The agent's acquisition still targeted podName ingress-nginx-controller-*
in the ingress namespace — a selector that has matched no pod since
ingress-nginx was retired (2026-05-17), so the agents have been parsing
nothing and no decisions were being generated.
Repoint to the Traefik controller (podName traefik-*, program traefik)
and swap the nginx collection/parser for crowdsecurity/traefik (which
bundles its own log parser). This restores attack detection. Enforcement
(a Traefik bouncer acting on the decisions) is a separate change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
k.rennerandClaude Opus 4.8