fix(web-sentinel): allow manual trigger apiserver egress

scripts/src/hwlab-node-web-sentinel-cicd.ts

@@ -1075,6 +1075,7 @@ function renderSentinelManifests(
   const pvcStorage = stringAt(runtime, "pvcStorage");
   const stateRoot = stringAt(runtime, "stateRoot");
   const sentinelEnv = sentinelContainerEnv(sentinelId, runtime, cicd, secrets);
+  const kubernetesApiEgress = sentinelKubernetesApiEgress(runtime);
   const cadenceJob = sentinelCadenceCronJobPlan(spec, sentinelId, runtime, cicd, scenarios, image.ref, sentinelEnv);
   if (cadenceJob !== null) {
     emitWebProbeSentinelSpan({
@@ -1221,7 +1222,10 @@ function renderSentinelManifests(
         podSelector: { matchLabels: { "app.kubernetes.io/name": deploymentName } },
         policyTypes: ["Ingress", "Egress"],
         ingress: [{ from: [{ namespaceSelector: {} }], ports: [{ protocol: "TCP", port: servicePort }] }],
-        egress: [{ to: [{ namespaceSelector: {} }] }],
+        egress: [
+          { to: [{ namespaceSelector: {} }] },
+          ...kubernetesApiEgress,
+        ],
       },
     },
     {
@@ -1242,6 +1246,14 @@ function renderSentinelManifests(
   ];
 }
 
+function sentinelKubernetesApiEgress(runtime: Record<string, unknown>): readonly Record<string, unknown>[] {
+  if (booleanAtNullable(runtime, "kubernetesApi.egress.enabled") !== true) return [];
+  return [{
+    to: [{ ipBlock: { cidr: stringAt(runtime, "kubernetesApi.egress.cidr") } }],
+    ports: [{ protocol: "TCP", port: numberAt(runtime, "kubernetesApi.egress.port") }],
+  }];
+}
+
 function sentinelContainerEnv(sentinelId: string, runtime: Record<string, unknown>, cicd: Record<string, unknown>, secrets: Record<string, unknown>): readonly Record<string, unknown>[] {
   const env: Record<string, unknown>[] = [{ name: "UNIDESK_WEB_PROBE_SENTINEL_ID", value: sentinelId }];
   const otelEnabled = booleanAtNullable(runtime, "observability.otel.enabled") ?? booleanAtNullable(cicd, "observability.otel.enabled") ?? false;