tenant: allow-to-apiserver only opens port 6443, breaks in-cluster clients using :443 #2773

Problem

The tenant allow-to-apiserver CiliumNetworkPolicy (networkpolicy.yaml) opts a pod in to API-server access via policy.cozystack.io/allow-to-apiserver: "true":

egress:
- toEntities:
  - kube-apiserver
- toPorts:
  - ports:
    - port: "6443"
      protocol: TCP

The two egress rules are OR'd: rule 1 allows the kube-apiserver entity on any port, rule 2 allows any destination on port 6443. An in-cluster client that talks to kubernetes.default.svc hits the ClusterIP on port 443. That only works if Cilium's socket-LB translates 443 → backend nodeIP:6443 before egress policy enforcement (so the kube-apiserver entity matches). On paths where that pre-policy translation doesn't happen, the connection on 443 is dropped, because only 6443 is explicitly allowed.

Reproduction

A FlinkDeployment configured with Kubernetes HA (fabric8 client, which defaults to https://kubernetes.default.svc:443) fails to reach the API server with allow-to-apiserver: "true" set. Forcing the client to :6443 makes it work.

Suggested fix

Add 443/TCP to the toPorts of allow-to-apiserver (it's the in-cluster Service port most clients target by default). This closes the whole class of in-cluster API clients, not just Flink.

Workaround

Point the client at the API server on :6443 directly (e.g. KUBERNETES_SERVICE_PORT=6443 / kubernetes.default.svc:6443).