From e25f1a43f8a7496337962d8e6491fafaf0c87c7f Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sat, 7 Nov 2026 22:00:21 +0100 Subject: [PATCH 1/2] fix(authentik): admit the UDM's LDAPS sync to the LDAP outpost The UDM authenticates admins against ldap.renner.uno:636 and syncs hourly. It sources from its k8s-ingress address (10.2.47.1 / fd02:47::1), which ldap-outpost-lan-ingress did not admit: 200 SYNs a day dropped at :26 every hour. Same group the alloy-syslog and CoreDNS policies use for the UDM; LDAPS only. S28-39 Co-Authored-By: Claude Opus 5.5 --- kubernetes/apps/authentik/ldap-outpost-cnp.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kubernetes/apps/authentik/ldap-outpost-cnp.yaml b/kubernetes/apps/authentik/ldap-outpost-cnp.yaml index ba94ead5..ebb848c1 100644 --- a/kubernetes/apps/authentik/ldap-outpost-cnp.yaml +++ b/kubernetes/apps/authentik/ldap-outpost-cnp.yaml @@ -34,3 +34,11 @@ spec: protocol: TCP - port: "6636" protocol: TCP + # The UDM's LDAPS admin-auth sync; it sources from its k8s-ingress + # address. + - fromCIDRSet: + - cidrGroupRef: net-k8s-ingress + toPorts: + - ports: + - port: "6636" + protocol: TCP -- 2.54.0 From 6a0dbf9e26e2592f2365f3ad944a3b9f2dbc6fe2 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sat, 7 Nov 2026 22:02:30 +0100 Subject: [PATCH 2/2] fix(authentik): admit only the UDM's own address, not all of k8s-ingress New CIDR group udm-k8s-ingress (10.2.47.1/32, fd02:47::1/128); the LDAPS rule references it instead of the whole net-k8s-ingress network. S28-39 Co-Authored-By: Claude Opus 5.5 --- kubernetes/apps/authentik/ldap-outpost-cnp.yaml | 5 ++--- .../infrastructure/network-policies/cidr-groups.yaml | 11 +++++++++++ 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/kubernetes/apps/authentik/ldap-outpost-cnp.yaml b/kubernetes/apps/authentik/ldap-outpost-cnp.yaml index ebb848c1..9ac9a956 100644 --- a/kubernetes/apps/authentik/ldap-outpost-cnp.yaml +++ b/kubernetes/apps/authentik/ldap-outpost-cnp.yaml @@ -34,10 +34,9 @@ spec: protocol: TCP - port: "6636" protocol: TCP - # The UDM's LDAPS admin-auth sync; it sources from its k8s-ingress - # address. + # The UDM's LDAPS admin-auth sync. - fromCIDRSet: - - cidrGroupRef: net-k8s-ingress + - cidrGroupRef: udm-k8s-ingress toPorts: - ports: - port: "6636" diff --git a/kubernetes/infrastructure/network-policies/cidr-groups.yaml b/kubernetes/infrastructure/network-policies/cidr-groups.yaml index 0ee9df84..64c9f81d 100644 --- a/kubernetes/infrastructure/network-policies/cidr-groups.yaml +++ b/kubernetes/infrastructure/network-policies/cidr-groups.yaml @@ -74,6 +74,17 @@ spec: - fd02:47::/64 - 10.2.47.0/24 --- +# The UDM's own address on k8s-ingress, which it sources from towards the +# cluster's LoadBalancer IPs. +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: udm-k8s-ingress +spec: + externalCIDRs: + - fd02:47::1/128 + - 10.2.47.1/32 +--- apiVersion: cilium.io/v2 kind: CiliumCIDRGroup metadata: -- 2.54.0