43 lines
1.5 KiB
YAML
43 lines
1.5 KiB
YAML
---
|
|
# Keep the memory database reachable only from inside its own namespace.
|
|
#
|
|
# What this does NOT change: the database was already unreachable from the
|
|
# internet. `memory-db-rw`, `memory-db-ro` and `memory-db-r` are ClusterIP
|
|
# services, no Ingress backs them, and no public DNS name resolves to them.
|
|
#
|
|
# What it fixes: a ClusterIP service is reachable by EVERY pod in the cluster,
|
|
# because Kubernetes has no implicit isolation. Cilium enforces NetworkPolicy, so
|
|
# stating the allowed sources is what turns "not on the internet" into "not
|
|
# reachable from another tenant's namespace".
|
|
#
|
|
# Two sources, both required:
|
|
# - the poimen namespace, which holds every client: poimen-memory, poimen-graphql,
|
|
# poimen-worker, poimen-workflows and the migration Job.
|
|
# - cnpg-system, where the CloudNativePG operator lives. It connects to the
|
|
# instance for switchover and failover, so a narrower rule breaks recovery.
|
|
#
|
|
# No other port is opened. The operator's metrics endpoint stays closed because no
|
|
# PodMonitor for this cluster exists, so nothing scrapes it.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: memory-db-ingress
|
|
namespace: poimen
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
cnpg.io/cluster: memory-db
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: poimen
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: cnpg-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|