k.rennerandClaude Opus 4.7
2d71fa1545
Previous version had ingress/egress with only icmps: block, no from/to source selector. Cilium requires a source/destination match on every ingress/egress rule; without it the rule is incomplete and never matches — verified empirically (Hubble kept logging the same DENIED ICMPv4/v6 DestinationUnreachable drops after the CCNP applied). Source/destination entities: cluster (other pods), host + remote-node (kubelet/control plane), world (external routers emitting PMTU and Fragmentation-Needed). ICMP error class is a trusted control protocol; wide allow is appropriate. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>