# CiliumClusterwideNetworkPolicies — endpointSelector-based only.
# These are safe to apply at any time independently of host-firewall.yaml.
#
# nodeSelector-based host firewall policies (etcd, BGP, SSH, etc.) live
# exclusively in host-firewall.yaml and must be applied as a unit.

---
# Allow all pods to reach the kube-apiserver regardless of which entity identity
# the node IP resolves to (kube-apiserver vs host in K3s embedded mode).
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: allow-kube-apiserver-egress
spec:
  endpointSelector: {}
  egress:
    - toEntities:
        - kube-apiserver
        - host
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
    # API hostname resolves to the OPNsense/HAProxy VIP. Cilium classifies
    # that address as reserved:world/cidr, not kube-apiserver.
    - toCIDR:
        - 10.72.123.235/32
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP

---
# Cilium health checks: covers both node-level probes and the reserved:health
# endpoints that each Cilium agent creates (pod-CIDR IPs, identity=health).
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: allow-cilium-health
spec:
  endpointSelector:
    matchLabels:
      reserved:health: ""
  ingress:
    - fromEntities:
        - remote-node
        - host
  egress:
    - toEntities:
        - remote-node
        - host