Merge pull request 'feat(cilium): export policy drops to the agent log' (#1591) from feat/hubble-policy-drop-log into main

Reviewed-on: #1591

kubernetes/infrastructure/cilium/helmrelease.yaml

@@ -156,13 +156,39 @@ spec:
     k8sServicePort: 7445
     # Hubble itself is on in every agent (chart default); the relay aggregates
     # the three nodes' flow buffers behind one gRPC endpoint so `hubble observe`
-    # works without exec into kube-system (REN-487). Renders no change to
-    # cilium-config or the agent DaemonSet, so the reloader annotation above
-    # does not roll the CNI. The relay has no client auth; who may reach it is
-    # network-policies/kube-system-hubble-relay.yaml.
+    # works without exec into kube-system (REN-487). The relay has no client
+    # auth; who may reach it is network-policies/kube-system-hubble-relay.yaml.
     hubble:
       relay:
         enabled: true
+      # Every policy drop goes to the agent's stdout and from there to Loki
+      # ({namespace="kube-system", container="cilium-agent"} |= "POLICY_DENIED"),
+      # so denied traffic can be reviewed after the fact. Changes cilium-config,
+      # so the reloader rolls the agents.
+      export:
+        static:
+          enabled: true
+          filePath: stdout
+          allowList:
+            - '{"verdict":["DROPPED"],"drop_reason_desc":["POLICY_DENIED"],"event_type":[{"type":1}]}'
+          fieldMask:
+            - time
+            - node_name
+            - verdict
+            - drop_reason_desc
+            - traffic_direction
+            - IP
+            - l4
+            - source.namespace
+            - source.pod_name
+            - source.identity
+            - source.workloads
+            - source_names
+            - destination.namespace
+            - destination.pod_name
+            - destination.identity
+            - destination.workloads
+            - destination_names
     l2announcements:
       enabled: true
     externalIPs:

kubernetes/infrastructure/network-policies/home-assistant-ns.yaml

@@ -205,8 +205,11 @@ spec:
     matchLabels:
       app.kubernetes.io/name: home-assistant
   ingress:
-    - fromEntities:
-        - world
+    - fromCIDRSet:
+        - cidrGroupRef: net-privat
+        - cidrGroupRef: net-vpn
+        - cidrGroupRef: net-iot
+        - cidrGroupRef: net-server
       toPorts:
         - ports:
             - port: "8123"
@@ -225,8 +228,8 @@ spec:
     matchLabels:
       app.kubernetes.io/name: shelly-manager
   ingress:
-    - fromEntities:
-        - world
+    - fromCIDRSet:
+        - cidrGroupRef: net-iot
       toPorts:
         - ports:
             - port: "8082"

kubernetes/infrastructure/network-policies/kube-system-coredns.yaml

@@ -0,0 +1,40 @@
+# CoreDNS is reachable from the LAN through the kube-dns-lb LoadBalancer
+# (ETP=Local, client address reaches the pod). Selecting the pods makes
+# them default-deny for ingress, so the whole cluster (pods, nodes, kubelet
+# probes, Prometheus) is allowed on every port; LAN clients only on 53.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: coredns-ingress
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      k8s-app: kube-dns
+  ingress:
+    - fromEntities:
+        - cluster
+    - fromCIDRSet:
+        - cidrGroupRef: net-default
+        - cidrGroupRef: net-management
+        - cidrGroupRef: net-radius
+        - cidrGroupRef: net-video
+        - cidrGroupRef: net-iot
+        - cidrGroupRef: net-server
+        - cidrGroupRef: net-k8s-node
+        - cidrGroupRef: net-k8s-ingress
+        - cidrGroupRef: net-k8s-pod
+        - cidrGroupRef: net-privat
+        - cidrGroupRef: net-phone
+        - cidrGroupRef: net-access
+        - cidrGroupRef: net-vpn
+        - cidrGroupRef: net-guest
+        - cidrGroupRef: net-multi-transfer
+        - cidrGroupRef: net-multi-lan
+        - cidrGroupRef: net-mutti
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP

