all the changes

k8s/clickhouse.yaml

@@ -143,4 +143,6 @@ spec:
   - name: http
     port: 8123
     targetPort: 8123
-  type: ClusterIP
+  # LoadBalancer for local-LAN development access only (training exports,
+  # spike-alerts). The receiver itself stays behind its own Service.
+  type: LoadBalancer

k8s/deployment.yaml

@@ -93,6 +93,16 @@ spec:
           value: "30s"
         - name: OTEL_CLICKHOUSE_CONN_MAX_LIFETIME
           value: "10m"
+        # Ingress blocker: promotes scanner IPs into ingress-nginx block-cidrs.
+        # Dry-run first: it logs what it would block and exposes it at
+        # /api/blocker/status. Set OTEL_BLOCKER_DRY_RUN=false to enforce, and
+        # put your own public IP(s) in OTEL_BLOCKER_ALLOW before doing so.
+        - name: OTEL_BLOCKER_ENABLED
+          value: "true"
+        - name: OTEL_BLOCKER_DRY_RUN
+          value: "true"
+        - name: OTEL_BLOCKER_ALLOW
+          value: ""
         - name: OTEL_STORE_WORKERS
           value: "4"
         # Optional rollout observation. The watcher is read-only and uses the
@@ -229,3 +239,32 @@ subjects:
 - kind: ServiceAccount
   name: otel-debug-receiver
   namespace: monitoring
+
+---
+# The blocker may read and update exactly one ConfigMap: the ingress-nginx
+# controller's, where `block-cidrs` lives. Nothing else in that namespace.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: otel-debug-receiver-ip-blocker
+  namespace: ingress-nginx
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  resourceNames: ["ingress-nginx-controller"]
+  verbs: ["get", "update"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: otel-debug-receiver-ip-blocker
+  namespace: ingress-nginx
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: otel-debug-receiver-ip-blocker
+subjects:
+- kind: ServiceAccount
+  name: otel-debug-receiver
+  namespace: monitoring