fix: use CiliumNetworkPolicy for kube-apiserver egress (#49)

Standard K8s NetworkPolicy ipBlock rules don't work under Cilium for API server access. Use Cilium-native kube-apiserver entity instead. Tested: runner pod can now reach K8s API server. Required by: homelab-frontend PR #25 (Tekton CI). --------- Co-authored-by: rock <[email protected]> Reviewed-on: #49 Co-authored-by: poimen <[email protected]>
2026-09-13 14:04:35 +00:00
parent 4b5ecfcd49
commit 86986013d7
2 changed files with 25 additions and 10 deletions
@@ -29,16 +29,6 @@ spec:
            except:
              - 192.168.1.0/24
              - 10.244.0.0/16
-    # Kubernetes API server — CI needs kubectl access to create
-    # Tekton PipelineRuns for integration testing.
-    # The API server runs on control-plane nodes (192.168.1.0/24);
-    # we allow port 6443 only to that subnet.
-    - to:
-        - ipBlock:
-            cidr: 192.168.1.0/24
-      ports:
-        - protocol: TCP
-          port: 6443
    # ingress-nginx, which is how forgejo.riotpiao.com resolves (CoreDNS
    # rewrites that name to ingress-nginx-controller.ingress-nginx.svc).
    # Image pushes go to that name so the tag matches what containerd pulls