Cluster authorization

Grafana Alloy
1

How does Alloy control who can join a cluster? It seems to me that there is no auth at all and anybody can join a cluster as long as they can connect to the port.

I guess when you are using Kubernetes you can define network policies that prevent access, but if you deploy on bare metal then there is nothing nearly as secure available without creating a subnet dedicated to Alloy.

Am I understanding this right?

2

There is no cluster authentication as far as I can tell. However, when forming a cluster you should specify --cluster.join-addresses using a DNS record, and if you deploy in Kubernetes unless someone manages to alter the service DNS record it shouldn’t be a problem.