fix: netpol egress to real API server IPs on port 6443 (Cilium)

2026-08-26 16:18:16 -07:00
parent 18678e988e
commit 8aa22c7e26
1 changed files with 4 additions and 2 deletions
@@ -31,12 +31,14 @@ spec:
      port: 8080
  egress:
  # Allow Kubernetes API server (ServiceAdapter CRD loader)
+  # Cilium doesn't match ipBlock against ClusterIP VIPs, so we target
+  # the real control-plane endpoint IPs on port 6443.
  - to:
    - ipBlock:
-        cidr: 10.96.0.1/32
+        cidr: 192.168.1.0/24
    ports:
    - protocol: TCP
-      port: 443
+      port: 6443
  # Allow DNS
  - to:
    - namespaceSelector: