feat(monitoring): restrict syslog ingress to the sending networks

alloy-syslog accepted syslog from any world source. Senders seen in Hubble and Loki over the last 7 days: switches and APs on Management, SLZB coordinators and edge hosts on IoT, and the UDM, which sources from its k8s-ingress address 10.2.47.1. The LB is ETP=Local, so those client addresses reach the pod. Refs S28-19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-07 11:14:54 +01:00
1 changed files with 7 additions and 12 deletions
@@ -1,13 +1,6 @@
-# Targeted carve-out: alloy-syslog needs world ingress on the syslog
-# ports specifically. The Service is ETP=Cluster, so external syslog
-# senders (Proxmox, LXC hosts, network gear) hit the LB IP, get DNAT'd
-# to an alloy pod, and get SNAT'd to the receiving node's cilium_host
-# address. Cilium then sees the source as `world-ipv4` identity (the
-# cilium_host IP isn't a known endpoint), NOT `host` — so the broad
-# monitoring CNP's `fromEntities: host` rule doesn't catch it.
-#
-# Scoped via endpointSelector so this only widens ingress on the
-# alloy-syslog pod, not the whole namespace.
+# Syslog senders reaching the alloy-syslog LB (ETP=Local, client address
+# reaches the pod): network gear on Management, the SLZB coordinators on
+# IoT, and the UDM itself, which sources from its k8s-ingress address.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -19,8 +12,10 @@ spec:
      app.kubernetes.io/instance: alloy-syslog
      app.kubernetes.io/name: alloy
  ingress:
-    - fromEntities:
-        - world
+    - fromCIDRSet:
+        - cidrGroupRef: net-management
+        - cidrGroupRef: net-iot
+        - cidrGroupRef: net-k8s-ingress
      toPorts:
        - ports:
            - port: "514"