kubernetes/infrastructure/network-policies/kustomization.yaml

@@ -41,3 +41,4 @@ resources:
   - allow-cilium-health.yaml
   - cnpg-barman-s3.yaml
   - kube-system-hubble-relay.yaml
+  - kube-system-coredns.yaml

kubernetes/infrastructure/network-policies/monitoring-alloy-syslog.yaml

@@ -1,13 +1,6 @@
-# Targeted carve-out: alloy-syslog needs world ingress on the syslog
-# ports specifically. The Service is ETP=Cluster, so external syslog
-# senders (Proxmox, LXC hosts, network gear) hit the LB IP, get DNAT'd
-# to an alloy pod, and get SNAT'd to the receiving node's cilium_host
-# address. Cilium then sees the source as `world-ipv4` identity (the
-# cilium_host IP isn't a known endpoint), NOT `host` — so the broad
-# monitoring CNP's `fromEntities: host` rule doesn't catch it.
-#
-# Scoped via endpointSelector so this only widens ingress on the
-# alloy-syslog pod, not the whole namespace.
+# Syslog senders reaching the alloy-syslog LB (ETP=Local, client address
+# reaches the pod): network gear on Management, the SLZB coordinators on
+# IoT, and the UDM itself, which sources from its k8s-ingress address.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -19,8 +12,10 @@ spec:
       app.kubernetes.io/instance: alloy-syslog
       app.kubernetes.io/name: alloy
   ingress:
-    - fromEntities:
-        - world
+    - fromCIDRSet:
+        - cidrGroupRef: net-management
+        - cidrGroupRef: net-iot
+        - cidrGroupRef: net-k8s-ingress
       toPorts:
         - ports:
             - port: "514"

kubernetes/infrastructure/network-policies/paperless-ns.yaml

@@ -112,7 +112,7 @@ spec:
             - { type: 136, family: IPv6 }
             - { type: 143, family: IPv6 }
 ---
-# Allow FTP access (from scanners on the LAN) to the ftp-scanner pod.
+# FTP from the scanners (IoT and Privat) to the ftp-scanner pod.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -123,8 +123,24 @@ spec:
     matchLabels:
       app.kubernetes.io/name: ftp-scanner
   ingress:
+    - fromCIDRSet:
+        - cidrGroupRef: net-iot
+        - cidrGroupRef: net-privat
+      toPorts:
+        - ports:
+            - port: "21"
+              protocol: TCP
+            - port: "21100"
+              protocol: TCP
+            - port: "21101"
+              protocol: TCP
+            - port: "21102"
+              protocol: TCP
+            - port: "21103"
+              protocol: TCP
+            - port: "21104"
+              protocol: TCP
     - fromEntities:
-        - world
         - host
         - remote-node
       toPorts:
@@ -142,7 +158,7 @@ spec:
             - port: "21104"
               protocol: TCP
 ---
-# Allow Syncthing peer-to-peer sync from the LAN/world.
+# Allow Syncthing peer-to-peer sync from Privat and VPN.
 # - 22000 TCP+QUIC: actual sync traffic between peers.
 # - 21027 UDP: local-discovery broadcast packets from peers on the LAN.
 # UI (8384) is intentionally NOT listed — authentik-gate-sync generates the
@@ -157,8 +173,18 @@ spec:
     matchLabels:
       app.kubernetes.io/name: syncthing
   ingress:
+    - fromCIDRSet:
+        - cidrGroupRef: net-privat
+        - cidrGroupRef: net-vpn
+      toPorts:
+        - ports:
+            - port: "22000"
+              protocol: TCP
+            - port: "22000"
+              protocol: UDP
+            - port: "21027"
+              protocol: UDP
     - fromEntities:
-        - world
         - host
         - remote-node
       toPorts: