29 lines
843 B
YAML
29 lines
843 B
YAML
---
|
|
# Keep the GraphQL server reachable only from the one service that proxies it.
|
|
#
|
|
# poimen-graphql is already off the internet: its Service is ClusterIP on 8090 and
|
|
# no Ingress names it. What it lacked is in-cluster isolation — a ClusterIP answers
|
|
# every pod in the cluster.
|
|
#
|
|
# The only caller is poimen-memory, whose /graphql route forwards the request body
|
|
# to MEM_GQL_PORT (8090). No other workload references this service.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: poimen-graphql-ingress
|
|
namespace: poimen
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: poimen-graphql
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: poimen-memory
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8090
|