From 4dd188c95cebf5d45531346e1bb7aaf2281839c8 Mon Sep 17 00:00:00 2001 From: Admin Bot Date: Wed, 26 Aug 2026 16:19:48 -0700 Subject: [PATCH] fix: netpol allow both ClusterIP VIP and real API server endpoints --- k8s/network-policy.yaml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml index 7544059..3f013cd 100644 --- a/k8s/network-policy.yaml +++ b/k8s/network-policy.yaml @@ -31,8 +31,13 @@ spec: port: 8080 egress: # Allow Kubernetes API server (ServiceAdapter CRD loader) - # Cilium doesn't match ipBlock against ClusterIP VIPs, so we target - # the real control-plane endpoint IPs on port 6443. + # ClusterIP VIP (10.96.0.1:443) + real control-plane endpoints (port 6443) + - to: + - ipBlock: + cidr: 10.96.0.1/32 + ports: + - protocol: TCP + port: 443 - to: - ipBlock: cidr: 192.168.1.0/24