Requesting Egress Domain Based Filtering

[aghassemlouei]

What would you like to be added:

In addition to ip address based network filtering we would like to see domain-based and sni-based filtering. For example:

# Ubuntu Repositories
archive.ubuntu.com
security.ubuntu.com
esm.ubuntu.com
.canonical.com
api.snapcraft.io
.cdn.snapcraftcontent.com

# Certificate Validation
cacerts.digicert.com
ocsp.digicert.com
crl3.digicert.com
crl4.digicert.com
ocsp.pki.goog
crl.pki.goog
crls.pki.goog
.amazontrust.com

Why is this needed:

To comply with US NIST 800-53 R5 SC-7 (8) SYSTEM AND COMMUNICATIONS PROTECTION; BOUNDARY PROTECTION | ROUTE TRAFFIC TO AUTHENTICATED PROXY SERVERS we need to ensure that we have the ability to configure an explicit permit list of known-good or approved domains from our workloads. We are working with our various development teams to incorporate this capability natively into their applications but without this feature we will end up implementing cloud-native solutions such as AWS Firewall or Google Cloud Secure Web Proxy which increases cost and maintenance across our service offerings.