MutatingAdmissionPolicy for unqualified Services to default to PreferDualStack

prefer-dual-stack.yaml

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingAdmissionPolicy
metadata:
  name: prefer-dual-stack-services
spec:
  matchConstraints:
    resourceRules:
    - apiGroups:   [""]
      apiVersions: ["v1"]
      operations:  ["CREATE"]
      resources:   ["services"]
  matchConditions:
  - name: ipfamilypolicy-unset
    expression: "!has(object.spec.ipFamilyPolicy)"
  - name: not-externalname
    expression: 'object.spec.type != "ExternalName"'
  failurePolicy: Ignore
  reinvocationPolicy: Never
  mutations:
  - patchType: ApplyConfiguration
    applyConfiguration:
      expression: >
        Object{
          spec: Object.spec{
            ipFamilyPolicy: "PreferDualStack"
          }
        }
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingAdmissionPolicyBinding
metadata:
  name: prefer-dual-stack-services-binding
spec:
  policyName: prefer-dual-stack-services