fix(multiplayer): authenticate Agones Kubernetes API

deploy/k8s/base/allocator-deployment.yaml

@@ -24,7 +24,9 @@ spec:
     spec:
       terminationGracePeriodSeconds: 10
       serviceAccountName: allocator
-      automountServiceAccountToken: false
+      # This role calls Agones CRDs through the Kubernetes API. The client
+      # rereads the short-lived projected token on every request.
+      automountServiceAccountToken: true
       topologySpreadConstraints:
         - maxSkew: 1
           topologyKey: topology.kubernetes.io/zone
@@ -52,8 +54,9 @@ spec:
           image: ghcr.io/cosmic-clash/allocator@sha256:0000000000000000000000000000000000000000000000000000000000000000
           args:
             - --dsn=$(COSMIC_CLASH_POSTGRES_DSN)
-            - --agones-url=https://agones-allocator.agones-system.svc.cluster.local
+            - --agones-url=https://kubernetes.default.svc
             - --agones-namespace=cosmic-clash
+            - --provider-timeout=10s
             - --metrics-addr=:9091
           ports:
             - name: metrics

deploy/k8s/base/network-policies.yaml

@@ -47,13 +47,6 @@ spec:
       ports:
         - protocol: TCP
           port: 6379
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: agones-system
-      ports:
-        - protocol: TCP
-          port: 443
     - ports:
         - protocol: UDP
           port: 53
@@ -130,11 +123,10 @@ spec:
       ports:
         - protocol: TCP
           port: 5432
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: agones-system
-      ports:
+    # The kubernetes.default Service endpoint is implementation-specific and
+    # may be a control-plane/node IP that cannot be selected by pod labels.
+    # Keep API egress portable while limiting it to TLS only.
+    - ports:
         - protocol: TCP
           port: 443
     - ports:

deploy/k8s/base/rbac.yaml

@@ -1,9 +1,12 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: control-plane-agones-allocator
-  namespace: agones-system
+  name: allocator-agones-api
+  namespace: cosmic-clash
 rules:
+  - apiGroups: ["agones.dev"]
+    resources: ["gameservers"]
+    verbs: ["list"]
   - apiGroups: ["allocation.agones.dev"]
     resources: ["gameserverallocations"]
     verbs: ["create"]
@@ -11,14 +14,13 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: cosmic-clash-control-plane-agones-allocator
-  namespace: agones-system
+  name: allocator-agones-api
+  namespace: cosmic-clash
 subjects:
   - kind: ServiceAccount
-    name: control-plane
+    name: allocator
     namespace: cosmic-clash
 roleRef:
   kind: Role
-  name: control-plane-agones-allocator
+  name: allocator-agones-api
   apiGroup: rbac.authorization.k8s.io
-