Hubble's static exporter writes every POLICY_DENIED drop event to the
cilium-agent stdout, which Alloy already ships to Loki (1 year
retention). That makes denied traffic reviewable after the fact instead
of only for the minutes the Hubble ring buffer holds.
Filter and field mask were checked against the running 1.20.4 agent
with hubble observe --allowlist / --field-mask. The cilium-config change
rolls the agents one at a time via the reloader annotation.
Refs S28-30
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CoreDNS had no policy, so kube-dns-lb answered any source. The new CNP
allows the whole cluster on every port and the internal client networks
on 53/UDP+TCP. Selecting the pods makes them default-deny for ingress.
Refs S28-19
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
home-assistant-bgp (:8123) accepted any world source. Allowed now:
Privat, VPN, IoT and Server, per the approved source matrix. Browser and
app access from outside goes through Traefik and is unaffected. The LB is
ETP=Local, so the client address reaches the pod.
Refs S28-19
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shelly-manager-firmware (:8082, /fw/ only) accepted any world source.
Shelly devices live on IoT; the LB is ETP=Local, so the client address
reaches the pod.
Refs S28-19
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mosquitto-iot accepted MQTT from any world source. Over the last 7 days
the mosquitto log shows client connections from 10.2.30.0/24 only. The
LB is ETP=Local, so the client address reaches the pod.
Refs S28-19
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
alloy-syslog accepted syslog from any world source. Senders seen in
Hubble and Loki over the last 7 days: switches and APs on Management,
SLZB coordinators and edge hosts on IoT, and the UDM, which sources from
its k8s-ingress address 10.2.47.1. The LB is ETP=Local, so those client
addresses reach the pod.
Refs S28-19
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-07 11:14:54 +01:00
5 changed files with 87 additions and 22 deletions
# Targeted carve-out: alloy-syslog needs world ingress on the syslog
# ports specifically. The Service is ETP=Cluster, so external syslog
# senders (Proxmox, LXC hosts, network gear) hit the LB IP, get DNAT'd
# to an alloy pod, and get SNAT'd to the receiving node's cilium_host
# address. Cilium then sees the source as `world-ipv4` identity (the
# cilium_host IP isn't a known endpoint), NOT `host` — so the broad
# monitoring CNP's `fromEntities: host` rule doesn't catch it.
#
# Scoped via endpointSelector so this only widens ingress on the
# alloy-syslog pod, not the whole namespace.
# Syslog senders reaching the alloy-syslog LB (ETP=Local, client address
# reaches the pod): network gear on Management, the SLZB coordinators on
# IoT, and the UDM itself, which sources from its k8s-ingress address.
apiVersion:cilium.io/v2
kind:CiliumNetworkPolicy
metadata:
@@ -19,8 +12,10 @@ spec:
app.kubernetes.io/instance:alloy-syslog
app.kubernetes.io/name:alloy
ingress:
- fromEntities:
- world
- fromCIDRSet:
- cidrGroupRef:net-management
- cidrGroupRef:net-iot
- cidrGroupRef:net-k8s-ingress
toPorts:
- ports:
- port:"514"
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
k.renner
claude-botandClaude Opus 5.5