compile-and-deploy netpol allows port 2222 (gitlab-shell) and 8181 (webservice) but NOT port 5000 (gitlab-registry). The deps-cache build needs port 5000 to push the resulting image, so kaniko was failing with: dial tcp 10.32.4.209:5000: i/o timeout. ci-pipeline netpol (used by build-ci-image-template, which also pushes to gitlab-registry via kaniko) does allow port 5000 to app: registry. Reuse that label.