* Enhance network policy to isolate synced workload pods and improve cross-cluster pod isolation handling
* Add test for label update on synced Pod to ensure isolation label persistence
* Derive host pod CIDRs dynamically for the isolation NetworkPolicy
Compute the egress-exclude CIDRs from the --cluster-cidr flag or the live
Node PodCIDR(s) via FindPodCIDRs, instead of a hardcoded guess, so cross-cluster
pod isolation is enforced against the host's real pod network. Adds unit,
integration, and e2e coverage.
* update comment
* Sort CIDR list in FindPodCIDRs function to ensure consistent order for egress rules
* Use `t.Context()` instead of `context.Background()`
Co-authored-by: Kevin McDermott <bigkevmcd@gmail.com>
* Use Ginkgo provided context
* Refactor FindPodCIDRs to use sets for CIDR collection and simplify logic
* fix lint
---------
Co-authored-by: Kevin McDermott <bigkevmcd@gmail.com>
