fix: netpol allow both ClusterIP VIP and real API server endpoints

2026-08-26 16:19:48 -07:00
parent 8aa22c7e26
commit 4dd188c95c
1 changed files with 7 additions and 2 deletions
@@ -31,8 +31,13 @@ spec:
      port: 8080
  egress:
  # Allow Kubernetes API server (ServiceAdapter CRD loader)
-  # Cilium doesn't match ipBlock against ClusterIP VIPs, so we target
-  # the real control-plane endpoint IPs on port 6443.
+  # ClusterIP VIP (10.96.0.1:443) + real control-plane endpoints (port 6443)
+  - to:
+    - ipBlock:
+        cidr: 10.96.0.1/32
+    ports:
+    - protocol: TCP
+      port: 443
  - to:
    - ipBlock:
        cidr: 192.168.1.0/24