feat(poimen): restrict the GraphQL server to the memory proxy #104

2026-11-03T21:38:31Z

rock commented

2026-11-03 21:38:31 +00:00

poimen-graphql is ClusterIP on 8090 with no Ingress, so it is not public. It had no NetworkPolicy, so any pod in any namespace could reach it.

Only poimen-memory calls it, through its /graphql proxy to MEM_GQL_PORT. This allows 8090 from poimen-memory pods only.

poimen-graphql is ClusterIP on 8090 with no Ingress, so it is not public. It had no NetworkPolicy, so any pod in any namespace could reach it. Only poimen-memory calls it, through its /graphql proxy to MEM_GQL_PORT. This allows 8090 from poimen-memory pods only.

rock added 1 commit 2026-11-03 21:38:31 +00:00

feat(poimen): restrict the GraphQL server to the memory proxy 9f15e4eb3c

poimen-graphql is already ClusterIP on 8090 with no Ingress, so it is off the
internet. It had no NetworkPolicy, so every pod in the cluster could reach it.

The only caller is poimen-memory, which forwards its /graphql route to
MEM_GQL_PORT=8090. No other workload references the service.

Allows 8090 from poimen-memory pods only.

rock merged commit 712bb6589b into main

2026-11-03 21:38:35 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#104