feat: what the filters excluded is named inside the cluster (ADR 0084)

[kfeofantov]

The agent counts what its filters exclude and never names it. That is the promise about what leaves the cluster — and it has also meant the customer, who owns every one of those annotations and can read them with kubectl, learns from this agent only that nine of something were excluded. Two questions had no answer: which object carries the annotation someone wrote, and why a given workload is missing from the report when five controls could have removed it.

What this adds

A second listener on the controller, at 127.0.0.1:9091, serving /collection: one NDJSON line per namespace, pod and Job — collected or not, profilable or not, which control refused it, and whether its workload was a kind the agent cannot read (ADR 0028 §3).

Nothing is retained to answer it. The informer caches already hold every object whether admitted or not, so the listing runs the same Admit* calls the event path makes and cannot drift from the decision. Reading it moves no counter.

Why loopback and not a path on 9090

A NetworkPolicy selects ports, not paths. The health port is opened to any source by a rule whose own justification is that every path there "names nothing in the cluster" — the caller is the kubelet, arriving from an address no pod selector can name. A path naming objects does not share that port. The policy is also not rendered at all in a controller-only install, and is inert where the CNI ignores it, so the bind address is the only control that holds in every case.

Loopback also settles authorization without inventing any: kubectl port-forward is the only way in, and Kubernetes already gates it on create of pods/portforward in the agent's namespace.

A non-loopback collection.listenAddress is a startup failure rather than a value normalized into something safe.

What keeps it inside the cluster

Not the handler — the import graph. Nothing that can write a payload or open a connection imports the package, and TestNothingThatCanTransmitKnowsThisPackage fails if that changes.

Not changed

No payload byte, no RBAC, no new verb, no Service, no container port, no rule in the shipped NetworkPolicy. The inference ADR 0054 named is neither closed nor widened; this is not shipped anywhere.

Evidence

go test -race ./...     # all packages ok, e2e tags type-checked
golangci-lint run       # 0 issues (v2.11.4, the CI pin)
make chart-lint         # three profiles, 0 failed

Also built and tested from a clean git archive HEAD extraction.

Not exercised against a kind cluster: the endpoint has no e2e test in this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KeZECJXTDHL6Nts95eKMJA