feat(poimen): restrict the memory database to its own namespace #103

2026-11-03T21:34:01Z

rock commented

2026-11-03 21:34:01 +00:00

OpenSearch is already restricted to poimen-memory + opensearch-dashboards on 9200. The database had no NetworkPolicy at all, so any pod in any namespace could reach memory-db-rw:5432.

Neither is publicly exposed: all memory-db services are ClusterIP, no Ingress backs them, and opensearch.riotpiao.com / memory-db.riotpiao.com do not resolve. This change adds the in-cluster isolation that ClusterIP does not provide.

Allows 5432 from namespace poimen (all clients) and from cnpg-system (the operator, for switchover/failover).

OpenSearch is already restricted to poimen-memory + opensearch-dashboards on 9200. The database had no NetworkPolicy at all, so any pod in any namespace could reach memory-db-rw:5432. Neither is publicly exposed: all memory-db services are ClusterIP, no Ingress backs them, and opensearch.riotpiao.com / memory-db.riotpiao.com do not resolve. This change adds the in-cluster isolation that ClusterIP does not provide. Allows 5432 from namespace poimen (all clients) and from cnpg-system (the operator, for switchover/failover).

rock added 1 commit 2026-11-03 21:34:01 +00:00

feat(poimen): restrict the memory database to its own namespace 7b7499c689

The database was already off the internet: every memory-db service is ClusterIP,
no Ingress backs one, and no public DNS name resolves to them.

That is not isolation. A ClusterIP service answers every pod in the cluster, so
any workload in any namespace could open 5432. Cilium enforces NetworkPolicy, so
stating the allowed sources is what closes it.

Two sources:
- namespace poimen, which holds every client (poimen-memory, poimen-graphql,
  poimen-worker, poimen-workflows, the migration Job)
- namespace cnpg-system, where the CloudNativePG operator connects for switchover
  and failover

Port 5432 only. The operator metrics port stays closed because no PodMonitor for
this cluster exists.

rock merged commit 9e004ccb9b into main

2026-11-03 21:34:05 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#103