From 64723eb0bad0515600be4e1825a95335bebdf4f6 Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Tue, 10 Mar 2026 22:09:55 -0500 Subject: [PATCH] Allow kube-apiserver webhook calls to netbird namespace The netbird-operator webhook service runs in the netbird namespace and receives admission webhook calls from kube-apiserver using node IPs (172.28.101.0/24). Without this, ztunnel rejects the connections with "allow policies exist, but none allowed". Co-Authored-By: Claude Opus 4.6 --- .../istio/manifests/mesh/authorization-policies.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/infrastructure/istio/manifests/mesh/authorization-policies.yaml b/infrastructure/istio/manifests/mesh/authorization-policies.yaml index 9252818..eabe042 100644 --- a/infrastructure/istio/manifests/mesh/authorization-policies.yaml +++ b/infrastructure/istio/manifests/mesh/authorization-policies.yaml @@ -280,6 +280,11 @@ spec: - source: namespaces: - prometheus + # kube-apiserver webhook calls to netbird-operator webhook service (node IPs) + - from: + - source: + ipBlocks: + - "172.28.101.0/24" --- # --- Netbird Operator: Allow intra-namespace + Prometheus ---