diff --git a/helm/argocd/Chart.yaml b/helm/argocd/Chart.yaml
index a4d7eb2..61a604a 100644
--- a/helm/argocd/Chart.yaml
+++ b/helm/argocd/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: argocd-configuration
-version: 0.2.1
+version: 0.2.2
 type: application
 description: "ArgoCD configuration which requires Argo CD to be installed separately."
 maintainers:
@@ -9,7 +9,7 @@ maintainers:
 annotations:
   artifacthub.io/changes: |
     - kind: fixed
-      description: Added missing namespace labels
+      description: Allow egress to host
   artifacthub.io/signKey: |
     fingerprint: F0F153B65BAD467201D7544E47393ABD1F96B7C8
     url: https://mafiasi.de/pks/key/47393ABD1F96B7C8.asc
diff --git a/helm/argocd/templates/network-policy.yaml b/helm/argocd/templates/network-policy.yaml
index f5f92d1..f1413a2 100644
--- a/helm/argocd/templates/network-policy.yaml
+++ b/helm/argocd/templates/network-policy.yaml
@@ -12,24 +12,24 @@ specs:
       # kubelet -> probes
       - toEndpoints:
           - matchLabels:
-              k8s:app.kubernetes.io/name: argocd-server
-              k8s:io.kubernetes.pod.namespace: argocd
+              app.kubernetes.io/name: argocd-server
+              io.kubernetes.pod.namespace: argocd
         toPorts:
           - ports:
               - port: '8080'
                 protocol: TCP
       - toEndpoints:
           - matchLabels:
-              k8s:app.kubernetes.io/name: argocd-application-controller
-              k8s:io.kubernetes.pod.namespace: argocd
+              app.kubernetes.io/name: argocd-application-controller
+              io.kubernetes.pod.namespace: argocd
         toPorts:
           - ports:
               - port: '8082'
                 protocol: TCP
       - toEndpoints:
           - matchLabels:
-              k8s:app.kubernetes.io/name: argocd-repo-server
-              k8s:io.kubernetes.pod.namespace: argocd
+              app.kubernetes.io/name: argocd-repo-server
+              io.kubernetes.pod.namespace: argocd
         toPorts:
           - ports:
               - port: '8084'
@@ -37,7 +37,7 @@ specs:
   - endpointSelector:
       # apply to core dns pods
       matchLabels:
-        k8s:app.kubernetes.io/name: argocd-server
+        app.kubernetes.io/name: argocd-server
     ingress:
       # kubelet -> probes
       - fromEntities:
@@ -49,8 +49,8 @@ specs:
       # ingress -> server
       - fromEndpoints:
           - matchLabels:
-              k8s:io.cilium.k8s.policy.serviceaccount: nginx-ingress-microk8s-serviceaccount
-              k8s:io.kubernetes.pod.namespace: ingress
+              io.cilium.k8s.policy.serviceaccount: nginx-ingress-microk8s-serviceaccount
+              io.kubernetes.pod.namespace: ingress
         toPorts:
           - ports:
               - port: '8080'
@@ -58,8 +58,8 @@ specs:
       # prometheus -> server metrics
       - fromEndpoints:
           - matchLabels:
-              k8s:io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
-              k8s:io.kubernetes.pod.namespace: observability
+              io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
+              io.kubernetes.pod.namespace: observability
         toPorts:
           - ports:
               - port: '8083'
@@ -68,15 +68,21 @@ specs:
       - toEndpoints:
           - matchLabels:
               io.cilium.k8s.policy.serviceaccount: coredns
-              k8s:io.kubernetes.pod.namespace: kube-system
+              io.kubernetes.pod.namespace: kube-system
         toPorts:
           - ports:
               - port: '53'
                 protocol: UDP
+      - toEntities:
+          - host
+        toPorts:
+          - ports:
+              - port: '16443'
+                protocol: TCP
   - endpointSelector:
       # apply to core dns pods
       matchLabels:
-        k8s:app.kubernetes.io/name: argocd-application-controller
+        app.kubernetes.io/name: argocd-application-controller
     ingress:
       # kubelet -> probes
       - fromEntities:
@@ -88,7 +94,7 @@ specs:
   - endpointSelector:
       # apply to core dns pods
       matchLabels:
-        k8s:app.kubernetes.io/name: argocd-repo-server
+        app.kubernetes.io/name: argocd-repo-server
     ingress:
       # kubelet -> probes
       - fromEntities: