feat(cilium): export policy drops to the agent log #1591

2026-11-07T10:24:37Z

claude-bot commented

2026-11-07 10:24:37 +00:00

Enables the Hubble static exporter with filePath: stdout, so every Cilium policy drop lands in the cilium-agent log and from there, via Alloy, in Loki (1 year retention). Query:

{namespace="kube-system", container="cilium-agent"} |= "POLICY_DENIED"

Allowlist: verdict=DROPPED, drop_reason_desc=POLICY_DENIED, event type drop only, so no duplicates from the policy-verdict events
Field mask: time, node, direction, IP, L4, source/destination namespace, pod, identity, workload, names

The filter and field mask were checked against the running 1.20.4 agent (hubble observe --allowlist … --field-mask …). The stdout handling is in pkg/hubble/exporter/cell/cell.go at v1.20.4.

The cilium-config change rolls the agents one at a time via the reloader annotation.

Refs S28-30

🤖 Generated with Claude Code

Enables the Hubble static exporter with `filePath: stdout`, so every Cilium policy drop lands in the cilium-agent log and from there, via Alloy, in Loki (1 year retention). Query: ``` {namespace="kube-system", container="cilium-agent"} |= "POLICY_DENIED" ``` - Allowlist: `verdict=DROPPED`, `drop_reason_desc=POLICY_DENIED`, event type drop only, so no duplicates from the policy-verdict events - Field mask: time, node, direction, IP, L4, source/destination namespace, pod, identity, workload, names The filter and field mask were checked against the running 1.20.4 agent (`hubble observe --allowlist … --field-mask …`). The `stdout` handling is in `pkg/hubble/exporter/cell/cell.go` at v1.20.4. The cilium-config change rolls the agents one at a time via the reloader annotation. Refs S28-30 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-11-07 10:24:38 +00:00

feat(cilium): export policy drops to the agent log

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

9777e147e8

Hubble's static exporter writes every POLICY_DENIED drop event to the
cilium-agent stdout, which Alloy already ships to Loki (1 year
retention). That makes denied traffic reviewable after the fact instead
of only for the minutes the Hubble ring buffer holds.

Filter and field mask were checked against the running 1.20.4 agent
with hubble observe --allowlist / --field-mask. The cilium-config change
rolls the agents one at a time via the reloader annotation.

Refs S28-30

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit 30704634b3 into main

2026-11-07 10:31:25 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1591