fix: use CiliumNetworkPolicy for kube-apiserver egress

k8s/network-policy.yaml

@@ -30,20 +30,9 @@ spec:
     - protocol: TCP
       port: 8080
   egress:
-  # Allow Kubernetes API server (ServiceAdapter CRD loader)
-  # ClusterIP VIP (10.96.0.1:443) + real control-plane endpoints (port 6443)
-  - to:
-    - ipBlock:
-        cidr: 10.96.0.1/32
-    ports:
-    - protocol: TCP
-      port: 443
-  - to:
-    - ipBlock:
-        cidr: 192.168.1.0/24
-    ports:
-    - protocol: TCP
-      port: 6443
+  # Kubernetes API server egress is handled by CiliumNetworkPolicy
+  # (k8s/cilium-netpol.yaml) using toEntities: kube-apiserver.
+  # Standard NetworkPolicy ipBlock doesn't work with Cilium for service VIPs.
   # Allow DNS
   - to:
     - namespaceSelector: