fix(kuma-cni): support port exclusion for UIDs

[lobkovilya]

Kuma Init container supports the following pod annotations:

• traffic.kuma.io/exclude-outbound-tcp-ports-for-uids
• traffic.kuma.io/exclude-outbound-udp-ports-for-uids

but Kuma CNI doesn't. Current PR adds support for these annotations for Kuma CNI.

Ideally, we'd like to converge Kuma CNI and Transparent Proxy code bases to share parsing and config structures.

Checklist prior to review

• Link to relevant issue as well as docs and UI issues --
• This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like syscall.Mkfifo have equivalent implementation on the other OS --
• Tests (Unit test, E2E tests, manual test on universal and k8s) --
  • Don't forget ci/ labels to run additional/fewer tests
• Do you need to update UPGRADE.md? --
• Does it need to be backported according to the backporting policy? (this GH action will add "backport" label based on these file globs, if you want to prevent it from adding the "backport" label use no-backport-autolabel label) --

[slonka]

looks good, two things to consider:

1. have you checked if there are other annotations that are missing parsing and only works in init-containers?
2. should we add a comment in init-container and cni that until Add a more systematic way to add transparent-proxy config #8324 is resolved new annotations need to be added in both places?

[lobkovilya]

1. I looked through the list of annotations, kuma.io/sidecar-uid is missing from CNI. But I assume this is by design since we always set UID to default.
2. Good idea, let me add a comment

[slonka]

I looked through the list of annotations, kuma.io/sidecar-uid is missing from CNI. But I assume this is by design since we always set UID to default.

@bartsmykla this should be configurable as well, right?

edit: https://github.com/kumahq/kuma/pull/2221/files#r659633047

[bartsmykla]

I think it should be configurable as current approach of always setting the default UID is incorrect when we would change via kuma.io/sidecar-uid annotation on pod.

[slonka]

Only

1 test failed out of 144
[It] Advanced LocalityAwareness with MeshLoadBalancingStrategy and Enabled Egress should route based on defined strategy with egress enabled

failed so I'm merging this since improvement for it is already in the branch