From 901a9b7984baab79c33d23b7b177f4f678ccbe55 Mon Sep 17 00:00:00 2001
From: Guilherme Ferreira <gferreir@redhat.com>
Date: Tue, 23 Jun 2026 14:08:38 -0300
Subject: [PATCH] fix: allow kube-apiserver to reach DevSpaces webhook (fixes
 #419)

---
 .../instance/base/allow-webhook-from-apiserver.yaml  | 12 ++++++++++++
 .../instance/base/kustomization.yaml                 |  1 +
 2 files changed, 13 insertions(+)
 create mode 100644 openshift-dev-spaces/instance/base/allow-webhook-from-apiserver.yaml

diff --git a/openshift-dev-spaces/instance/base/allow-webhook-from-apiserver.yaml b/openshift-dev-spaces/instance/base/allow-webhook-from-apiserver.yaml
new file mode 100644
index 00000000..0c41e5e2
--- /dev/null
+++ b/openshift-dev-spaces/instance/base/allow-webhook-from-apiserver.yaml
@@ -0,0 +1,12 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-webhook-from-apiserver
+spec:
+  ingress:
+    - ports:
+      - protocol: TCP
+        port: 9443
+  podSelector: {}
+  policyTypes:
+  - Ingress
diff --git a/openshift-dev-spaces/instance/base/kustomization.yaml b/openshift-dev-spaces/instance/base/kustomization.yaml
index ad66382b..c759bf65 100644
--- a/openshift-dev-spaces/instance/base/kustomization.yaml
+++ b/openshift-dev-spaces/instance/base/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
   - checluster.yaml
   - namespace.yaml
   - network-policy.yaml
+  - allow-webhook-from-apiserver.yaml