From d51b99add37b3fb6159c8b6928fe9212a1bb13bd Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Wed, 26 Aug 2026 16:21:58 -0700
Subject: [PATCH] fix: use CiliumNetworkPolicy for kube-apiserver egress

---
 k8s/cilium-netpol.yaml  | 12 ++++++++++++
 k8s/kustomization.yaml  |  1 +
 k8s/network-policy.yaml | 17 +++--------------
 3 files changed, 16 insertions(+), 14 deletions(-)
 create mode 100644 k8s/cilium-netpol.yaml

diff --git a/k8s/cilium-netpol.yaml b/k8s/cilium-netpol.yaml
new file mode 100644
index 0000000..8cdc01f
--- /dev/null
+++ b/k8s/cilium-netpol.yaml
@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-kube-api
+  namespace: api
+spec:
+  endpointSelector:
+    matchLabels:
+      app: api-gateway
+  egress:
+  - toEntities:
+    - kube-apiserver
diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml
index 9c99aea..4d2f2bd 100644
--- a/k8s/kustomization.yaml
+++ b/k8s/kustomization.yaml
@@ -9,6 +9,7 @@ resources:
 - service.yaml
 - deployment.yaml
 - network-policy.yaml
+- cilium-netpol.yaml
 - configmap.yaml
 
 # The deployed image tag lives here and nowhere else. CI publishes
diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index 3f013cd..b31dde4 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -30,20 +30,9 @@ spec:
     - protocol: TCP
       port: 8080
   egress:
-  # Allow Kubernetes API server (ServiceAdapter CRD loader)
-  # ClusterIP VIP (10.96.0.1:443) + real control-plane endpoints (port 6443)
-  - to:
-    - ipBlock:
-        cidr: 10.96.0.1/32
-    ports:
-    - protocol: TCP
-      port: 443
-  - to:
-    - ipBlock:
-        cidr: 192.168.1.0/24
-    ports:
-    - protocol: TCP
-      port: 6443
+  # Kubernetes API server egress is handled by CiliumNetworkPolicy
+  # (k8s/cilium-netpol.yaml) using toEntities: kube-apiserver.
+  # Standard NetworkPolicy ipBlock doesn't work with Cilium for service VIPs.
   # Allow DNS
   - to:
     - namespaceSelector: