From 6a66e2752f9de3eb3c2a52d559291649d58b4460 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Sun, 13 Sep 2026 23:03:20 +0900
Subject: [PATCH] fix: use CiliumNetworkPolicy for kube-apiserver egress
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Standard K8s NetworkPolicy ipBlock rules don't work under Cilium for
the API server — the except clause on 192.168.1.0/24 blocks the
post-DNAT destination even when a separate rule re-allows the subnet.

Cilium's native kube-apiserver entity tracks API server endpoints
regardless of ClusterIP vs node-IP routing.

Replaces: ipBlock 192.168.1.0/24:6443 (broken under Cilium)
With: CiliumNetworkPolicy toEntities: kube-apiserver (works)
---
 .../templates/cilium-apiserver-egress.yaml    | 25 +++++++++++++++++++
 .../templates/networkpolicy.yaml              | 10 --------
 2 files changed, 25 insertions(+), 10 deletions(-)
 create mode 100644 k8s/infra/forgejo-runner/templates/cilium-apiserver-egress.yaml

diff --git a/k8s/infra/forgejo-runner/templates/cilium-apiserver-egress.yaml b/k8s/infra/forgejo-runner/templates/cilium-apiserver-egress.yaml
new file mode 100644
index 0000000..70a1e1c
--- /dev/null
+++ b/k8s/infra/forgejo-runner/templates/cilium-apiserver-egress.yaml
@@ -0,0 +1,25 @@
+# CiliumNetworkPolicy for kube-apiserver access.
+#
+# Standard K8s NetworkPolicy ipBlock rules don't work for the API server
+# under Cilium — the except clause on 192.168.1.0/24 blocks the post-DNAT
+# destination even when a separate rule re-allows a /32 or subnet.
+#
+# Cilium's native `kube-apiserver` entity resolves this correctly: it
+# tracks the API server endpoints regardless of ClusterIP vs node-IP
+# routing, so the policy stays valid across node changes and NAT paths.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-apiserver
+  namespace: {{ .Release.Namespace }}
+spec:
+  endpointSelector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  egress:
+  - toEntities:
+    - kube-apiserver
+    toPorts:
+    - ports:
+      - port: "6443"
+        protocol: TCP
diff --git a/k8s/infra/forgejo-runner/templates/networkpolicy.yaml b/k8s/infra/forgejo-runner/templates/networkpolicy.yaml
index 2998562..890de0a 100644
--- a/k8s/infra/forgejo-runner/templates/networkpolicy.yaml
+++ b/k8s/infra/forgejo-runner/templates/networkpolicy.yaml
@@ -29,16 +29,6 @@ spec:
             except:
               - 192.168.1.0/24
               - 10.244.0.0/16
-    # Kubernetes API server — CI needs kubectl access to create
-    # Tekton PipelineRuns for integration testing.
-    # The API server runs on control-plane nodes (192.168.1.0/24);
-    # we allow port 6443 only to that subnet.
-    - to:
-        - ipBlock:
-            cidr: 192.168.1.0/24
-      ports:
-        - protocol: TCP
-          port: 6443
     # ingress-nginx, which is how forgejo.riotpiao.com resolves (CoreDNS
     # rewrites that name to ingress-nginx-controller.ingress-nginx.svc).
     # Image pushes go to that name so the tag matches what containerd pulls