ealth probes may begin to be blocked by your CNI&rsquo;s <code>NetworkPolicy</code> implementation. To allow ambient health probes to bypass <code>NetworkPolicy</code>, explicitly allow traffic from the host node to your pod by allow-listing the link-local address ambient uses for this traffic:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-ingress-allow-kubelet-healthprobes
spec:
  podSelector:
    matchLab