From 6810dba05a33cc704402545b9b96a8baab37f2d9 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 27 Jun 2026 12:46:02 +0200 Subject: [PATCH] crowdsec: repoint agent log acquisition from ingress-nginx to Traefik MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The agent's acquisition still targeted podName ingress-nginx-controller-* in the ingress namespace — a selector that has matched no pod since ingress-nginx was retired (2026-05-17), so the agents have been parsing nothing and no decisions were being generated. Repoint to the Traefik controller (podName traefik-*, program traefik) and swap the nginx collection/parser for crowdsecurity/traefik (which bundles its own log parser). This restores attack detection. Enforcement (a Traefik bouncer acting on the decisions) is a separate change. Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/infrastructure/crowdsec/helmrelease.yaml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/kubernetes/infrastructure/crowdsec/helmrelease.yaml b/kubernetes/infrastructure/crowdsec/helmrelease.yaml index 81c55b15..d5cd5708 100644 --- a/kubernetes/infrastructure/crowdsec/helmrelease.yaml +++ b/kubernetes/infrastructure/crowdsec/helmrelease.yaml @@ -48,15 +48,18 @@ spec: key: key agent: + # The agent parses the ingress controller's access logs (read from + # the pod's stdout) to detect attacks. Repointed from the retired + # ingress-nginx (decommissioned 2026-05-17) to Traefik. The + # crowdsecurity/traefik collection bundles the matching log parser, + # so no separate PARSERS entry is needed. acquisition: - namespace: ingress - podName: ingress-nginx-controller-* - program: nginx + podName: traefik-* + program: traefik env: - name: COLLECTIONS - value: "crowdsecurity/nginx crowdsecurity/http-cve crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules" - - name: PARSERS - value: "crowdsecurity/nginx-logs" + value: "crowdsecurity/traefik crowdsecurity/http-cve crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules" config: parsers: