not yet support changing the service CIDRs at runtime.

bindata/cluster-network-operator/servicecidr-vap.yaml

@@ -0,0 +1,14 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: "servicecidrs.openshift.io"
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:   ["networking"]
+      apiVersions: ["v1"]
+      operations:  ["CREATE", "UPDATE"]
+      resources:   ["servicecidr"]
+  validations:
+    - expression: "object.name != 'kubernetes'"