# Allow SNAT'd kubelet health probes into ambient mesh pods
# Istio ambient rewrites kubelet probe source to 169.254.7.127 (link-local)
# so ztunnel can identify and skip these packets. This policy ensures
# CiliumNetworkPolicies don't block the rewritten probe traffic.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: allow-ambient-hostprobes
spec:
  description: "Allows SNAT-ed kubelet health check probes into ambient pods"
  enableDefaultDeny:
    egress: false
    ingress: false
  endpointSelector: {}
  ingress:
    - fromCIDR:
        - "169.254.7.127/32"