feat(monitoring): restrict syslog ingress to the sending networks #1585

2026-11-07T10:15:06Z

claude-bot commented

2026-11-07 10:15:06 +00:00

Replaces fromEntities: world on allow-syslog-world-ingress with the CIDR groups of the networks that actually send syslog:

net-management: switches and APs
net-iot: SLZB coordinators, edge-1/edge-2
net-k8s-ingress: the UDM, which sources from 10.2.47.1

Senders taken from Hubble flows to the alloy-syslog pod and from the Loki host label over 7 days. The LB is ETP=Local, so client addresses reach the pod. Server-side dry-run passes.

Refs S28-19

🤖 Generated with Claude Code

Replaces `fromEntities: world` on `allow-syslog-world-ingress` with the CIDR groups of the networks that actually send syslog: - `net-management`: switches and APs - `net-iot`: SLZB coordinators, edge-1/edge-2 - `net-k8s-ingress`: the UDM, which sources from 10.2.47.1 Senders taken from Hubble flows to the alloy-syslog pod and from the Loki `host` label over 7 days. The LB is ETP=Local, so client addresses reach the pod. Server-side dry-run passes. Refs S28-19 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-11-07 10:15:07 +00:00

feat(monitoring): restrict syslog ingress to the sending networks

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

c4f32c7a97

alloy-syslog accepted syslog from any world source. Senders seen in
Hubble and Loki over the last 7 days: switches and APs on Management,
SLZB coordinators and edge hosts on IoT, and the UDM, which sources from
its k8s-ingress address 10.2.47.1. The LB is ETP=Local, so those client
addresses reach the pod.

Refs S28-19

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit edb4aa804c into main

2026-11-07 10:30:33 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1585