fix: use CiliumNetworkPolicy for kube-apiserver egress

Standard K8s NetworkPolicy ipBlock rules don't work under Cilium for
the API server — the except clause on 192.168.1.0/24 blocks the
post-DNAT destination even when a separate rule re-allows the subnet.

Cilium's native kube-apiserver entity tracks API server endpoints
regardless of ClusterIP vs node-IP routing.

Replaces: ipBlock 192.168.1.0/24:6443 (broken under Cilium)
With: CiliumNetworkPolicy toEntities: kube-apiserver (works)

k8s/infra/forgejo-runner/templates/cilium-apiserver-egress.yaml

@@ -0,0 +1,25 @@
+# CiliumNetworkPolicy for kube-apiserver access.
+#
+# Standard K8s NetworkPolicy ipBlock rules don't work for the API server
+# under Cilium — the except clause on 192.168.1.0/24 blocks the post-DNAT
+# destination even when a separate rule re-allows a /32 or subnet.
+#
+# Cilium's native `kube-apiserver` entity resolves this correctly: it
+# tracks the API server endpoints regardless of ClusterIP vs node-IP
+# routing, so the policy stays valid across node changes and NAT paths.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-apiserver
+  namespace: {{ .Release.Namespace }}
+spec:
+  endpointSelector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  egress:
+  - toEntities:
+    - kube-apiserver
+    toPorts:
+    - ports:
+      - port: "6443"
+        protocol: TCP

k8s/infra/forgejo-runner/templates/networkpolicy.yaml

@@ -29,16 +29,6 @@ spec:
             except:
               - 192.168.1.0/24
               - 10.244.0.0/16
-    # Kubernetes API server — CI needs kubectl access to create
-    # Tekton PipelineRuns for integration testing.
-    # The API server runs on control-plane nodes (192.168.1.0/24);
-    # we allow port 6443 only to that subnet.
-    - to:
-        - ipBlock:
-            cidr: 192.168.1.0/24
-      ports:
-        - protocol: TCP
-          port: 6443
     # ingress-nginx, which is how forgejo.riotpiao.com resolves (CoreDNS
     # rewrites that name to ingress-nginx-controller.ingress-nginx.svc).
     # Image pushes go to that name so the tag matches what containerd pulls