fix: allow webhook NetworkPolicy traffic on pod port 9443 by shreemaan-abhishek · Pull Request #439 · api7/api7-ingress-controller

shreemaan-abhishek · 2026-07-19T08:56:49Z

What this does

The allow-webhook-traffic NetworkPolicy opens ingress on port 443, but the webhook server pod listens on containerPort: 9443 (config/default/manager_webhook_patch.yaml).

NetworkPolicy ingress rules match the pod's destination port after Service DNAT, not the Service port. So on a NetworkPolicy-enforcing CNI, AdmissionReview traffic destined for 9443 is dropped by a policy that only allows 443. Because the validating webhook uses failurePolicy: Ignore, the dropped calls time out and every admission request is silently admitted without validation, so the isolation control appears healthy while doing nothing.

Fix

Point the NetworkPolicy at 9443 to match the webhook-server containerPort.

Notes

The network-policy overlay is opt-in (not in the default kustomization), so this affects clusters that apply it on an enforcing CNI with the webhook enabled.
Reconciler/translator re-validation still backstops admission, so this restores a defense-in-depth layer rather than the only check.
Synced with fix: allow webhook NetworkPolicy traffic on pod port 9443 apache/apisix-ingress-controller#2812.

Summary by CodeRabbit

Bug Fixes
- Updated webhook network access rules to allow traffic on the correct server port.
- Improved connectivity for webhook requests passing through network policy enforcement.

The allow-webhook-traffic NetworkPolicy opened port 443, but the webhook server pod listens on containerPort 9443. NetworkPolicy ingress rules match the pod's destination port after Service DNAT, not the Service port, so on an enforcing CNI AdmissionReview traffic to 9443 was dropped. Combined with the webhook's failurePolicy: Ignore, this silently bypassed admission validation. Point the policy at 9443 to match the webhook-server containerPort.

coderabbitai · 2026-07-19T08:57:16Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9c2015dd-727f-44ec-9646-d855077e2206

📥 Commits

Reviewing files that changed from the base of the PR and between 5f84a00 and f761870.

📒 Files selected for processing (1)

config/network-policy/allow-webhook-traffic.yaml

📝 Walkthrough

Walkthrough

The webhook ingress NetworkPolicy rule changes its allowed TCP destination port from 443 to 9443 and documents that NetworkPolicy evaluates the pod port after Service DNAT.

Changes

Webhook NetworkPolicy

Layer / File(s)	Summary
Correct webhook destination port `config/network-policy/allow-webhook-traffic.yaml`	The ingress rule allows TCP port `9443`, matching the webhook server container port, and documents post-DNAT evaluation.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related issues

api7/rfcs#223 — Corrects the webhook NetworkPolicy port from 443 to the pod’s actual port 9443.

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: updating the webhook NetworkPolicy to allow pod port 9443.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
E2e Test Quality Review	✅ Passed	PASS: Minimal config-only fix; NetworkPolicy now matches webhook pod port 9443 and comments explain DNAT semantics. No unrelated changes or correctness issues found.
Security Check	✅ Passed	Only change is a NetworkPolicy port fix to 9443 matching the webhook containerPort; no secret/authz/TLS/data-flow risks introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/webhook-networkpolicy-port

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-19T09:10:44Z

conformance test report - apisix-standalone mode

apiVersion: gateway.networking.k8s.io/v1
date: "2026-07-19T09:10:41Z"
gatewayAPIChannel: experimental
gatewayAPIVersion: v1.3.0
implementation:
  contact: null
  organization: APISIX
  project: apisix-ingress-controller
  url: https://github.com/apache/apisix-ingress-controller.git
  version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
    result: success
    statistics:
      Failed: 0
      Passed: 12
      Skipped: 0
  name: GATEWAY-GRPC
  summary: Core tests succeeded.
- core:
    result: partial
    skippedTests:
    - HTTPRouteHTTPSListener
    statistics:
      Failed: 0
      Passed: 32
      Skipped: 1
  extended:
    result: partial
    skippedTests:
    - HTTPRouteRedirectPortAndScheme
    statistics:
      Failed: 0
      Passed: 11
      Skipped: 1
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    - HTTPRouteBackendProtocolWebSocket
    - HTTPRouteDestinationPortMatching
    - HTTPRouteHostRewrite
    - HTTPRouteMethodMatching
    - HTTPRoutePathRewrite
    - HTTPRoutePortRedirect
    - HTTPRouteQueryParamMatching
    - HTTPRouteRequestMirror
    - HTTPRouteResponseHeaderModification
    - HTTPRouteSchemeRedirect
    unsupportedFeatures:
    - GatewayHTTPListenerIsolation
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - HTTPRouteBackendProtocolH2C
    - HTTPRouteBackendRequestHeaderModification
    - HTTPRouteBackendTimeout
    - HTTPRouteParentRefPort
    - HTTPRoutePathRedirect
    - HTTPRouteRequestMultipleMirrors
    - HTTPRouteRequestPercentageMirror
    - HTTPRouteRequestTimeout
  name: GATEWAY-HTTP
  summary: Core tests partially succeeded with 1 test skips. Extended tests partially
    succeeded with 1 test skips.
- core:
    result: partial
    skippedTests:
    - TLSRouteSimpleSameNamespace
    statistics:
      Failed: 0
      Passed: 10
      Skipped: 1
  name: GATEWAY-TLS
  summary: Core tests partially succeeded with 1 test skips.

