jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-10 16:04:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add regional Agones fleet overlays

Browse Source
This commit is contained in:
Josh Creek
2026-08-31 21:51:37 +01:00
parent 6253b620a9
commit 0551fb0b1f
11 changed files with 137 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/k8s/base/control-plane-deployment.yaml
+1 -1
View File
@@ -2,6 +2,7 @@ apiVersion: apps/v1
kind: Deployment
metadata:
name: control-plane
namespace: cosmic-clash
labels:
app.kubernetes.io/name: control-plane
spec:
@@ -56,4 +57,3 @@ spec:
secretKeyRef:
name: cosmic-clash-steam
key: publisher-key
deploy/k8s/base/fleet.yaml
+55
View File
@@ -0,0 +1,55 @@
apiVersion: agones.dev/v1
kind: Fleet
metadata:
name: cosmic-clash-game
namespace: cosmic-clash
labels:
app.kubernetes.io/name: game-fleet
spec:
replicas: 2
strategy:
type: RollingUpdate
template:
metadata:
labels:
app.kubernetes.io/name: game-server
cosmic-clash.io/region: EU
cosmic-clash.io/build: build-1
cosmic-clash.io/protocol: "1"
cosmic-clash.io/transport: enet
spec:
ports:
- name: game
containerPort: 7777
protocol: UDP
health:
disabled: false
initialDelaySeconds: 5
periodSeconds: 5
failureThreshold: 3
template:
spec:
serviceAccountName: match-server
automountServiceAccountToken: false
securityContext:
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
seccompProfile:
type: RuntimeDefault
containers:
- name: game-server
image: ghcr.io/cosmic-clash/game-server@sha256:0000000000000000000000000000000000000000000000000000000000000000
args: ["--port=7777"]
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop: [ALL]
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 1
memory: 512Mi
deploy/k8s/base/kustomization.yaml
+1 -2
View File
@@ -1,10 +1,9 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: cosmic-clash
resources:
- namespace.yaml
- service-accounts.yaml
- rbac.yaml
- network-policies.yaml
- control-plane-deployment.yaml
- fleet.yaml
deploy/k8s/base/network-policies.yaml
+2 -1
View File
@@ -2,6 +2,7 @@ apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-ingress-egress
namespace: cosmic-clash
spec:
podSelector: {}
policyTypes: [Ingress, Egress]
@@ -10,6 +11,7 @@ apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: control-plane-allowed-flows
namespace: cosmic-clash
spec:
podSelector:
matchLabels:
@@ -64,4 +66,3 @@ spec:
podSelector:
matchLabels:
k8s-app: kube-dns
deploy/k8s/overlays/eu/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../base
patches:
- path: region.yaml
deploy/k8s/overlays/eu/region.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: agones.dev/v1
kind: Fleet
metadata:
name: cosmic-clash-game
namespace: cosmic-clash
spec:
template:
metadata:
labels:
cosmic-clash.io/region: EU
deploy/k8s/overlays/na/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../base
patches:
- path: region.yaml
deploy/k8s/overlays/na/region.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: agones.dev/v1
kind: Fleet
metadata:
name: cosmic-clash-game
namespace: cosmic-clash
spec:
template:
metadata:
labels:
cosmic-clash.io/region: NA
multiplayer-next.md
+5 -2
View File
@@ -111,8 +111,11 @@ product policy are in [`docs/MATCHMAKING.md`](docs/MATCHMAKING.md).
## Phase 8 — Agones and regional server capacity
- [ ] Add portable EU/NA Agones Fleets with provider edge/network/secret and
Valve-approved SDR POP/certificate/public-UDP overlays.
- [ ] **IN PROGRESS:** Add portable EU/NA Agones Fleets with provider
edge/network/secret and Valve-approved SDR POP/certificate/public-UDP
overlays. A restricted provider-neutral Fleet base and distinct EU/NA
Kustomize overlays now exist; live rendering and provider/Valve overlays
remain.
- [ ] Add the local-safe Agones adapter and separate process-ready (listen then
Ready) from assignment-ready (Allocated manifest verified and registered).
