authentik and monitoring carried only the metadata block, so every pod
there could reach anything. Both now follow the pattern from matrix: the
broad policy keeps an exclusion list and stays as the catch-all, and each
workload gets a rule of its own.
The destinations were read, not guessed. Alloy ships to 10.0.0.3 on 3100
and 9090 - taken from its running configuration. Authentik sends mail
through smtp.ionos.de:587, and that is load-bearing rather than optional:
the blueprints use password recovery and invitations by mail. The database
and kube-state-metrics speak to nobody outside.
Mail gets a /27 rather than two /32. The name resolves to .97 and .113
today, both in the provider's own block; a third address would break mail
with nobody watching a rule, and thirty-two addresses of one provider's
mail infrastructure is the smaller price. That is the opposite call to
ClamAV on purpose - this is not a CDN in front of half the internet.
Deliberately not allowed: authentik's version check. It sits behind
Cloudflare with rotating addresses and nothing depends on it, so the call
fails and gets logged. The manifest says so, because whoever finds that
error later should know it is intended.
Congruence checked in both namespaces before pushing: excluded and
narrowly ruled are the same sets.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F2Q4Ri8NGwyTZzScvKnWFM
Thore CimbalandClaude Opus 5
d5b59eb5e9