github-actions · 2026-07-19T09:11:01Z

conformance test report - apisix mode

apiVersion: gateway.networking.k8s.io/v1
date: "2026-07-19T09:10:58Z"
gatewayAPIChannel: experimental
gatewayAPIVersion: v1.3.0
implementation:
  contact: null
  organization: APISIX
  project: apisix-ingress-controller
  url: https://github.com/apache/apisix-ingress-controller.git
  version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
    failedTests:
    - HTTPRouteInvalidBackendRefUnknownKind
    result: failure
    skippedTests:
    - HTTPRouteHTTPSListener
    statistics:
      Failed: 1
      Passed: 31
      Skipped: 1
  extended:
    result: partial
    skippedTests:
    - HTTPRouteRedirectPortAndScheme
    statistics:
      Failed: 0
      Passed: 11
      Skipped: 1
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    - HTTPRouteBackendProtocolWebSocket
    - HTTPRouteDestinationPortMatching
    - HTTPRouteHostRewrite
    - HTTPRouteMethodMatching
    - HTTPRoutePathRewrite
    - HTTPRoutePortRedirect
    - HTTPRouteQueryParamMatching
    - HTTPRouteRequestMirror
    - HTTPRouteResponseHeaderModification
    - HTTPRouteSchemeRedirect
    unsupportedFeatures:
    - GatewayHTTPListenerIsolation
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - HTTPRouteBackendProtocolH2C
    - HTTPRouteBackendRequestHeaderModification
    - HTTPRouteBackendTimeout
    - HTTPRouteParentRefPort
    - HTTPRoutePathRedirect
    - HTTPRouteRequestMultipleMirrors
    - HTTPRouteRequestPercentageMirror
    - HTTPRouteRequestTimeout
  name: GATEWAY-HTTP
  summary: Core tests failed with 1 test failures. Extended tests partially succeeded
    with 1 test skips.
- core:
    result: partial
    skippedTests:
    - TLSRouteSimpleSameNamespace
    statistics:
      Failed: 0
      Passed: 10
      Skipped: 1
  name: GATEWAY-TLS
  summary: Core tests partially succeeded with 1 test skips.
- core:
    result: success
    statistics:
      Failed: 0
      Passed: 12
      Skipped: 0
  name: GATEWAY-GRPC
  summary: Core tests succeeded.

github-actions · 2026-07-19T09:28:24Z

conformance test report

apiVersion: gateway.networking.k8s.io/v1
date: "2026-07-19T09:28:22Z"
gatewayAPIChannel: experimental
gatewayAPIVersion: v1.3.0
implementation:
  contact: null
  organization: APISIX
  project: apisix-ingress-controller
  url: https://github.com/apache/apisix-ingress-controller.git
  version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
    failedTests:
    - GatewayModifyListeners
    result: failure
    skippedTests:
    - HTTPRouteHTTPSListener
    statistics:
      Failed: 1
      Passed: 31
      Skipped: 1
  extended:
    result: partial
    skippedTests:
    - HTTPRouteRedirectPortAndScheme
    statistics:
      Failed: 0
      Passed: 11
      Skipped: 1
    supportedFeatures:
    - GatewayAddressEmpty
    - GatewayPort8080
    - HTTPRouteBackendProtocolWebSocket
    - HTTPRouteDestinationPortMatching
    - HTTPRouteHostRewrite
    - HTTPRouteMethodMatching
    - HTTPRoutePathRewrite
    - HTTPRoutePortRedirect
    - HTTPRouteQueryParamMatching
    - HTTPRouteRequestMirror
    - HTTPRouteResponseHeaderModification
    - HTTPRouteSchemeRedirect
    unsupportedFeatures:
    - GatewayHTTPListenerIsolation
    - GatewayInfrastructurePropagation
    - GatewayStaticAddresses
    - HTTPRouteBackendProtocolH2C
    - HTTPRouteBackendRequestHeaderModification
    - HTTPRouteBackendTimeout
    - HTTPRouteParentRefPort
    - HTTPRoutePathRedirect
    - HTTPRouteRequestMultipleMirrors
    - HTTPRouteRequestPercentageMirror
    - HTTPRouteRequestTimeout
  name: GATEWAY-HTTP
  summary: Core tests failed with 1 test failures. Extended tests partially succeeded
    with 1 test skips.
- core:
    failedTests:
    - GatewayModifyListeners
    - TLSRouteSimpleSameNamespace
    result: failure
    statistics:
      Failed: 2
      Passed: 9
      Skipped: 0
  name: GATEWAY-TLS
  summary: Core tests failed with 2 test failures.
- core:
    failedTests:
    - GatewayModifyListeners
    result: failure
    statistics:
      Failed: 1
      Passed: 11
      Skipped: 0
  name: GATEWAY-GRPC
  summary: Core tests failed with 1 test failures.

shreemaan-abhishek self-assigned this Jul 20, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: allow webhook NetworkPolicy traffic on pod port 9443#439

fix: allow webhook NetworkPolicy traffic on pod port 9443#439
shreemaan-abhishek wants to merge 1 commit into
masterfrom
fix/webhook-networkpolicy-port

shreemaan-abhishek commented Jul 19, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 19, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-actions Bot commented Jul 19, 2026

Uh oh!

github-actions Bot commented Jul 19, 2026

Uh oh!

github-actions Bot commented Jul 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

shreemaan-abhishek commented Jul 19, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this does

Fix

Notes

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Jul 19, 2026

conformance test report - apisix-standalone mode

Uh oh!

github-actions Bot commented Jul 19, 2026

conformance test report - apisix mode

Uh oh!

github-actions Bot commented Jul 19, 2026

conformance test report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

shreemaan-abhishek commented Jul 19, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 19, 2026 •

edited

Loading