type: user

role: user

content:
You are implementing Task A4 of the "DD Agent Logs via Vector" plan.

## Task Description

Open Cilium NetworkPolicy ingress for port 8282 in the Vector module.

**File to modify:** `/Users/steve.briggs/projects/IAC/terraform/internal-modules/kubernetes/monitoring/vector/netpol.tf`

The current file has multiple ingress rules. The first ingress rule (around lines 12-21) reads:
```hcl
      {
        # OTLP from any cluster-internal sender (primarily otel-collector).
        fromEntities = ["cluster"]
        toPorts = [{
          ports = [
            { port = "4317" },
            { port = "4318" },
          ]
        }]
      },
```

Replace it with:
```hcl
      {
        # OTLP from any cluster-internal sender (primarily otel-collector).
        # Port 8282 is the OPW-compatible Datadog Agent intake (datadog_agent source).
        fromEntities = ["cluster"]
        toPorts = [{
          ports = [
            { port = "4317" },
            { port = "4318" },
            { port = "8282" },
          ]
        }]
      },
```

Two changes: a new comment line explaining 8282, and a new `{ port = "8282" },` entry in the `ports` list.

**Do NOT modify any other ingress rule.** In particular, do NOT add 8282 to the `host` (kubelet) ingress rule — kubelet doesn't probe this port.

## Verification

```
cd /Users/steve.briggs/projects/IAC/terraform/internal-modules/kubernetes/monitoring/vector
terraform fmt -check -recursive
```

Expected: no output, exit 0. (If `terraform fmt -check` reports differences, run `terraform fmt netpol.tf` to fix and document what was changed.)

Skip `terraform validate` — local terraform is 1.3.10 and the example is pinned higher; that's environmental, not a code concern.

## Context

The Vector module's `service.ports` and the `customConfig.sources.dd_agent_in` block were just modified to expose port 8282 as the OPW intake. The netpol now needs to allow cluster-internal traffic to reach that port. DD Agent pods are cluster-internal so the existing `fromEntities = ["cluster"]` rule is the right place to add the new port.

## CRITICAL — No git operations

Do NOT run any git commands. Sir Charles handles git himself.

## Your Job

1. Read the current `netpol.tf` to identify the exact existing text.
2. Make the edit (use Edit tool with sufficient context to uniquely match the old block).
3. Run `terraform fmt -check -recursive` per Verification.
4. Self-review: re-read the file, confirm only the targeted ingress rule was modified.
5. Report back.

## Report Format

- **Status:** DONE | DONE_WITH_CONCERNS | BLOCKED | NEEDS_CONTEXT
- File modified
- terraform fmt output (the actual command output)
- Self-review notes (specifically: confirm the kubelet `host` rule was NOT modified)
- Any concerns

userType: external

entrypoint: cli

gitBranch: master


type: message

role: assistant

type: text

text: I'll help you implement Task A4. Let me start by reading the current netpol.tf file to identify the exact text that needs to be modified.

service_tier: standard

attributionAgent: general-purpose

attributionPlugin: superpowers

type: assistant


Read

type: direct


content:
1	locals {
2	  netpols = {
3	    "vector" = local.vector_netpol
4	  }
5	  vector_netpol = {
6	    endpointSelector = {
7	      matchLabels = {
8	        "app.kubernetes.io/name" = "vector"
9	      }
10	    }
11	    ingress = [
12	      {
13	        # OTLP from any cluster-internal sender (primarily otel-collector).
14	        fromEntities = ["cluster"]
15	        toPorts = [{
16	          ports = [
17	            { port = "4317" },
18	            { port = "4318" },
19	          ]
20	        }]
21	      },
22	      {
23	        # Vector self-metrics scrape (Prometheus operator, Datadog Agent, etc.).
24	        fromEntities = ["cluster"]
25	        toPorts = [{
26	          ports = [{ port = "8686" }]
27	        }]
28	      },
29	      {
30	        # kubelet health probes from the node.
31	        fromEntities = ["host"]
32	        toPorts = [{
33	          ports = [
34	            { port = "4317" },
35	            { port = "4318" },
36	            { port = "8686" },
37	          ]
38	        }]
39	      },
40	      {
41	        fromEntities = ["kube-apiserver"]
42	      }
43	    ]
44	    egress = [
45	      {
46	        # Datadog SaaS HTTPS for logs/traces/metrics sinks.
47	        toEntities = ["world"]
48	        toPorts = [{
49	          ports = [{ port = "443" }]
50	        }]
51	      },
52	      {
53	        toEntities = ["kube-apiserver"]
54	      },
55	      {
56	        # DNS resolution + service discovery (CoreDNS lives here).
57	        toEntities = ["cluster"]
58	      }
59	    ]
60	  }
61	}
62


text: Now I'll make the edit to add port 8282 and the explanatory comment to the first ingress rule:


