jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-11 20:33:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(multiplayer): deploy allocator role

Browse Source
This commit is contained in:
Josh Creek
2026-09-01 18:48:51 +01:00
parent 95e82cc719
commit 2e1c010fa2
6 changed files with 144 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/security/test_kubernetes_policies.py
+21
View File
@@ -26,6 +26,27 @@ class KubernetesPolicyTest(unittest.TestCase):
self.assertNotRegex(deployment, r"(?im)^\s*(password|token|private.?key):\s*[^\n]+$")
self.assertIn("secretKeyRef:", deployment)
def test_allocator_is_hardened_and_uses_only_external_secrets(self):
deployment = self.read("allocator-deployment.yaml")
for required in (
"runAsNonRoot: true", "type: RuntimeDefault", "allowPrivilegeEscalation: false",
"readOnlyRootFilesystem: true", "drop: [ALL]", "resources:",
"image: ghcr.io/cosmic-clash/allocator@sha256:",
"--metrics-addr=:9091", "containerPort: 9091",
"key: dsn", "key: secret", "automountServiceAccountToken: false",
):
self.assertIn(required, deployment)
self.assertNotRegex(deployment, r"(?im)^\s*(password|token|private.?key):\s*[^\n]+$")
def test_allocator_network_policy_has_only_metrics_data_agones_and_dns_flows(self):
policies = self.read("network-policies.yaml")
allocator = policies.split("name: allocator-allowed-flows", 1)[-1]
self.assertIn("port: 9091", allocator)
for port in ("port: 5432", "port: 443", "port: 53"):
self.assertIn(port, allocator)
self.assertNotIn("port: 8080", allocator)
self.assertNotIn("ipBlock:", allocator)
def test_rbac_is_scoped_to_allocator_create(self):
rbac = self.read("rbac.yaml")
self.assertIn("namespace: agones-system", rbac)