---
# Keep the memory database reachable only from inside its own namespace.
#
# What this does NOT change: the database was already unreachable from the
# internet. `memory-db-rw`, `memory-db-ro` and `memory-db-r` are ClusterIP
# services, no Ingress backs them, and no public DNS name resolves to them.
#
# What it fixes: a ClusterIP service is reachable by EVERY pod in the cluster,
# because Kubernetes has no implicit isolation. Cilium enforces NetworkPolicy, so
# stating the allowed sources is what turns "not on the internet" into "not
# reachable from another tenant's namespace".
#
# Two sources, both required:
#  - the poimen namespace, which holds every client: poimen-memory, poimen-graphql,
#    poimen-worker, poimen-workflows and the migration Job.
#  - cnpg-system, where the CloudNativePG operator lives. It connects to the
#    instance for switchover and failover, so a narrower rule breaks recovery.
#
# No other port is opened. The operator's metrics endpoint stays closed because no
# PodMonitor for this cluster exists, so nothing scrapes it.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: memory-db-ingress
  namespace: poimen
spec:
  podSelector:
    matchLabels:
      cnpg.io/cluster: memory-db
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: poimen
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: cnpg-system
      ports:
        - protocol: TCP
          port: 5432