We may want to let users create services, but not let them use all the possible options.

• often we might not want a user to be allowed to pick ServiceType = NodePort because this consumes global resources.
• possibly we might not want a user to be allowed to pick ServiceType = LoadBalancer, since this exposes services outside the cluster.
• Possibly user-specified PortalIP is needs restriction too?

For Pods we have a proposal to make a SecurityConstraint that controls some security sensitive fields which are grouped into a SecurityContext. Does this pattern apply to service as well in some way?

Sometimes we want to let a principal create pods, but not allow them to use all the possible options on pods. One way we are looking at doing this is to group some sensitive options