crowdsec: repoint agent log acquisition from ingress-nginx to Traefik #76

2026-06-27T10:46:40Z

k.renner commented

2026-06-27 10:46:40 +00:00

Tier 4, part 1 of 2 — detection (the safe half; no ingress-path impact).

The CrowdSec agent's log acquisition still targeted podName: ingress-nginx-controller-* — a selector that has matched no pod since ingress-nginx was retired (2026-05-17). So the agents have been parsing nothing and generating no decisions.

This repoints acquisition to the Traefik controller (podName: traefik-*, program: traefik) and swaps crowdsecurity/nginx + nginx-logs for the crowdsecurity/traefik collection (bundles its own parser). Traefik already emits access logs to stdout (logs.access.enabled: true), which the agent reads via the k8s pod-log acquisition.

Restores attack detection. Enforcement — a Traefik bouncer acting on the decisions — is part 2 (separate PR, higher risk).

Worst case here is unchanged from today (agent parses nothing); no request-path effect.

🤖 Generated with Claude Code

Tier 4, part 1 of 2 — **detection** (the safe half; no ingress-path impact). The CrowdSec agent's log acquisition still targeted `podName: ingress-nginx-controller-*` — a selector that has matched **no pod** since ingress-nginx was retired (2026-05-17). So the agents have been parsing nothing and generating no decisions. This repoints acquisition to the Traefik controller (`podName: traefik-*`, `program: traefik`) and swaps `crowdsecurity/nginx` + `nginx-logs` for the `crowdsecurity/traefik` collection (bundles its own parser). Traefik already emits access logs to stdout (`logs.access.enabled: true`), which the agent reads via the k8s pod-log acquisition. Restores attack **detection**. **Enforcement** — a Traefik bouncer acting on the decisions — is part 2 (separate PR, higher risk). Worst case here is unchanged from today (agent parses nothing); no request-path effect. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

k.renner added 1 commit 2026-06-27 10:46:40 +00:00

crowdsec: repoint agent log acquisition from ingress-nginx to Traefik 6810dba05a

The agent's acquisition still targeted podName ingress-nginx-controller-*
in the ingress namespace — a selector that has matched no pod since
ingress-nginx was retired (2026-05-17), so the agents have been parsing
nothing and no decisions were being generated.

Repoint to the Traefik controller (podName traefik-*, program traefik)
and swap the nginx collection/parser for crowdsecurity/traefik (which
bundles its own log parser). This restores attack detection. Enforcement
(a Traefik bouncer acting on the decisions) is a separate change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit cde4b58bad into master

2026-06-27 11:02:11 +00:00

k.renner referenced this issue from a commit

2026-06-27 11:02:12 +00:00

Merge pull request 'crowdsec: repoint agent log acquisition from ingress-nginx to Traefik' (#76) from crowdsec-acquisition-traefik into master

k.renner referenced this pull request

2026-06-27 11:05:29 +00:00

traefik: add CrowdSec bouncer plugin + global fail-open middleware #77

k.renner referenced this pull request

2026-06-27 14:11:44 +00:00

traefik: disable global CrowdSec enforcement (caused v6 ingress outage) #80

Sign in to join this conversation.