rock
7b7499c689
The database was already off the internet: every memory-db service is ClusterIP, no Ingress backs one, and no public DNS name resolves to them. That is not isolation. A ClusterIP service answers every pod in the cluster, so any workload in any namespace could open 5432. Cilium enforces NetworkPolicy, so stating the allowed sources is what closes it. Two sources: - namespace poimen, which holds every client (poimen-memory, poimen-graphql, poimen-worker, poimen-workflows, the migration Job) - namespace cnpg-system, where the CloudNativePG operator connects for switchover and failover Port 5432 only. The operator metrics port stays closed because no PodMonitor for this cluster exists.
43 lines
1.5 KiB
YAML
43 lines
1.5 KiB
YAML
---
|
|
# Keep the memory database reachable only from inside its own namespace.
|
|
#
|
|
# What this does NOT change: the database was already unreachable from the
|
|
# internet. `memory-db-rw`, `memory-db-ro` and `memory-db-r` are ClusterIP
|
|
# services, no Ingress backs them, and no public DNS name resolves to them.
|
|
#
|
|
# What it fixes: a ClusterIP service is reachable by EVERY pod in the cluster,
|
|
# because Kubernetes has no implicit isolation. Cilium enforces NetworkPolicy, so
|
|
# stating the allowed sources is what turns "not on the internet" into "not
|
|
# reachable from another tenant's namespace".
|
|
#
|
|
# Two sources, both required:
|
|
# - the poimen namespace, which holds every client: poimen-memory, poimen-graphql,
|
|
# poimen-worker, poimen-workflows and the migration Job.
|
|
# - cnpg-system, where the CloudNativePG operator lives. It connects to the
|
|
# instance for switchover and failover, so a narrower rule breaks recovery.
|
|
#
|
|
# No other port is opened. The operator's metrics endpoint stays closed because no
|
|
# PodMonitor for this cluster exists, so nothing scrapes it.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: memory-db-ingress
|
|
namespace: poimen
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
cnpg.io/cluster: memory-db
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: poimen
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: cnpg-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|