feat: add regional Agones fleet overlays

server/security/test_fleet_manifests.py

@@ -0,0 +1,40 @@
+from pathlib import Path
+import unittest
+
+
+BASE = Path(__file__).parents[2] / "deploy" / "k8s"
+
+
+class FleetManifestTest(unittest.TestCase):
+    def read(self, path):
+        return (BASE / path).read_text()
+
+    def test_base_fleet_selects_compatible_game_servers(self):
+        fleet = self.read("base/fleet.yaml")
+        for label in (
+            "cosmic-clash.io/region: EU", "cosmic-clash.io/build: build-1",
+            'cosmic-clash.io/protocol: "1"', "cosmic-clash.io/transport: enet",
+            "protocol: UDP", "containerPort: 7777", "replicas: 2",
+        ):
+            self.assertIn(label, fleet)
+        for hardening in ("runAsNonRoot: true", "automountServiceAccountToken: false", "readOnlyRootFilesystem: true", "allowPrivilegeEscalation: false"):
+            self.assertIn(hardening, fleet)
+
+    def test_eu_and_na_overlays_are_distinct_and_namespaced(self):
+        eu = self.read("overlays/eu/region.yaml")
+        na = self.read("overlays/na/region.yaml")
+        self.assertIn("cosmic-clash.io/region: EU", eu)
+        self.assertIn("cosmic-clash.io/region: NA", na)
+        self.assertNotEqual(eu, na)
+        for document in (eu, na):
+            self.assertIn("namespace: cosmic-clash", document)
+
+    def test_kustomization_does_not_rewrite_cross_namespace_agones_rbac(self):
+        base = self.read("base/kustomization.yaml")
+        rbac = self.read("base/rbac.yaml")
+        self.assertNotIn("namespace: cosmic-clash", base)
+        self.assertIn("namespace: agones-system", rbac)
+
+
+if __name__ == "__main__":
+    unittest.main()