feat/ci-k8s-api-egress
main
CI needs kubectl access to create Tekton PipelineRuns for integration testing. The API server runs on control-plane nodes in 192.168.1.0/24 which was blocked by the existing except rule. Allow port 6443 to 192.168.1.0/24 (control-plane subnet only).