fix: use CiliumNetworkPolicy for kube-apiserver egress

k8s/cilium-netpol.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-kube-api
+  namespace: api
+spec:
+  endpointSelector:
+    matchLabels:
+      app: api-gateway
+  egress:
+  - toEntities:
+    - kube-apiserver

k8s/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
 - service.yaml
 - deployment.yaml
 - network-policy.yaml
+- cilium-netpol.yaml
 - configmap.yaml
 
 # The deployed image tag lives here and nowhere else. CI publishes

k8s/network-policy.yaml

@@ -30,20 +30,9 @@ spec:
     - protocol: TCP
       port: 8080
   egress:
-  # Allow Kubernetes API server (ServiceAdapter CRD loader)
+  # Kubernetes API server egress is handled by CiliumNetworkPolicy
-  # ClusterIP VIP (10.96.0.1:443) + real control-plane endpoints (port 6443)
+  # (k8s/cilium-netpol.yaml) using toEntities: kube-apiserver.
-  - to:
+  # Standard NetworkPolicy ipBlock doesn't work with Cilium for service VIPs.
-    - ipBlock:
-        cidr: 10.96.0.1/32
-    ports:
-    - protocol: TCP
-      port: 443
-  - to:
-    - ipBlock:
-        cidr: 192.168.1.0/24
-    ports:
-    - protocol: TCP
-      port: 6443
   # Allow DNS
   - to:
     - namespaceSelector: