fix: allow egress to Kubernetes API server on port 6443 [RHDHBUGS-3926]

config/profile/rhdh/default-config/networkpolicy.yaml

@@ -52,6 +52,13 @@ spec:
     - ports:
         - port: 443
           protocol: TCP
+        # Kubernetes API server (e.g., OpenShift uses 6443; some managed platforms
+        # use 443 above). Needed by plugins that query cluster resources: Tekton,
+        # ArgoCD/GitOps, Topology, KServe model catalog, and any catalog provider
+        # or frontend plugin that lists or watches Kubernetes objects.
+        # RBAC on the ServiceAccount is the access-control boundary, not NetworkPolicy.
+        - port: 6443
+          protocol: TCP
 
 ---
 # Redis is part of the recommended checklist for production deployments

docs/configuration.md

@@ -230,6 +230,7 @@ For example, Backstage CR named **mybackstage** will create K8s Deployment resou
     - DB-scoped policies are filtered out when `spec.database.enableLocalDb` is `false`
     - When local DB is disabled, the `allow-psql-egress` policy allows egress on port 5432 to any destination (for external databases)
     - The `allow-redis-egress` policy allows egress on port 6379 TCP to any destination (Redis is not deployed by the operator; users bring their own)
+    - The `allow-https-egress` policy also allows egress on port 6443 TCP (Kubernetes API server) — needed by plugins that query cluster resources (Tekton, ArgoCD/GitOps, Topology, KServe model catalog, etc.). On some managed platforms (GKE, EKS) the API server listens on port 443 instead.
     - The `allow-metrics-ingress` policy allows ingress on port 9464 from `openshift-monitoring`, `openshift-user-workload-monitoring`, GKE GMP namespaces (`gmp-system`, `gke-gmp-system`), and `monitoring` (kube-prometheus-stack convention)
     - On OpenShift, the `allow-router-ingress` policy's `namespaceSelector` is set to `policy-group.network.openshift.io/ingress: ""`
 

docs/intelligent-assistant-okp-kubernetes.md

@@ -80,7 +80,7 @@ spec:
                   number: 8080
 ```
 
-The default RHDH NetworkPolicies already allow HTTPS egress from the Backstage pod on TCP port 443. The OKP add-on additionally allows HTTP egress on ports 80 and 8080. If you replace the default policies, ensure that the replacement permits the port used by `OKP_SERVICE_URL`.
+The default RHDH NetworkPolicies already allow HTTPS egress from the Backstage pod on TCP ports 443 and 6443 (Kubernetes API server). The OKP add-on additionally allows HTTP egress on ports 80 and 8080. If you replace the default policies, ensure that the replacement permits the port used by `OKP_SERVICE_URL`.
 
 ## Configure the public OKP URL
 

docs/intelligent-assistant-okp-openshift.md

@@ -51,7 +51,7 @@ The ConfigMap contains only a public CA certificate. Do not copy the router Secr
 
 ### Verify HTTPS egress
 
-The default RHDH NetworkPolicies allow HTTPS egress from the Backstage pod on TCP port 443. If you replace the default policies, ensure that the replacement permits HTTPS access to the OKP Route.
+The default RHDH NetworkPolicies allow HTTPS egress from the Backstage pod on TCP ports 443 and 6443 (Kubernetes API server). If you replace the default policies, ensure that the replacement permits HTTPS access to the OKP Route.
 
 ### Mount and trust the CA