rock
7b7499c689
The database was already off the internet: every memory-db service is ClusterIP, no Ingress backs one, and no public DNS name resolves to them. That is not isolation. A ClusterIP service answers every pod in the cluster, so any workload in any namespace could open 5432. Cilium enforces NetworkPolicy, so stating the allowed sources is what closes it. Two sources: - namespace poimen, which holds every client (poimen-memory, poimen-graphql, poimen-worker, poimen-workflows, the migration Job) - namespace cnpg-system, where the CloudNativePG operator connects for switchover and failover Port 5432 only. The operator metrics port stays closed because no PodMonitor for this cluster exists.
15 lines
553 B
YAML
15 lines
553 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
# Poimen infrastructure — CNPG Postgres for memory service.
|
|
# Part of the `poimen` ArgoCD Application (multi-source, source 3).
|
|
# Sync-wave -1 ensures the DB cluster is healthy before application
|
|
# deployments (wave 0) are applied.
|
|
resources:
|
|
- memory-db.yaml
|
|
# ClusterIP alone is not isolation: every pod in the cluster can reach it.
|
|
- memory-db-netpol.yaml
|
|
- poimen-sandbox-namespace.yaml
|
|
- poimen-sandbox-quota.yaml
|
|
- pi-session-netpol.yaml
|
|
- pi-agent-workspace-pv.yaml
|