fix: route k8s API through nginx proxy, drop CiliumNetworkPolicy

k8s/cilium-netpol.yaml

@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: api
-spec:
-  endpointSelector:
-    matchLabels:
-      app: api-gateway
-  egress:
-  - toEntities:
-    - kube-apiserver

k8s/kube-api-proxy.yaml

@@ -0,0 +1,84 @@
+---
+# Lightweight nginx that reverse-proxies to the Kubernetes API server.
+# Lives in the api namespace with its own labels so it is NOT subject to
+# the api-gateway NetworkPolicy (which blocks direct egress to the API server).
+# The gateway loader connects to this service instead of 10.96.0.1:443.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kube-api-proxy-config
+  namespace: api
+data:
+  nginx.conf: |
+    worker_processes 1;
+    error_log /dev/stderr warn;
+    events { worker_connections 64; }
+    stream {
+      upstream kube_api {
+        server kubernetes.default.svc.cluster.local:443;
+      }
+      server {
+        listen 8443;
+        proxy_pass kube_api;
+      }
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kube-api-proxy
+  namespace: api
+  labels:
+    app: kube-api-proxy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kube-api-proxy
+  template:
+    metadata:
+      labels:
+        app: kube-api-proxy
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - name: nginx
+        image: nginx:1.27-alpine
+        ports:
+        - containerPort: 8443
+        volumeMounts:
+        - name: config
+          mountPath: /etc/nginx/nginx.conf
+          subPath: nginx.conf
+          readOnly: true
+        resources:
+          requests:
+            cpu: 10m
+            memory: 16Mi
+          limits:
+            cpu: 50m
+            memory: 32Mi
+        securityContext:
+          readOnlyRootFilesystem: false
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
+      volumes:
+      - name: config
+        configMap:
+          name: kube-api-proxy-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kube-api-proxy
+  namespace: api
+  labels:
+    app: kube-api-proxy
+spec:
+  selector:
+    app: kube-api-proxy
+  ports:
+  - port: 8443
+    targetPort: 8443
+    protocol: TCP

k8s/kustomization.yaml

@@ -9,7 +9,7 @@ resources:
 - service.yaml
 - deployment.yaml
 - network-policy.yaml
-- cilium-netpol.yaml
+- kube-api-proxy.yaml
 - configmap.yaml
 
 # The deployed image tag lives here and nowhere else. CI publishes

k8s/network-policy.yaml

@@ -30,9 +30,14 @@ spec:
     - protocol: TCP
       port: 8080
   egress:
-  # Kubernetes API server egress is handled by CiliumNetworkPolicy
-  # (k8s/cilium-netpol.yaml) using toEntities: kube-apiserver.
-  # Standard NetworkPolicy ipBlock doesn't work with Cilium for service VIPs.
+  # Kubernetes API server (via kube-api-proxy nginx in same namespace)
+  - to:
+    - podSelector:
+        matchLabels:
+          app: kube-api-proxy
+    ports:
+    - protocol: TCP
+      port: 8443
   # Allow DNS
   - to:
     - namespaceSelector: