fix(networkpolicy): allow all egress for API server access

docs/NetworkPolicy.md

@@ -45,20 +45,20 @@ to the operand namespace (e.g. `tekton-pipelines` or `openshift-pipelines`):
 | `tekton-default-deny` | deny all | — | All pods with `app.kubernetes.io/part-of: tekton-triggers` |
 | `triggers-controller` | ingress | TCP/9000 | Prometheus namespace |
 | | egress | UDP+TCP/53 (K8s) or 5353 (OpenShift) | DNS resolver pods |
-| | egress | TCP/443 (K8s) or 6443 (OpenShift) | API server |
+| | egress | all | API server (all egress allowed — NP cannot select host-network endpoints) |
 | `triggers-webhook` | ingress | TCP/8443 | Any (admission webhook) |
 | | ingress | TCP/9000 | Prometheus namespace |
 | | egress | UDP+TCP/53 or 5353 | DNS resolver pods |
-| | egress | TCP/443 or 6443 | API server |
+| | egress | all | API server (all egress allowed — NP cannot select host-network endpoints) |
 | `triggers-core-interceptors` | ingress | TCP/8443 | All namespaces (EventListeners) |
 | | ingress | TCP/9000 | Prometheus namespace |
 | | egress | UDP+TCP/53 or 5353 | DNS resolver pods |
-| | egress | TCP/443 or 6443 | API server |
+| | egress | all | API server (all egress allowed — NP cannot select host-network endpoints) |
 | | egress | TCP/80, 443 | Any (external APIs e.g. GitHub) |
 | `tekton-proxy-webhook-default-deny` | deny all | — | All pods with `name: tekton-operator` (proxy-webhook) in the Pipeline target namespace |
 | `proxy-webhook` | ingress | TCP/8443 | Any (admission webhook) |
 | | egress | UDP+TCP/53 or 5353 | DNS resolver pods |
-| | egress | TCP/443 or 6443 | API server |
+| | egress | all | API server (all egress allowed — NP cannot select host-network endpoints) |
 
 The `proxy-webhook` policies apply to the TektonPipeline target namespace (e.g.
 `tekton-pipelines` or `openshift-pipelines`), where the operator deploys the
@@ -73,7 +73,6 @@ NetworkPolicies as part of the operator's own install manifests/bundle (see
 |---|---|---|
 | DNS port | 53 | 5353 |
 | DNS namespace | `kube-system` | `openshift-dns` |
-| API server port | 443 | 6443 |
 | Prometheus namespace label | `kubernetes.io/metadata.name: monitoring` | `openshift.io/cluster-monitoring: "true"` |
 
 ## Operator's own namespace
@@ -95,10 +94,10 @@ the operator's bundle never affects unrelated pods that might share the namespac
 |---|---|---|---|
 | `tekton-operator` / `openshift-pipelines-operator` | ingress | TCP/9090 | Prometheus namespace |
 | | egress | UDP+TCP/53 or 5353 | DNS resolver pods |
-| | egress | TCP/443 or 6443 | API server |
+| | egress | all | API server (all egress allowed — NP cannot select host-network endpoints) |
 | `tekton-operator-webhook` | ingress | TCP/8443 | Any (admission webhook) |
 | | egress | UDP+TCP/53 or 5353 | DNS resolver pods |
-| | egress | TCP/443 or 6443 | API server |
+| | egress | all | API server (all egress allowed — NP cannot select host-network endpoints) |
 
 **OpenShift caveat**: `openshift-operators` is a shared namespace where OLM installs
 operators from OperatorHub, many of which ship no NetworkPolicy of their own. To

pkg/reconciler/common/networkpolicy/networkpolicy.go

@@ -123,16 +123,11 @@ func DNSEgressRule(p PlatformParams) networkingv1.NetworkPolicyEgressRule {
 	}
 }
 
-// APIServerEgressRule allows egress to the API server on the platform-specific port (443 on
-// Kubernetes, 6443 on OpenShift). No To restriction — API server is behind a ClusterIP service.
-func APIServerEgressRule(p PlatformParams) networkingv1.NetworkPolicyEgressRule {
-	tcp := corev1.ProtocolTCP
-	apiPort := intstr.FromInt32(p.APIServerPort)
-	return networkingv1.NetworkPolicyEgressRule{
-		Ports: []networkingv1.NetworkPolicyPort{
-			{Protocol: &tcp, Port: &apiPort},
-		},
-	}
+// APIServerEgressRule allows all egress so pods can reach the API server.
+// NetworkPolicy cannot select host-network endpoints, and the API server
+// port is configurable, so we must allow unrestricted egress.
+func APIServerEgressRule() networkingv1.NetworkPolicyEgressRule {
+	return networkingv1.NetworkPolicyEgressRule{}
 }
 
 // InternetEgressRule allows egress on TCP 80 and 443 to any destination.

