From 9f15e4eb3c57a5ace0502aab4cf50a390d7fa710 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Wed, 4 Nov 2026 05:38:26 +0800
Subject: [PATCH] feat(poimen): restrict the GraphQL server to the memory proxy

poimen-graphql is already ClusterIP on 8090 with no Ingress, so it is off the
internet. It had no NetworkPolicy, so every pod in the cluster could reach it.

The only caller is poimen-memory, which forwards its /graphql route to
MEM_GQL_PORT=8090. No other workload references the service.

Allows 8090 from poimen-memory pods only.
---
 k8s/infra/poimen/graphql-netpol.yaml | 28 ++++++++++++++++++++++++++++
 k8s/infra/poimen/kustomization.yaml  |  2 ++
 2 files changed, 30 insertions(+)
 create mode 100644 k8s/infra/poimen/graphql-netpol.yaml

diff --git a/k8s/infra/poimen/graphql-netpol.yaml b/k8s/infra/poimen/graphql-netpol.yaml
new file mode 100644
index 0000000..50eff71
--- /dev/null
+++ b/k8s/infra/poimen/graphql-netpol.yaml
@@ -0,0 +1,28 @@
+---
+# Keep the GraphQL server reachable only from the one service that proxies it.
+#
+# poimen-graphql is already off the internet: its Service is ClusterIP on 8090 and
+# no Ingress names it. What it lacked is in-cluster isolation — a ClusterIP answers
+# every pod in the cluster.
+#
+# The only caller is poimen-memory, whose /graphql route forwards the request body
+# to MEM_GQL_PORT (8090). No other workload references this service.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: poimen-graphql-ingress
+  namespace: poimen
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: poimen-graphql
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: poimen-memory
+      ports:
+        - protocol: TCP
+          port: 8090
diff --git a/k8s/infra/poimen/kustomization.yaml b/k8s/infra/poimen/kustomization.yaml
index 30945a6..0884f5a 100644
--- a/k8s/infra/poimen/kustomization.yaml
+++ b/k8s/infra/poimen/kustomization.yaml
@@ -8,6 +8,8 @@ resources:
   - memory-db.yaml
   # ClusterIP alone is not isolation: every pod in the cluster can reach it.
   - memory-db-netpol.yaml
+  # Only poimen-memory's /graphql proxy calls 8090.
+  - graphql-netpol.yaml
   - poimen-sandbox-namespace.yaml
   - poimen-sandbox-quota.yaml
   - pi-session-netpol.yaml