From 8aa22c7e267fc6beb09858ca2a7e7ec633f5be0b Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Wed, 26 Aug 2026 16:18:16 -0700
Subject: [PATCH] fix: netpol egress to real API server IPs on port 6443
 (Cilium)

---
 k8s/network-policy.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index 1c1ecdc..7544059 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -31,12 +31,14 @@ spec:
       port: 8080
   egress:
   # Allow Kubernetes API server (ServiceAdapter CRD loader)
+  # Cilium doesn't match ipBlock against ClusterIP VIPs, so we target
+  # the real control-plane endpoint IPs on port 6443.
   - to:
     - ipBlock:
-        cidr: 10.96.0.1/32
+        cidr: 192.168.1.0/24
     ports:
     - protocol: TCP
-      port: 443
+      port: 6443
   # Allow DNS
   - to:
     - namespaceSelector: