From 92ef7e21ec0525a4a35d54c888495e5ebfb9fa82 Mon Sep 17 00:00:00 2001 From: jgrusewski Date: Wed, 4 Mar 2026 13:10:18 +0100 Subject: [PATCH] feat(infra): api-gateway K8s API egress for pod listing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Allow api-gateway to reach the Kubernetes API server for pod listing (Pods cockpit). Two CIDR blocks are needed because Cilium applies NetworkPolicy after DNAT: - 10.32.0.0/12:443 — kubernetes.default.svc ClusterIP - 172.16.0.0/16:6443 — real node IP after Cilium DNAT Co-Authored-By: Claude Opus 4.6 --- infra/k8s/network-policies/api-gateway.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/infra/k8s/network-policies/api-gateway.yaml b/infra/k8s/network-policies/api-gateway.yaml index 0135feed0..68e2aed65 100644 --- a/infra/k8s/network-policies/api-gateway.yaml +++ b/infra/k8s/network-policies/api-gateway.yaml @@ -102,3 +102,16 @@ spec: ports: - protocol: TCP port: 9000 + # Kubernetes API (pod listing for Pods cockpit) + - to: + - ipBlock: + cidr: 10.32.0.0/12 + ports: + - protocol: TCP + port: 443 + - to: + - ipBlock: + cidr: 172.16.0.0/16 + ports: + - protocol: TCP + port: 6443