fix: update network policy to allow S3 traffic and kubelet health checks

deploy/base/network-policy.yaml

@@ -18,6 +18,14 @@ spec:
     ports:
     - protocol: TCP
       port: 8000
+  # Allow inbound traffic from kubelet for health checks
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          name: kube-system
+    ports:
+    - protocol: TCP
+      port: 8000
   egress:
   # Allow outbound DNS resolution
   - to:
@@ -29,7 +37,25 @@ spec:
       port: 53
     - protocol: UDP
       port: 53
-  # Allow outbound HTTPS for package updates or external APIs
-  - ports:
+  # Allow outbound HTTPS to Kubernetes API server
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          name: kube-system
+    ports:
     - protocol: TCP
-      port: 443
+      port: 443
+  # Allow outbound HTTPS to Infomaniak S3
+  - to:
+    - ipBlock:
+        cidr: 45.157.188.56/29  # Infomaniak S3 IPv4 range
+    ports:
+    - protocol: TCP
+      port: 443
+  # Allow outbound NTP for time synchronization
+  - to:
+    - ipBlock:
+        cidr: 0.0.0.0/0
+    ports:
+    - protocol: UDP
+      port: 123