jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-11 00:14:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): keep abandonment maintenance available

Browse Source
This commit is contained in:
Josh Creek
2026-09-03 21:07:50 +01:00
parent addcea9fed
commit 25cf1e0cfa
5 changed files with 45 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/security/test_kubernetes_policies.py
+12 -1
View File
@@ -47,16 +47,27 @@ class KubernetesPolicyTest(unittest.TestCase):
def test_maintenance_runs_the_live_abandonment_reconciler_hardened(self):
deployment = self.read("maintenance-deployment.yaml")
for required in (
"replicas: 1", "serviceAccountName: maintenance", "automountServiceAccountToken: false",
"replicas: 2", "type: RollingUpdate", "maxUnavailable: 0", "maxSurge: 1",
"serviceAccountName: maintenance", "automountServiceAccountToken: false",
"runAsNonRoot: true", "type: RuntimeDefault", "allowPrivilegeEscalation: false",
"readOnlyRootFilesystem: true", "drop: [ALL]",
"image: ghcr.io/cosmic-clash/maintenance@sha256:",
"--initial-connect-interval=1s", "--live-abandonment-batch=100",
"name: COSMIC_CLASH_POSTGRES_DSN", "key: dsn",
"topologySpreadConstraints:", "topologyKey: topology.kubernetes.io/zone",
"podAntiAffinity:", "topologyKey: kubernetes.io/hostname",
):
self.assertIn(required, deployment)
self.assertNotRegex(deployment, r"(?im)^\s*(password|token|private.?key):\s*[^\n]+$")
def test_maintenance_pdb_keeps_one_reconciler_running(self):
pdb = self.read("maintenance-pdb.yaml")
for required in (
"apiVersion: policy/v1", "kind: PodDisruptionBudget", "name: maintenance",
"namespace: cosmic-clash", "minAvailable: 1", "app.kubernetes.io/name: maintenance",
):
self.assertIn(required, pdb)
def test_control_plane_has_health_rollout_and_failure_domain_guards(self):
deployment = self.read("control-plane-deployment.yaml")
for required in (