From 86986013d75288d2b1f0c6e6974ee4f4ef82311d Mon Sep 17 00:00:00 2001 From: poimen Date: Sun, 13 Sep 2026 14:04:35 +0000 Subject: [PATCH] fix: use CiliumNetworkPolicy for kube-apiserver egress (#49) Standard K8s NetworkPolicy ipBlock rules don't work under Cilium for API server access. Use Cilium-native kube-apiserver entity instead. Tested: runner pod can now reach K8s API server. Required by: homelab-frontend PR #25 (Tekton CI). --------- Co-authored-by: rock Reviewed-on: https://forgejo.riotpiao.com/riotpiao-poimen/homelab/pulls/49 Co-authored-by: poimen --- .../templates/cilium-apiserver-egress.yaml | 25 +++++++++++++++++++ .../templates/networkpolicy.yaml | 10 -------- 2 files changed, 25 insertions(+), 10 deletions(-) create mode 100644 k8s/infra/forgejo-runner/templates/cilium-apiserver-egress.yaml diff --git a/k8s/infra/forgejo-runner/templates/cilium-apiserver-egress.yaml b/k8s/infra/forgejo-runner/templates/cilium-apiserver-egress.yaml new file mode 100644 index 0000000..70a1e1c --- /dev/null +++ b/k8s/infra/forgejo-runner/templates/cilium-apiserver-egress.yaml @@ -0,0 +1,25 @@ +# CiliumNetworkPolicy for kube-apiserver access. +# +# Standard K8s NetworkPolicy ipBlock rules don't work for the API server +# under Cilium — the except clause on 192.168.1.0/24 blocks the post-DNAT +# destination even when a separate rule re-allows a /32 or subnet. +# +# Cilium's native `kube-apiserver` entity resolves this correctly: it +# tracks the API server endpoints regardless of ClusterIP vs node-IP +# routing, so the policy stays valid across node changes and NAT paths. +apiVersion: cilium.io/v2 +kind: CiliumNetworkPolicy +metadata: + name: {{ .Release.Name }}-apiserver + namespace: {{ .Release.Namespace }} +spec: + endpointSelector: + matchLabels: + app: {{ .Release.Name }} + egress: + - toEntities: + - kube-apiserver + toPorts: + - ports: + - port: "6443" + protocol: TCP diff --git a/k8s/infra/forgejo-runner/templates/networkpolicy.yaml b/k8s/infra/forgejo-runner/templates/networkpolicy.yaml index 2998562..890de0a 100644 --- a/k8s/infra/forgejo-runner/templates/networkpolicy.yaml +++ b/k8s/infra/forgejo-runner/templates/networkpolicy.yaml @@ -29,16 +29,6 @@ spec: except: - 192.168.1.0/24 - 10.244.0.0/16 - # Kubernetes API server — CI needs kubectl access to create - # Tekton PipelineRuns for integration testing. - # The API server runs on control-plane nodes (192.168.1.0/24); - # we allow port 6443 only to that subnet. - - to: - - ipBlock: - cidr: 192.168.1.0/24 - ports: - - protocol: TCP - port: 6443 # ingress-nginx, which is how forgejo.riotpiao.com resolves (CoreDNS # rewrites that name to ingress-nginx-controller.ingress-nginx.svc). # Image pushes go to that name so the tag matches what containerd pulls