shreemaan-abhishek opened a new pull request, #2812: URL: https://github.com/apache/apisix-ingress-controller/pull/2812
### What this does The `allow-webhook-traffic` NetworkPolicy opens ingress on port `443`, but the webhook server pod listens on `containerPort: 9443` (`config/default/manager_webhook_patch.yaml`). NetworkPolicy ingress rules match the pod's destination port **after** Service DNAT, not the Service port. So on a NetworkPolicy-enforcing CNI, `AdmissionReview` traffic destined for `9443` is dropped by a policy that only allows `443`. Because the validating webhook uses `failurePolicy: Ignore`, the dropped calls time out and every admission request is silently admitted without validation, so the isolation control appears healthy while doing nothing. ### Fix Point the NetworkPolicy at `9443` to match the webhook-server `containerPort`. ### Notes - The network-policy overlay is opt-in (not in the default kustomization), so this affects clusters that apply it on an enforcing CNI with the webhook enabled. - Reconciler/translator re-validation still backstops admission, so this restores a defense-in-depth layer rather than the only check. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
