From c4f32c7a97e4f241c9048476f37ea2605e5b509d Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sat, 7 Nov 2026 11:14:54 +0100 Subject: [PATCH] feat(monitoring): restrict syslog ingress to the sending networks alloy-syslog accepted syslog from any world source. Senders seen in Hubble and Loki over the last 7 days: switches and APs on Management, SLZB coordinators and edge hosts on IoT, and the UDM, which sources from its k8s-ingress address 10.2.47.1. The LB is ETP=Local, so those client addresses reach the pod. Refs S28-19 Co-Authored-By: Claude Opus 5.5 --- .../monitoring-alloy-syslog.yaml | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/kubernetes/infrastructure/network-policies/monitoring-alloy-syslog.yaml b/kubernetes/infrastructure/network-policies/monitoring-alloy-syslog.yaml index f5e0f958..e1bb0a08 100644 --- a/kubernetes/infrastructure/network-policies/monitoring-alloy-syslog.yaml +++ b/kubernetes/infrastructure/network-policies/monitoring-alloy-syslog.yaml @@ -1,13 +1,6 @@ -# Targeted carve-out: alloy-syslog needs world ingress on the syslog -# ports specifically. The Service is ETP=Cluster, so external syslog -# senders (Proxmox, LXC hosts, network gear) hit the LB IP, get DNAT'd -# to an alloy pod, and get SNAT'd to the receiving node's cilium_host -# address. Cilium then sees the source as `world-ipv4` identity (the -# cilium_host IP isn't a known endpoint), NOT `host` — so the broad -# monitoring CNP's `fromEntities: host` rule doesn't catch it. -# -# Scoped via endpointSelector so this only widens ingress on the -# alloy-syslog pod, not the whole namespace. +# Syslog senders reaching the alloy-syslog LB (ETP=Local, client address +# reaches the pod): network gear on Management, the SLZB coordinators on +# IoT, and the UDM itself, which sources from its k8s-ingress address. apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: @@ -19,8 +12,10 @@ spec: app.kubernetes.io/instance: alloy-syslog app.kubernetes.io/name: alloy ingress: - - fromEntities: - - world + - fromCIDRSet: + - cidrGroupRef: net-management + - cidrGroupRef: net-iot + - cidrGroupRef: net-k8s-ingress toPorts: - ports: - port: "514" -- 2.54.0