Post by @jorijn

Jorijn Schrijvershof
@jorijn
Public en

Something that caught me off guard recently: With native #Kubernetes NetworkPolicy resources with #Cilium, you can't select Kubernetes resources by CIDR range. If you need to allow certain traffic to lets say, the API server originating from a Pod, this is not possible by default.

Luckily, there's a flag: https://docs.cilium.io/en/stable/security/policy/language/#selecting-nodes-with-cidr-ipblock

Unfortunately, due to backwards compatibility, they can't make this the default behavior.

Discussion: https://github.com/cilium/cilium/issues/20550