From f76187064a6d5f9510f5c17d34c54ee5f5547b29 Mon Sep 17 00:00:00 2001 From: Abhishek Choudhary Date: Sun, 19 Jul 2026 14:40:49 +0545 Subject: [PATCH] fix: allow webhook NetworkPolicy traffic on pod port 9443 The allow-webhook-traffic NetworkPolicy opened port 443, but the webhook server pod listens on containerPort 9443. NetworkPolicy ingress rules match the pod's destination port after Service DNAT, not the Service port, so on an enforcing CNI AdmissionReview traffic to 9443 was dropped. Combined with the webhook's failurePolicy: Ignore, this silently bypassed admission validation. Point the policy at 9443 to match the webhook-server containerPort. --- config/network-policy/allow-webhook-traffic.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/config/network-policy/allow-webhook-traffic.yaml b/config/network-policy/allow-webhook-traffic.yaml index e3f2f408..a1fd69b5 100644 --- a/config/network-policy/allow-webhook-traffic.yaml +++ b/config/network-policy/allow-webhook-traffic.yaml @@ -23,5 +23,7 @@ spec: matchLabels: webhook: enabled # Only from namespaces with this label ports: - - port: 443 + # Match the webhook-server containerPort; NetworkPolicy evaluates the + # pod's destination port (post-Service DNAT), not the Service port. + - port: 9443 protocol: TCP