fix(networkpolicy): allow all egress for API server access

NetworkPolicy cannot select host-network endpoints and the API server
port is configurable, so allow unrestricted egress. Remove APIServerPort
from PlatformParams. Admin network policy could improve this later but
would break third-party SDNs.

Signed-off-by: Khurram Baig <kbaig@redhat.com>
Assisted-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: khrm

pkg/reconciler/common/networkpolicy/networkpolicy.go

@@ -123,16 +123,11 @@ func DNSEgressRule(p PlatformParams) networkingv1.NetworkPolicyEgressRule {
 	}
 }
 
-// APIServerEgressRule allows egress to the API server on the platform-specific port (443 on
-// Kubernetes, 6443 on OpenShift). No To restriction — API server is behind a ClusterIP service.
-func APIServerEgressRule(p PlatformParams) networkingv1.NetworkPolicyEgressRule {
-	tcp := corev1.ProtocolTCP
-	apiPort := intstr.FromInt32(p.APIServerPort)
-	return networkingv1.NetworkPolicyEgressRule{
-		Ports: []networkingv1.NetworkPolicyPort{
-			{Protocol: &tcp, Port: &apiPort},
-		},
-	}
+// APIServerEgressRule allows all egress so pods can reach the API server.
+// NetworkPolicy cannot select host-network endpoints, and the API server
+// port is configurable, so we must allow unrestricted egress.
+func APIServerEgressRule() networkingv1.NetworkPolicyEgressRule {
+	return networkingv1.NetworkPolicyEgressRule{}
 }
 
 // InternetEgressRule allows egress on TCP 80 and 443 to any destination.

pkg/reconciler/common/networkpolicy/networkpolicy_test.go

@@ -177,25 +177,13 @@ func TestInternetEgressRule(t *testing.T) {
 	}
 }
 
-func TestAPIServerEgressRule_Kubernetes(t *testing.T) {
-	params := networkpolicy.KubernetesPlatformDefaults()
-	rule := networkpolicy.APIServerEgressRule(params)
-	if len(rule.Ports) != 1 || rule.Ports[0].Port.IntVal != 443 {
-		t.Fatalf("expected port 443 for Kubernetes, got %v", rule.Ports)
-	}
-	if len(rule.To) != 0 {
-		t.Errorf("expected no To restriction for API server egress, got %v", rule.To)
-	}
-}
-
-func TestAPIServerEgressRule_OpenShift(t *testing.T) {
-	params := networkpolicy.OpenShiftPlatformDefaults()
-	rule := networkpolicy.APIServerEgressRule(params)
-	if len(rule.Ports) != 1 || rule.Ports[0].Port.IntVal != 6443 {
-		t.Fatalf("expected port 6443 for OpenShift, got %v", rule.Ports)
+func TestAPIServerEgressRule(t *testing.T) {
+	rule := networkpolicy.APIServerEgressRule()
+	if len(rule.Ports) != 0 {
+		t.Errorf("expected no port restriction (allow all), got %v", rule.Ports)
 	}
 	if len(rule.To) != 0 {
-		t.Errorf("expected no To restriction for API server egress, got %v", rule.To)
+		t.Errorf("expected no To restriction (allow all), got %v", rule.To)
 	}
 }
 

pkg/reconciler/common/networkpolicy/platform.go

@@ -25,8 +25,6 @@ type PlatformParams struct {
 	// DNSPort is the DNS resolver pod port. Kubernetes CoreDNS uses 53; OpenShift DNS
 	// uses 5353 (OVN-K8s enforces NetworkPolicy after DNAT, so pod port applies).
 	DNSPort int32
-	// APIServerPort is the kubernetes.default.svc port: 443 on Kubernetes, 6443 on OpenShift.
-	APIServerPort int32
 }
 
 // KubernetesPlatformDefaults returns PlatformParams for vanilla Kubernetes.
@@ -36,7 +34,6 @@ func KubernetesPlatformDefaults() PlatformParams {
 		DNSResolverPodLabel:      map[string]string{"k8s-app": "kube-dns"},
 		PrometheusNamespaceLabel: map[string]string{"kubernetes.io/metadata.name": "monitoring"},
 		DNSPort:                  53,
-		APIServerPort:            443,
 	}
 }
 
@@ -47,6 +44,5 @@ func OpenShiftPlatformDefaults() PlatformParams {
 		DNSResolverPodLabel:      map[string]string{"dns.operator.openshift.io/daemonset-dns": "default"},
 		PrometheusNamespaceLabel: map[string]string{"openshift.io/cluster-monitoring": "true"},
 		DNSPort:                  5353,
-		APIServerPort:            6443,
 	}
 }

pkg/reconciler/kubernetes/tektonpipeline/networkpolicies.go

@@ -58,7 +58,7 @@ func proxyWebhookDefaultPolicies(params networkpolicy.PlatformParams) []networki
 				},
 				Egress: []networkingv1.NetworkPolicyEgressRule{
 					networkpolicy.DNSEgressRule(params),
-					networkpolicy.APIServerEgressRule(params),
+					networkpolicy.APIServerEgressRule(),
 				},
 			},
 		},

pkg/reconciler/kubernetes/tektontrigger/networkpolicies.go

@@ -48,7 +48,7 @@ func triggersDefaultPolicies(params networkpolicy.PlatformParams) []networkingv1
 				},
 				Egress: []networkingv1.NetworkPolicyEgressRule{
 					networkpolicy.DNSEgressRule(params),
-					networkpolicy.APIServerEgressRule(params),
+					networkpolicy.APIServerEgressRule(),
 				},
 			},
 		},
@@ -66,7 +66,7 @@ func triggersDefaultPolicies(params networkpolicy.PlatformParams) []networkingv1
 				},
 				Egress: []networkingv1.NetworkPolicyEgressRule{
 					networkpolicy.DNSEgressRule(params),
-					networkpolicy.APIServerEgressRule(params),
+					networkpolicy.APIServerEgressRule(),
 				},
 			},
 		},
@@ -91,7 +91,7 @@ func triggersDefaultPolicies(params networkpolicy.PlatformParams) []networkingv1
 				},
 				Egress: []networkingv1.NetworkPolicyEgressRule{
 					networkpolicy.DNSEgressRule(params),
-					networkpolicy.APIServerEgressRule(params),
+					networkpolicy.APIServerEgressRule(),
 					// Allow egress to external APIs (e.g. GitHub) for file fetching and validation.
 					networkpolicy.InternetEgressRule(),
 				},