The database was already off the internet: every memory-db service is ClusterIP,
no Ingress backs one, and no public DNS name resolves to them.
That is not isolation. A ClusterIP service answers every pod in the cluster, so
any workload in any namespace could open 5432. Cilium enforces NetworkPolicy, so
stating the allowed sources is what closes it.
Two sources:
- namespace poimen, which holds every client (poimen-memory, poimen-graphql,
poimen-worker, poimen-workflows, the migration Job)
- namespace cnpg-system, where the CloudNativePG operator connects for switchover
and failover
Port 5432 only. The operator metrics port stays closed because no PodMonitor for
this cluster exists.
rock
7b7499c689