1. Embed toPorts into the From* and To* structures to make the L3 dependant L4 part obvious and explicitly require the user to specify the wildcard if wanted. This will make it super obvious what is going on at all times.
2. Declare the IngressRule and EgressRule a union which means that only one of FromEndpoints, FromRequires, FromCIDR and FromEntities can be specified. This makes it super obvious that there is no point in combing label based source selector and CIDR based source rules.
3. Only add ToPorts to the From* and To* fields that support L3 dependant L4. This means we would currently exclude FromCIDR and ToCIDR until we have added support for it.

Example:

  endpointSelector:
    matchLabels:
      role: backend
  ingress:
  - fromEndpoints:
    - toPorts:
      - ports:
        - port: "80"
          protocol: TCP