feat(poimen): restrict the memory database to its own namespace (#103)

Co-authored-by: rock <[email protected]>
2026-11-03 21:34:04 +00:00
parent 4e684b2ee2
commit 9e004ccb9b
2 changed files with 44 additions and 0 deletions
@@ -6,6 +6,8 @@ kind: Kustomization
 # deployments (wave 0) are applied.
 resources:
  - memory-db.yaml
+  # ClusterIP alone is not isolation: every pod in the cluster can reach it.
+  - memory-db-netpol.yaml
  - poimen-sandbox-namespace.yaml
  - poimen-sandbox-quota.yaml
  - pi-session-netpol.yaml