rock
9f15e4eb3c
poimen-graphql is already ClusterIP on 8090 with no Ingress, so it is off the internet. It had no NetworkPolicy, so every pod in the cluster could reach it. The only caller is poimen-memory, which forwards its /graphql route to MEM_GQL_PORT=8090. No other workload references the service. Allows 8090 from poimen-memory pods only.
17 lines
629 B
YAML
17 lines
629 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
# Poimen infrastructure — CNPG Postgres for memory service.
|
|
# Part of the `poimen` ArgoCD Application (multi-source, source 3).
|
|
# Sync-wave -1 ensures the DB cluster is healthy before application
|
|
# deployments (wave 0) are applied.
|
|
resources:
|
|
- memory-db.yaml
|
|
# ClusterIP alone is not isolation: every pod in the cluster can reach it.
|
|
- memory-db-netpol.yaml
|
|
# Only poimen-memory's /graphql proxy calls 8090.
|
|
- graphql-netpol.yaml
|
|
- poimen-sandbox-namespace.yaml
|
|
- poimen-sandbox-quota.yaml
|
|
- pi-session-netpol.yaml
|
|
- pi-agent-workspace-pv.yaml
|