kubernetes/infrastructure/cilium/helmrelease.yaml

@@ -156,13 +156,39 @@ spec:
     k8sServicePort: 7445
     # Hubble itself is on in every agent (chart default); the relay aggregates
     # the three nodes' flow buffers behind one gRPC endpoint so `hubble observe`
-    # works without exec into kube-system (REN-487). Renders no change to
-    # cilium-config or the agent DaemonSet, so the reloader annotation above
-    # does not roll the CNI. The relay has no client auth; who may reach it is
-    # network-policies/kube-system-hubble-relay.yaml.
+    # works without exec into kube-system (REN-487). The relay has no client
+    # auth; who may reach it is network-policies/kube-system-hubble-relay.yaml.
     hubble:
       relay:
         enabled: true
+      # Every policy drop goes to the agent's stdout and from there to Loki
+      # ({namespace="kube-system", container="cilium-agent"} |= "POLICY_DENIED"),
+      # so denied traffic can be reviewed after the fact. Changes cilium-config,
+      # so the reloader rolls the agents.
+      export:
+        static:
+          enabled: true
+          filePath: stdout
+          allowList:
+            - '{"verdict":["DROPPED"],"drop_reason_desc":["POLICY_DENIED"],"event_type":[{"type":1}]}'
+          fieldMask:
+            - time
+            - node_name
+            - verdict
+            - drop_reason_desc
+            - traffic_direction
+            - IP
+            - l4
+            - source.namespace
+            - source.pod_name
+            - source.identity
+            - source.workloads
+            - source_names
+            - destination.namespace
+            - destination.pod_name
+            - destination.identity
+            - destination.workloads
+            - destination_names
     l2announcements:
       enabled: true
     externalIPs: