From c1997152766ac0fdc9068905a0547bd28349df57 Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Thu, 12 Mar 2026 23:24:26 -0500 Subject: [PATCH] Allow envoy-gateway-system ingress to rook-ceph for dashboard The Ceph dashboard moved from Istio to the Envoy edge gateway but the CiliumNetworkPolicy was still only allowing istio-system, causing 503s. Co-Authored-By: Claude Opus 4.6 --- .../cilium/manifests/network-policies/baseline.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/infrastructure/cilium/manifests/network-policies/baseline.yaml b/infrastructure/cilium/manifests/network-policies/baseline.yaml index 24315e7..885e096 100644 --- a/infrastructure/cilium/manifests/network-policies/baseline.yaml +++ b/infrastructure/cilium/manifests/network-policies/baseline.yaml @@ -139,10 +139,13 @@ spec: - host - kube-apiserver - remote-node - # Istio ingress gateway (Ceph dashboard) + # Ingress gateways (Ceph dashboard) - fromEndpoints: - matchLabels: k8s:io.kubernetes.pod.namespace: istio-system + - fromEndpoints: + - matchLabels: + k8s:io.kubernetes.pod.namespace: envoy-gateway-system # Internal Ceph traffic - fromEndpoints: - matchLabels: