rock 9f15e4eb3c feat(poimen): restrict the GraphQL server to the memory proxy ...

poimen-graphql is already ClusterIP on 8090 with no Ingress, so it is off the
internet. It had no NetworkPolicy, so every pod in the cluster could reach it.

The only caller is poimen-memory, which forwards its /graphql route to
MEM_GQL_PORT=8090. No other workload references the service.

Allows 8090 from poimen-memory pods only.

2026-11-04 05:38:26 +08:00

..

cluster-maintenance

fix(etcd): add a working 15-day defrag CronJob under the backend quota

2026-10-07 17:12:39 +08:00

databases

chore(iam): retire Authentik

2026-10-26 03:32:18 -07:00

forgejo-runner

fix: use CiliumNetworkPolicy for kube-apiserver egress (#49)

2026-09-13 14:04:35 +00:00

iam

fix(iam): make ZITADEL OIDC secrets and identity links IaC-owned (#85)

2026-10-31 20:53:53 +00:00

local-path

feat(storage): add local-path-provisioner as the fleet's persistent-storage backend

2026-10-06 12:45:12 +08:00

logging

feat(grafana): provision a Gotify contact point

2026-10-27 12:38:29 -07:00

longhorn

feat(longhorn): one-shot destructive disk health scan job (#95)

2026-11-02 04:32:30 +00:00

minio

fix(iam): make ZITADEL OIDC secrets and identity links IaC-owned (#85)

2026-10-31 20:53:53 +00:00

monitoring

chore(iam): retire Authentik

2026-10-26 03:32:18 -07:00

poimen

feat(poimen): restrict the GraphQL server to the memory proxy

2026-11-04 05:38:26 +08:00

rbac

feat(iam): wire all 9 consumer manifests to Zitadel OIDC

2026-10-26 00:14:51 -07:00

talos-repair

fix(oidc): remove the API-server restart Jobs from GitOps

2026-10-24 15:06:32 -07:00

tekton

fix: vendor Tekton release.yaml for proper ArgoCD management

2026-09-13 15:10:39 +09:00

tracing

feat(cag): PrometheusRule + Grafana panels for KV cache observability

2026-09-27 18:37:03 +08:00

zitadel-core

feat(iam): own the ZITADEL core objects in GitOps

2026-10-26 23:54:57 -07:00