feat(poimen): restrict the GraphQL server to the memory proxy

poimen-graphql is already ClusterIP on 8090 with no Ingress, so it is off the internet. It had no NetworkPolicy, so every pod in the cluster could reach it. The only caller is poimen-memory, which forwards its /graphql route to MEM_GQL_PORT=8090. No other workload references the service. Allows 8090 from poimen-memory pods only.
2026-11-04 05:38:26 +08:00
parent 9e004ccb9b
commit 9f15e4eb3c
2 changed files with 30 additions and 0 deletions
@@ -8,6 +8,8 @@ resources:
  - memory-db.yaml
  # ClusterIP alone is not isolation: every pod in the cluster can reach it.
  - memory-db-netpol.yaml
+  # Only poimen-memory's /graphql proxy calls 8090.
+  - graphql-netpol.yaml
  - poimen-sandbox-namespace.yaml
  - poimen-sandbox-quota.yaml
  - pi-session-netpol.yaml