From 3244fdf611c1f886ee63c107162bde0e5800db12 Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Thu, 12 Mar 2026 23:59:53 -0500 Subject: [PATCH] Allow envoy-gateway-system ingress to vault and authentik All namespaces with CiliumNetworkPolicies need envoy-gateway-system access now that services are migrating from Istio to Envoy gateway. Co-Authored-By: Claude Opus 4.6 --- .../cilium/manifests/network-policies/baseline.yaml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/infrastructure/cilium/manifests/network-policies/baseline.yaml b/infrastructure/cilium/manifests/network-policies/baseline.yaml index 885e096..145fc39 100644 --- a/infrastructure/cilium/manifests/network-policies/baseline.yaml +++ b/infrastructure/cilium/manifests/network-policies/baseline.yaml @@ -22,11 +22,14 @@ spec: - host - kube-apiserver - remote-node - # Istio ingress gateway + # Ingress gateways - fromEndpoints: - matchLabels: k8s:io.kubernetes.pod.namespace: istio-system istio: ingressgateway + - fromEndpoints: + - matchLabels: + k8s:io.kubernetes.pod.namespace: envoy-gateway-system # External Secrets Operator - fromEndpoints: - matchLabels: @@ -55,10 +58,13 @@ spec: - host - kube-apiserver - remote-node - # Istio ingress gateway + # Ingress gateways - fromEndpoints: - matchLabels: k8s:io.kubernetes.pod.namespace: istio-system + - fromEndpoints: + - matchLabels: + k8s:io.kubernetes.pod.namespace: envoy-gateway-system # Internal authentik traffic (server <-> worker, pg access) - fromEndpoints: - matchLabels: