From 4dfdbfeb62c76facbb4a9f94e24e129f35f854db Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Fri, 26 Dec 2025 17:44:23 +0300 Subject: [PATCH] fix(tenant): allow egress to parent ingress pods Nested Kubernetes clusters with exposeMethod: Proxied cannot reach their own external domains because the clusterwide egress policy blocks traffic to ingress pods in parent namespaces. This breaks cert-manager HTTP-01 self-check and any scenario where pods need to access services exposed through parent ingress. Add egress rule allowing traffic to ingress pods (cozystack.io/service: ingress) in parent namespaces, following the same pattern as existing vminsert and etcd rules. Co-Authored-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/apps/tenant/templates/networkpolicy.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/packages/apps/tenant/templates/networkpolicy.yaml b/packages/apps/tenant/templates/networkpolicy.yaml index b66e85ffb..2c15a8774 100644 --- a/packages/apps/tenant/templates/networkpolicy.yaml +++ b/packages/apps/tenant/templates/networkpolicy.yaml @@ -67,6 +67,19 @@ spec: {{- end }} {{- end }} {{- end }} + {{- if ne (include "tenant.name" .) "tenant-root" }} + - toEndpoints: + {{- if hasPrefix "tenant-" .Release.Namespace }} + {{- $parts := splitList "-" .Release.Namespace }} + {{- range $i, $v := $parts }} + {{- if ne $i 0 }} + - matchLabels: + cozystack.io/service: ingress + "k8s:io.kubernetes.pod.namespace": {{ join "-" (slice $parts 0 (add $i 1)) }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} --- apiVersion: cilium.io/v2 kind: CiliumClusterwideNetworkPolicy