riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

fix: use CiliumNetworkPolicy for kube-apiserver egress #49

Merged
rock merged 1 commits from fix/cilium-apiserver-egress into main 2026-09-13 14:04:36 +00:00
Conversation 0 Commits 1 Files Changed 2
+25 -10
poimen commented 2026-09-13 14:03:25 +00:00
Member
Copy Link
Copy Source

Standard K8s NetworkPolicy ipBlock rules don't work under Cilium for API server access. Use Cilium-native kube-apiserver entity instead.

Tested: runner pod can now reach K8s API server.
Required by: homelab-frontend PR #25 (Tekton CI).

Standard K8s NetworkPolicy ipBlock rules don't work under Cilium for API server access. Use Cilium-native kube-apiserver entity instead. Tested: runner pod can now reach K8s API server. Required by: homelab-frontend PR #25 (Tekton CI).
poimen added 1 commit 2026-09-13 14:03:26 +00:00
fix: use CiliumNetworkPolicy for kube-apiserver egress 6a66e2752f 
Standard K8s NetworkPolicy ipBlock rules don't work under Cilium for
the API server — the except clause on 192.168.1.0/24 blocks the
post-DNAT destination even when a separate rule re-allows the subnet.

Cilium's native kube-apiserver entity tracks API server endpoints
regardless of ClusterIP vs node-IP routing.

Replaces: ipBlock 192.168.1.0/24:6443 (broken under Cilium)
With: CiliumNetworkPolicy toEntities: kube-apiserver (works)
rock merged commit 86986013d7 into main 2026-09-13 14:04:36 +00:00
rock deleted branch fix/cilium-apiserver-egress 2026-09-13 14:04:37 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/event-bus
Event routing and notification pipeline
 area/gateway
API gateway code (homelab-frontend)
 area/notifications
Gotify, SMTP, push notifications
 area/observer
Poimen goal-driven observation and pattern detection
 priority/high
Must have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#49