fix(monitoring): turn off Alloy and InfluxDB usage telemetry

Both phone home on a timer: every alloy pod to stats.grafana.org (~135 a day each) and influxd to telemetry.influxdata.com (56 a day). Egress policy denies it, so this only removed log noise and wasted SYNs; switch it off at the source like Loki's reporting_enabled: false. --disable-reporting per the "alloy run" reference (chart alloy.extraArgs); INFLUXD_REPORTING_DISABLED per the InfluxDB v2 config options. S28-41 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge pull request 'fix(authentik): admit the UDM's LDAPS sync to the LDAP outpost' (#1600 ) from fix/ldap-outpost-udm-ldaps into main
2026-11-07 22:10:52 +01:00 · 2026-11-07 21:03:33 +00:00 · 2026-11-07 22:02:30 +01:00 · 2026-11-07 22:00:21 +01:00 · 2026-11-07 20:02:17 +00:00
5 changed files with 27 additions and 0 deletions
@@ -34,3 +34,10 @@ spec:
              protocol: TCP
            - port: "6636"
              protocol: TCP
+    # The UDM's LDAPS admin-auth sync.
+    - fromCIDRSet:
+        - cidrGroupRef: udm-k8s-ingress
+      toPorts:
+        - ports:
+            - port: "6636"
+              protocol: TCP
@@ -100,6 +100,9 @@ spec:
      # Keep tokens unhashed; enable hashing later as its own change.
      - name: INFLUXD_USE_HASHED_TOKENS
        value: "false"
+      # No usage telemetry to telemetry.influxdata.com (egress is denied).
+      - name: INFLUXD_REPORTING_DISABLED
+        value: "true"
    # The chart defaults to liveness/readiness with initialDelaySeconds=0,
    # so after a crash restart the kubelet kills the pod before shards
    # finish opening. Give it 10 minutes to come up cleanly.
@@ -54,6 +54,9 @@ spec:
      # non-RFC-framed payload). Scoped to this single-purpose receiver
      # only — the pod-log Alloy DaemonSet stays at default stability.
      stabilityLevel: experimental
+      # No usage reporting to stats.grafana.org (egress is denied anyway).
+      extraArgs:
+        - --disable-reporting
      resources:
        requests:
          cpu: 20m
@@ -116,6 +116,9 @@ spec:
      retries: 3
  values:
    alloy:
+      # No usage reporting to stats.grafana.org (egress is denied anyway).
+      extraArgs:
+        - --disable-reporting
      configMap:
        content: |
          // Discover and collect K8s pod logs
@@ -74,6 +74,17 @@ spec:
    - fd02:47::/64
    - 10.2.47.0/24
 ---
+# The UDM's own address on k8s-ingress, which it sources from towards the
+# cluster's LoadBalancer IPs.
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: udm-k8s-ingress
+spec:
+  externalCIDRs:
+    - fd02:47::1/128
+    - 10.2.47.1/32
+---
 apiVersion: cilium.io/v2
 kind: CiliumCIDRGroup
 metadata:
Author	SHA1	Message	Date
claude-botandClaude Opus 5.5	4589ef3747	fix(monitoring): turn off Alloy and InfluxDB usage telemetry ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details Both phone home on a timer: every alloy pod to stats.grafana.org (~135 a day each) and influxd to telemetry.influxdata.com (56 a day). Egress policy denies it, so this only removed log noise and wasted SYNs; switch it off at the source like Loki's reporting_enabled: false. --disable-reporting per the "alloy run" reference (chart alloy.extraArgs); INFLUXD_REPORTING_DISABLED per the InfluxDB v2 config options. S28-41 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 22:10:52 +01:00
k.renner	979e3910ca	Merge pull request 'fix(authentik): admit the UDM's LDAPS sync to the LDAP outpost' (#1600 ) from fix/ldap-outpost-udm-ldaps into main Reviewed-on: #1600	2026-11-07 21:03:33 +00:00
claude-botandClaude Opus 5.5	6a0dbf9e26	fix(authentik): admit only the UDM's own address, not all of k8s-ingress ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details New CIDR group udm-k8s-ingress (10.2.47.1/32, fd02:47::1/128); the LDAPS rule references it instead of the whole net-k8s-ingress network. S28-39 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 22:02:30 +01:00
claude-botandClaude Opus 5.5	e25f1a43f8	fix(authentik): admit the UDM's LDAPS sync to the LDAP outpost ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details The UDM authenticates admins against ldap.renner.uno:636 and syncs hourly. It sources from its k8s-ingress address (10.2.47.1 / fd02:47::1), which ldap-outpost-lan-ingress did not admit: 200 SYNs a day dropped at :26 every hour. Same group the alloy-syslog and CoreDNS policies use for the UDM; LDAPS only. S28-39 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 22:00:21 +01:00
k.renner	a4e5f99ca1	Merge pull request 'docs(trmnl): note the expected Google drops from the renderer's Chromium' (#1599 ) from docs/trmnl-renderer-google-drops into main Reviewed-on: #1599	2026-11-07 20:02:17 +00:00