add egress policy for oidc pods

global/cc-gardener/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: cc-gardener
 description: Converged Cloud Gardener setup based on gardener-operator
 type: application
-version: 0.38.48
+version: 0.38.49
 home: https://github.com/gardener/gardener
 dependencies:
 - name: owner-info

global/cc-gardener/templates/extension-oidc-apps-controller.yaml

@@ -137,4 +137,37 @@ spec:
           oidc-application-controller/component: pod
   policyTypes:
   - Ingress
+
+{{- if .Values.gardener }}
+{{- $namespaces := lookup "v1" "Namespace" "" "" }}
+{{- range $namespaces.items }}
+{{- if eq (index .metadata.labels "gardener.cloud/role") "shoot" }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: egress-oidc-apps-to-virtual-garden-kube-apiserver
+  namespace: {{ .metadata.name }}
+spec:
+  podSelector:
+    matchLabels:
+      oidc-application-controller/component: pod
+  policyTypes:
+  - Egress
+  egress:
+  - ports:
+    - port: 443
+      protocol: TCP
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: garden
+      podSelector:
+        matchLabels:
+          app: kubernetes
+          role: apiserver
+{{- end }}
+{{- end }}
 {{- end }}
+
+{{- end }}