The Go supervisor now validates dynamic address/port data and gates Ready on
multiplayer-todo.md
+1 -1
View File
@@ -1208,7 +1208,7 @@ the local/CI/community transport, not a silent production fallback.
| # | Task | Acceptance |
|---|---|---|
| 8.26 `[D:8.1,8.6,8.12]` | Portable Helm/Kustomize Fleets per build/EU/NA region; isolate provider edge/network/DNS/secret and SDR POP/cert/public-UDP overlays | Two provider fixtures render; labels select region/build/protocol/transport; each fixture documents Valve approval and externally reachable UDP mapping |
| 8.26 `[D:8.1,8.6,8.12]` | **IN PROGRESS.** Provider-neutral Kustomize base now defines a restricted Agones Fleet with region/build/protocol/transport labels and UDP game port, plus distinct EU/NA overlays; the base avoids rewriting cross-namespace Agones RBAC | `deploy/k8s/base/fleet.yaml`, `overlays/eu`, `overlays/na` and `server/security/test_fleet_manifests.py` cover labels, replica floor, UDP declaration, pod hardening, overlay distinction and RBAC namespace safety; live Kustomize/Agones rendering, second-provider fixtures, edge/network/DNS/secret and SDR POP/cert/public-UDP overlays remain |
| 8.27 `[D:8.26]` | **IN PROGRESS.** Go supervisor package provides local-safe Agones REST discovery, validates assigned address/port data, injects dynamic `SDR_LISTEN_PORT`/`SDR_IP`, performs explicit process-ready probing and Ready transition; direct mode bypasses Agones | `server/supervisor/` covers allocated/direct startup, invalid endpoint rejection, dynamic endpoint/Ready ordering and authenticated drain; Godot Agones adapter, metadata watch, Health/annotation/Shutdown and emulator integration remain |
| 8.28 `[D:8.6,8.27]` | **IN PROGRESS.** Supervisor separates explicit process-ready from Agones Ready and never scrapes stdout; allocated mode refuses to mark Ready without a configured readiness probe | `server/supervisor/` tests prove Ready follows the probe and direct mode remains functional; Godot readiness endpoint, detached-container and Health-reclaim integration remain |
| 8.29 `[D:8.26,8.27]` | **IN PROGRESS.** Supervisor discovers and validates the Agones endpoint, propagates the actual dynamic `--port`, and exports `SDR_LISTEN_PORT`/`SDR_IP` only for Hosted-SDR while preserving an isolated ENet path | `server/supervisor/` tests cover invalid address/port rejection, dynamic port argument/env propagation and SDR-vs-ENet separation; real Agones dynamic/passthrough mapping, POP/cert/firewall/NAT and multi-match fixture remain |
server/security/test_fleet_manifests.py
+40
View File
@@ -0,0 +1,40 @@
from pathlib import Path
import unittest
BASE = Path(__file__).parents[2] / "deploy" / "k8s"
class FleetManifestTest(unittest.TestCase):
def read(self, path):
return (BASE / path).read_text()
def test_base_fleet_selects_compatible_game_servers(self):
fleet = self.read("base/fleet.yaml")
for label in (
"cosmic-clash.io/region: EU", "cosmic-clash.io/build: build-1",
'cosmic-clash.io/protocol: "1"', "cosmic-clash.io/transport: enet",
"protocol: UDP", "containerPort: 7777", "replicas: 2",
):
self.assertIn(label, fleet)
for hardening in ("runAsNonRoot: true", "automountServiceAccountToken: false", "readOnlyRootFilesystem: true", "allowPrivilegeEscalation: false"):
self.assertIn(hardening, fleet)
def test_eu_and_na_overlays_are_distinct_and_namespaced(self):
eu = self.read("overlays/eu/region.yaml")
na = self.read("overlays/na/region.yaml")
self.assertIn("cosmic-clash.io/region: EU", eu)
self.assertIn("cosmic-clash.io/region: NA", na)
self.assertNotEqual(eu, na)
for document in (eu, na):
self.assertIn("namespace: cosmic-clash", document)
def test_kustomization_does_not_rewrite_cross_namespace_agones_rbac(self):
base = self.read("base/kustomization.yaml")
rbac = self.read("base/rbac.yaml")
self.assertNotIn("namespace: cosmic-clash", base)
self.assertIn("namespace: agones-system", rbac)
if __name__ == "__main__":
unittest.main()