mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
18 lines
597 B
YAML
18 lines
597 B
YAML
# Allow SNAT'd kubelet health probes into ambient mesh pods
|
|
# Istio ambient rewrites kubelet probe source to 169.254.7.127 (link-local)
|
|
# so ztunnel can identify and skip these packets. This policy ensures
|
|
# CiliumNetworkPolicies don't block the rewritten probe traffic.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumClusterwideNetworkPolicy
|
|
metadata:
|
|
name: allow-ambient-hostprobes
|
|
spec:
|
|
description: "Allows SNAT-ed kubelet health check probes into ambient pods"
|
|
enableDefaultDeny:
|
|
egress: false
|
|
ingress: false
|
|
endpointSelector: {}
|
|
ingress:
|
|
- fromCIDR:
|
|
- "169.254.7.127/32"
|