konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests Packages Projects Releases 1 Wiki Activity

docs(monitoring): record the ESO scrape trust boundary and real grant scope (REN-100) #998

Merged
Ghost merged 2 commits from atlas/ren-103-scrape-doc-gaps into master 2026-10-01 09:03:17 +00:00
Conversation 5 Commits 2 Files Changed 2
+30 -3
2 Commits
Author SHA1 Message Date
atlas-botPaperclipClaude Opus 5
 		51afb386bc docs(netpol): correct the monitoring-grant count in external-secrets-ns
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details 
The previous wording claimed home-assistant-ns.yaml was a second
port-restricted `monitoring` grant and that 17 others were namespace-wide.
Both numbers were wrong. Counted per ingress list item over
kubernetes/infrastructure/network-policies at master:

  20 `monitoring` grants across 19 files
  (influxdb-ns.yaml carries two — one whole-namespace, one Grafana-pod)
  exactly one of them — this rule — carries a `toPorts`

home-assistant-ns.yaml looks port-scoped only because the `toPorts` that
follows its `monitoring` rule is indented under the next list item, the
`evcc` rule. Its `monitoring` grant is namespace-wide.

Comment-only. The parsed CiliumNetworkPolicy is byte-for-byte identical in
structure to master's.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-26 00:39:23 +00:00
atlas-botPaperclipClaude Opus 5
 		b4e56e2d1f docs(monitoring): record the ESO scrape's trust boundary and real grant scope (REN-100)
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details 
Comment-only. No manifest field changes, so `kustomize build` output is
byte-identical before and after.

Two gaps in what REN-103's merged scrape says about itself, both raised in
review of PR #994/#996:

  * The metrics endpoint is plain HTTP with no authentication. That is chart
    2.11.0's default (`metrics.listen.secure.enabled` and
    `metrics.listen.auth.enabled` both false, values.yaml:365-369) and this
    repo overrides neither, so what actually bounds the exposure is the
    CiliumNetworkPolicy, not the endpoint. A reader adding `tlsConfig` to the
    PodMonitor would have broken the scrape; say so in the file.

  * The network policy comment implied the grant reaches the controller. It
    does not: the CNP's `endpointSelector` is {}, so monitoring→:8080 is
    admitted for all three ESO deployments, which all serve metrics on that
    port. Only the controller is scraped, because the PodMonitor's selector is
    exact on the unsuffixed name. Reachable-but-unvisited is the accurate
    description and the one a future reader needs.

Also corrected two counts in the same comment. The port-scoping is not unique
in this directory — home-assistant-ns.yaml does it too, so 17 of the other 18
`monitoring` grants are namespace-wide, not all 18. And there is no single
"health port": the controller's is 8082, the webhook's and cert-controller's
are 8081 (values.yaml:501-504, 564-570, 882-885).

Revert: `git revert` this commit. It restores the previous comment text and
touches no applied field.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-26 00:26:01 +00:00