pkg/reconciler/common/networkpolicy/networkpolicy_test.go

@@ -177,25 +177,13 @@ func TestInternetEgressRule(t *testing.T) {
 	}
 }
 
-func TestAPIServerEgressRule_Kubernetes(t *testing.T) {
-	params := networkpolicy.KubernetesPlatformDefaults()
-	rule := networkpolicy.APIServerEgressRule(params)
-	if len(rule.Ports) != 1 || rule.Ports[0].Port.IntVal != 443 {
-		t.Fatalf("expected port 443 for Kubernetes, got %v", rule.Ports)
-	}
-	if len(rule.To) != 0 {
-		t.Errorf("expected no To restriction for API server egress, got %v", rule.To)
-	}
-}
-
-func TestAPIServerEgressRule_OpenShift(t *testing.T) {
-	params := networkpolicy.OpenShiftPlatformDefaults()
-	rule := networkpolicy.APIServerEgressRule(params)
-	if len(rule.Ports) != 1 || rule.Ports[0].Port.IntVal != 6443 {
-		t.Fatalf("expected port 6443 for OpenShift, got %v", rule.Ports)
+func TestAPIServerEgressRule(t *testing.T) {
+	rule := networkpolicy.APIServerEgressRule()
+	if len(rule.Ports) != 0 {
+		t.Errorf("expected no port restriction (allow all), got %v", rule.Ports)
 	}
 	if len(rule.To) != 0 {
-		t.Errorf("expected no To restriction for API server egress, got %v", rule.To)
+		t.Errorf("expected no To restriction (allow all), got %v", rule.To)
 	}
 }
 

pkg/reconciler/common/networkpolicy/platform.go

@@ -25,8 +25,6 @@ type PlatformParams struct {
 	// DNSPort is the DNS resolver pod port. Kubernetes CoreDNS uses 53; OpenShift DNS
 	// uses 5353 (OVN-K8s enforces NetworkPolicy after DNAT, so pod port applies).
 	DNSPort int32
-	// APIServerPort is the kubernetes.default.svc port: 443 on Kubernetes, 6443 on OpenShift.
-	APIServerPort int32
 }
 
 // KubernetesPlatformDefaults returns PlatformParams for vanilla Kubernetes.
@@ -36,7 +34,6 @@ func KubernetesPlatformDefaults() PlatformParams {
 		DNSResolverPodLabel:      map[string]string{"k8s-app": "kube-dns"},
 		PrometheusNamespaceLabel: map[string]string{"kubernetes.io/metadata.name": "monitoring"},
 		DNSPort:                  53,
-		APIServerPort:            443,
 	}
 }
 
@@ -47,6 +44,5 @@ func OpenShiftPlatformDefaults() PlatformParams {
 		DNSResolverPodLabel:      map[string]string{"dns.operator.openshift.io/daemonset-dns": "default"},
 		PrometheusNamespaceLabel: map[string]string{"openshift.io/cluster-monitoring": "true"},
 		DNSPort:                  5353,
-		APIServerPort:            6443,
 	}
 }

pkg/reconciler/kubernetes/tektonpipeline/networkpolicies.go

@@ -58,7 +58,7 @@ func proxyWebhookDefaultPolicies(params networkpolicy.PlatformParams) []networki
 				},
 				Egress: []networkingv1.NetworkPolicyEgressRule{
 					networkpolicy.DNSEgressRule(params),
-					networkpolicy.APIServerEgressRule(params),
+					networkpolicy.APIServerEgressRule(),
 				},
 			},
 		},

pkg/reconciler/kubernetes/tektontrigger/networkpolicies.go

@@ -48,7 +48,7 @@ func triggersDefaultPolicies(params networkpolicy.PlatformParams) []networkingv1
 				},
 				Egress: []networkingv1.NetworkPolicyEgressRule{
 					networkpolicy.DNSEgressRule(params),
-					networkpolicy.APIServerEgressRule(params),
+					networkpolicy.APIServerEgressRule(),
 				},
 			},
 		},
@@ -66,7 +66,7 @@ func triggersDefaultPolicies(params networkpolicy.PlatformParams) []networkingv1
 				},
 				Egress: []networkingv1.NetworkPolicyEgressRule{
 					networkpolicy.DNSEgressRule(params),
-					networkpolicy.APIServerEgressRule(params),
+					networkpolicy.APIServerEgressRule(),
 				},
 			},
 		},
@@ -91,7 +91,7 @@ func triggersDefaultPolicies(params networkpolicy.PlatformParams) []networkingv1
 				},
 				Egress: []networkingv1.NetworkPolicyEgressRule{
 					networkpolicy.DNSEgressRule(params),
-					networkpolicy.APIServerEgressRule(params),
+					networkpolicy.APIServerEgressRule(),
 					// Allow egress to external APIs (e.g. GitHub) for file fetching and validation.
 					networkpolicy.InternetEgressRule(),
 				},