Allow network blocking by port.

[GrahamDumpleton]

Is your feature request related to a problem? Please describe.

Can currently specify a network block list using:

clusterNetwork:
  blockCIDRs:
  - "169.254.169.254/32"
  - "fd00:ec2::254/128"

This is for all ports but I want to only restrict certain ports.

Describe the solution you'd like

Want to be able to say:

clusterNetwork:
  blockCIDRs:
  - "0.0.0.0/0:8333"

Or similar to block specific ports.

Describe alternatives you've considered

No response

Additional information

No response

[GrahamDumpleton]

Note that the other way to handle this for injecting NetworkPolicy objects into any Educates namespaces is to use Kyverno. One would use a label selector in the ClusterPolicy to target all namespaces with training.educates.dev/component label set to environment or session.

[GrahamDumpleton]

So should be able to use something like:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: educates-block-egress-8333
spec:
  background: true
  validationFailureAction: Enforce
  rules:
    - name: block-egress-to-8333-environment-namespaces
      match:
        resources:
          kinds:
            - Namespace
          selector:
            matchLabels:
              training.educates.dev/component: environment
      exclude: {}
      generate:
        kind: NetworkPolicy
        name: educates-block-egress-8333-environment-namespaces
        namespace: "{{request.object.metadata.name}}"
        synchronize: true
        apiVersion: networking.k8s.io/v1
        data:
          spec:
            podSelector: {}
            policyTypes:
              - Egress
            egress:
              - to:
                  - ipBlock:
                      cidr: 0.0.0.0/0
                ports:
                  - protocol: TCP
                    port: 8333
    - name: block-egress-to-8333-session-session-namespaces
      match:
        resources:
          kinds:
            - Namespace
          selector:
            matchLabels:
              training.educates.dev/component: session
      exclude: {}
      generate:
        kind: NetworkPolicy
        name: educates-block-egress-8333-session-namespaces
        namespace: "{{request.object.metadata.name}}"
        synchronize: true
        apiVersion: networking.k8s.io/v1
        data:
          spec:
            podSelector: {}
            policyTypes:
              - Egress
            egress:
              - to:
                  - ipBlock:
                      cidr: 0.0.0.0/0
                ports:
                  - protocol: TCP
                    port: 8333

This would be better way of dealing with it that trying to shoehorn port capability into existing basic blocking capability.