Initial commit

infrastructure/cilium/manifests/network-policies/health-probes.yaml

@@ -0,0 +1,17 @@
+# Allow SNAT'd kubelet health probes into ambient mesh pods
+# Istio ambient rewrites kubelet probe source to 169.254.7.127 (link-local)
+# so ztunnel can identify and skip these packets. This policy ensures
+# CiliumNetworkPolicies don't block the rewritten probe traffic.
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-ambient-hostprobes
+spec:
+  description: "Allows SNAT-ed kubelet health check probes into ambient pods"
+  enableDefaultDeny:
+    egress: false
+    ingress: false
+  endpointSelector: {}
+  ingress:
+    - fromCIDR:
+        - "169.254.7.127/32"