Edit

old_string:
      {
        # OTLP from any cluster-internal sender (primarily otel-collector).
        fromEntities = ["cluster"]
        toPorts = [{
          ports = [
            { port = "4317" },
            { port = "4318" },
          ]
        }]
      },

new_string:
      {
        # OTLP from any cluster-internal sender (primarily otel-collector).
        # Port 8282 is the OPW-compatible Datadog Agent intake (datadog_agent source).
        fromEntities = ["cluster"]
        toPorts = [{
          ports = [
            { port = "4317" },
            { port = "4318" },
            { port = "8282" },
          ]
        }]
      },

speed: standard


content: The file /Users/steve.briggs/projects/IAC/terraform/internal-modules/kubernetes/monitoring/vector/netpol.tf has been updated successfully. (file state is current in your context — no need to Read it back)


text: Now let me run the terraform fmt verification:


Bash

command: cd /Users/steve.briggs/projects/IAC/terraform/internal-modules/kubernetes/monitoring/vector && terraform fmt -check -recursive

description: Run terraform fmt check to verify formatting


content: (Bash completed with no output)


text: Perfect. Now let me self-review by reading the file to confirm only the targeted ingress rule was modified and the kubelet rule was not touched:


content:
1	locals {
2	  netpols = {
3	    "vector" = local.vector_netpol
4	  }
5	  vector_netpol = {
6	    endpointSelector = {
7	      matchLabels = {
8	        "app.kubernetes.io/name" = "vector"
9	      }
10	    }
11	    ingress = [
12	      {
13	        # OTLP from any cluster-internal sender (primarily otel-collector).
14	        # Port 8282 is the OPW-compatible Datadog Agent intake (datadog_agent source).
15	        fromEntities = ["cluster"]
16	        toPorts = [{
17	          ports = [
18	            { port = "4317" },
19	            { port = "4318" },
20	            { port = "8282" },
21	          ]
22	        }]
23	      },
24	      {
25	        # Vector self-metrics scrape (Prometheus operator, Datadog Agent, etc.).
26	        fromEntities = ["cluster"]
27	        toPorts = [{
28	          ports = [{ port = "8686" }]
29	        }]
30	      },
31	      {
32	        # kubelet health probes from the node.
33	        fromEntities = ["host"]
34	        toPorts = [{
35	          ports = [
36	            { port = "4317" },
37	            { port = "4318" },
38	            { port = "8686" },
39	          ]
40	        }]
41	      },
42	      {
43	        fromEntities = ["kube-apiserver"]
44	      }
45	    ]
46	    egress = [
47	      {
48	        # Datadog SaaS HTTPS for logs/traces/metrics sinks.
49	        toEntities = ["world"]
50	        toPorts = [{
51	          ports = [{ port = "443" }]
52	        }]
53	      },
54	      {
55	        toEntities = ["kube-apiserver"]
56	      },
57	      {
58	        # DNS resolution + service discovery (CoreDNS lives here).
59	        toEntities = ["cluster"]
60	      }
61	    ]
62	  }
63	}
64


text:
Excellent. Self-review complete. Let me document the findings:

---

## Report

**Status:** DONE

**File modified:** `/Users/steve.briggs/projects/IAC/terraform/internal-modules/kubernetes/monitoring/vector/netpol.tf`

**Changes made:**
1. Added comment on line 14: `# Port 8282 is the OPW-compatible Datadog Agent intake (datadog_agent source).`
2. Added port entry on line 20: `{ port = "8282" },` to the cluster-internal ingress rule's ports list

**terraform fmt verification:**
```
cd /Users/steve.briggs/projects/IAC/terraform/internal-modules/kubernetes/monitoring/vector && terraform fmt -check -recursive
```
Exit code: 0, no output (formatting is correct).

**Self-review notes:**
- ✓ Only the first ingress rule (lines 12-23) was modified as required
- ✓ The kubelet `host` ingress rule (lines 31-41) was NOT modified—it still contains only ports 4317, 4318, and 8686
- ✓ The self-metrics scrape rule (lines 24-30) and kube-apiserver rule (lines 42-45) remain unchanged
- ✓ Egress rules untouched
- ✓ File is properly formatted

No concerns. Task A4 is complete, Sir Charles.