k.rennerandClaude Opus 4.7
7da87bf397
The egress section transitioned namespaces that previously had ingress-only CNPs (velero, monitoring, rook-ceph CSI) into egress-policy-enforced mode with only ICMP egress allowed — breaking DNS lookups to coredns, kube-apiserver access, and world egress. The user-facing ICMP problem was coredns→HA ICMP DU drops, which is ingress on HA's side. The ingress rule alone is sufficient. ICMP egress in the per-namespace egress-enforced CNPs already flows via the broad toEntities rules (host/remote-node/world don't constrain protocol so ICMP is included). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>