Tenant namespaces run under a default-deny Cilium egress installed by
the tenant chart, which lets a worker's CDI importer reach the outside
world and kube-dns but nothing in kube-system. The in-sandbox image
mirror is a kube-system Service, so without an explicit allow the
importer's connect to its ClusterIP is dropped and the worker disk
import never starts.
Ship a tightly-scoped CiliumClusterwideNetworkPolicy in the mirror
manifest that lets importer Pods in tenant-test egress to the mirror
Pod in kube-system. Cilium unions allow rules, so this only adds a
hole; scoping it to tenant-test (already under default-deny egress)
means it never flips another namespace's posture, and the mirror Pod
needs no ingress rule because it is selected by no ingress policy. The
policy is kept out of the pre-install apply because that runs before
Cilium's CRDs exist; the resolver in hack/e2e-apps/talos-image-cache.sh
applies it at point-of-use once Cilium is up.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Aleksei Sviridkin
1a0680b778