feat(poimen): restrict the GraphQL server to the memory proxy (#104)

Co-authored-by: rock <[email protected]>
2026-11-03 21:38:34 +00:00
parent 9e004ccb9b
commit 712bb6589b
2 changed files with 30 additions and 0 deletions
@@ -8,6 +8,8 @@ resources:
  - memory-db.yaml
  # ClusterIP alone is not isolation: every pod in the cluster can reach it.
  - memory-db-netpol.yaml
+  # Only poimen-memory's /graphql proxy calls 8090.
+  - graphql-netpol.yaml
  - poimen-sandbox-namespace.yaml
  - poimen-sandbox-quota.yaml
  - pi-session-netpol.yaml