From 9777e147e88a802355f2533bb0b0af18ef739c76 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sat, 7 Nov 2026 11:24:23 +0100 Subject: [PATCH] feat(cilium): export policy drops to the agent log Hubble's static exporter writes every POLICY_DENIED drop event to the cilium-agent stdout, which Alloy already ships to Loki (1 year retention). That makes denied traffic reviewable after the fact instead of only for the minutes the Hubble ring buffer holds. Filter and field mask were checked against the running 1.20.4 agent with hubble observe --allowlist / --field-mask. The cilium-config change rolls the agents one at a time via the reloader annotation. Refs S28-30 Co-Authored-By: Claude Opus 5.5 --- .../infrastructure/cilium/helmrelease.yaml | 34 ++++++++++++++++--- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/kubernetes/infrastructure/cilium/helmrelease.yaml b/kubernetes/infrastructure/cilium/helmrelease.yaml index 273a1dd1..ddfcd48d 100644 --- a/kubernetes/infrastructure/cilium/helmrelease.yaml +++ b/kubernetes/infrastructure/cilium/helmrelease.yaml @@ -156,13 +156,39 @@ spec: k8sServicePort: 7445 # Hubble itself is on in every agent (chart default); the relay aggregates # the three nodes' flow buffers behind one gRPC endpoint so `hubble observe` - # works without exec into kube-system (REN-487). Renders no change to - # cilium-config or the agent DaemonSet, so the reloader annotation above - # does not roll the CNI. The relay has no client auth; who may reach it is - # network-policies/kube-system-hubble-relay.yaml. + # works without exec into kube-system (REN-487). The relay has no client + # auth; who may reach it is network-policies/kube-system-hubble-relay.yaml. hubble: relay: enabled: true + # Every policy drop goes to the agent's stdout and from there to Loki + # ({namespace="kube-system", container="cilium-agent"} |= "POLICY_DENIED"), + # so denied traffic can be reviewed after the fact. Changes cilium-config, + # so the reloader rolls the agents. + export: + static: + enabled: true + filePath: stdout + allowList: + - '{"verdict":["DROPPED"],"drop_reason_desc":["POLICY_DENIED"],"event_type":[{"type":1}]}' + fieldMask: + - time + - node_name + - verdict + - drop_reason_desc + - traffic_direction + - IP + - l4 + - source.namespace + - source.pod_name + - source.identity + - source.workloads + - source_names + - destination.namespace + - destination.pod_name + - destination.identity + - destination.workloads + - destination_names l2announcements: enabled: true externalIPs: -- 2.54.0