fix: use CiliumNetworkPolicy for kube-apiserver egress

2026-08-26 16:21:58 -07:00
parent 4dd188c95c
commit d51b99add3
3 changed files with 16 additions and 14 deletions
@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-kube-api
+  namespace: api
+spec:
+  endpointSelector:
+    matchLabels:
+      app: api-gateway
+  egress:
+  - toEntities:
+    - kube-apiserver
@@ -9,6 +9,7 @@ resources:
 - service.yaml
 - deployment.yaml
 - network-policy.yaml
+- cilium-netpol.yaml
 - configmap.yaml

 # The deployed image tag lives here and nowhere else. CI publishes
@@ -30,20 +30,9 @@ spec:
    - protocol: TCP
      port: 8080
  egress:
-  # Allow Kubernetes API server (ServiceAdapter CRD loader)
-  # ClusterIP VIP (10.96.0.1:443) + real control-plane endpoints (port 6443)
-  - to:
-    - ipBlock:
-        cidr: 10.96.0.1/32
-    ports:
-    - protocol: TCP
-      port: 443
-  - to:
-    - ipBlock:
-        cidr: 192.168.1.0/24
-    ports:
-    - protocol: TCP
-      port: 6443
+  # Kubernetes API server egress is handled by CiliumNetworkPolicy
+  # (k8s/cilium-netpol.yaml) using toEntities: kube-apiserver.
+  # Standard NetworkPolicy ipBlock doesn't work with Cilium for service VIPs.
  # Allow DNS
  - to:
    - namespaceSelector: