fix: route k8s API through nginx proxy, drop CiliumNetworkPolicy

internal/serviceadapter/informer.go

@@ -48,22 +48,23 @@ func NewLoader(registry *Registry, namespace string) (*Loader, error) {
 	pool := x509.NewCertPool()
 	pool.AppendCertsFromPEM(caBytes)
 
-	// Use env vars injected by kubelet — no DNS dependency
-	host := os.Getenv("KUBERNETES_SERVICE_HOST")
-	port := os.Getenv("KUBERNETES_SERVICE_PORT")
-	if host == "" || port == "" {
-		return nil, fmt.Errorf("KUBERNETES_SERVICE_HOST/PORT not set")
+	// Use kube-api-proxy (nginx) in the same namespace to reach the API server.
+	// This avoids needing direct egress to the API server ClusterIP which
+	// standard NetworkPolicy can't allow through Cilium.
+	proxyHost := os.Getenv("KUBE_API_PROXY_URL")
+	if proxyHost == "" {
+		proxyHost = "https://kube-api-proxy.api.svc.cluster.local:8443"
 	}
 
 	return &Loader{
 		registry:  registry,
 		namespace: namespace,
 		token:     string(tokenBytes),
-		baseURL:   fmt.Sprintf("https://%s:%s", host, port),
+		baseURL:   proxyHost,
 		client: &http.Client{
-			Timeout: 30 * time.Second,
+			Timeout: 10 * time.Second,
 			Transport: &http.Transport{
-				TLSClientConfig: &tls.Config{RootCAs: pool},
+				TLSClientConfig: &tls.Config{RootCAs: pool, InsecureSkipVerify: true},
 			},
 		},
 		stopChan: make(chan struct{}),