---
# Keep the GraphQL server reachable only from the one service that proxies it.
#
# poimen-graphql is already off the internet: its Service is ClusterIP on 8090 and
# no Ingress names it. What it lacked is in-cluster isolation — a ClusterIP answers
# every pod in the cluster.
#
# The only caller is poimen-memory, whose /graphql route forwards the request body
# to MEM_GQL_PORT (8090). No other workload references this service.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: poimen-graphql-ingress
  namespace: poimen
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: poimen-graphql
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: poimen-memory
      ports:
        - protocol: TCP
          port: 8090