ce7cb702218693d08ea6d83464d2457c9250027c

vendor/infrastructure/cilium/config/policies/global.yaml

@@ -0,0 +1,51 @@
+# CiliumClusterwideNetworkPolicies — endpointSelector-based only.
+# These are safe to apply at any time independently of host-firewall.yaml.
+#
+# nodeSelector-based host firewall policies (etcd, BGP, SSH, etc.) live
+# exclusively in host-firewall.yaml and must be applied as a unit.
+
+---
+# Allow all pods to reach the kube-apiserver regardless of which entity identity
+# the node IP resolves to (kube-apiserver vs host in K3s embedded mode).
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-kube-apiserver-egress
+spec:
+  endpointSelector: {}
+  egress:
+    - toEntities:
+        - kube-apiserver
+        - host
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    # API hostname resolves to the OPNsense/HAProxy VIP. Cilium classifies
+    # that address as reserved:world/cidr, not kube-apiserver.
+    - toCIDR:
+        - 10.72.123.235/32
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+
+---
+# Cilium health checks: covers both node-level probes and the reserved:health
+# endpoints that each Cilium agent creates (pod-CIDR IPs, identity=health).
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-cilium-health
+spec:
+  endpointSelector:
+    matchLabels:
+      reserved:health: ""
+  ingress:
+    - fromEntities:
+        - remote-node
+        - host
+  egress:
+    - toEntities:
+        - remote-node
+        - host