fix: route k8s API through nginx proxy, drop CiliumNetworkPolicy

2026-08-26 16:24:43 -07:00
parent d51b99add3
commit 977058d0b0
5 changed files with 102 additions and 24 deletions
@@ -30,9 +30,14 @@ spec:
    - protocol: TCP
      port: 8080
  egress:
-  # Kubernetes API server egress is handled by CiliumNetworkPolicy
-  # (k8s/cilium-netpol.yaml) using toEntities: kube-apiserver.
-  # Standard NetworkPolicy ipBlock doesn't work with Cilium for service VIPs.
+  # Kubernetes API server (via kube-api-proxy nginx in same namespace)
+  - to:
+    - podSelector:
+        matchLabels:
+          app: kube-api-proxy
+    ports:
+    - protocol: TCP
+      port: 8443
  # Allow DNS
  - to:
    - namespaceSelector: