Bug report

General Information

• Cilium version : 1.8
• Kernel version: 4.19

How to reproduce the issue

1. Create a policy rule to allow a pod to talk to all nodes. cidr 10.128.0.0/20 is the node cidr.

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-kubelet-from-test-pod
spec:
  podSelector:
    matchLabels:
      k8s-app: test-pod
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 10.128.0.0/20
    ports:
    - protocol: TCP
      port: 10255

2. curl the node from the pod, and found that the connection is rejected, instead of being allowed.

The issue is because the node ip is translated to host identity, not the cidr identity. However, kubernetes network policy doesn't have a node selector. So to allow pods to talk to host in either direction using k8s network policy, only cidr can be used. The current behavior is inconsistent with what is supposed to work with k8s network policy.
https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/api/networking/v1/types.go