jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-11 20:33:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): authenticate Agones Kubernetes API

Browse Source
This commit is contained in:
Josh Creek
2026-09-02 18:58:57 +01:00
parent 55b88a3aa5
commit 670466dbd7
9 changed files with 238 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/cmd/allocator/main.go
+10 -3
View File
@@ -23,6 +23,9 @@ func main() {
migrationDir := flag.String("migrations", "migrations", "directory containing numbered SQL migrations")
agonesURL := flag.String("agones-url", os.Getenv("COSMIC_CLASH_AGONES_URL"), "Agones allocation API base URL")
namespace := flag.String("agones-namespace", envOrDefault("COSMIC_CLASH_AGONES_NAMESPACE", "default"), "Agones namespace")
kubernetesTokenPath := flag.String("kubernetes-token-path", envOrDefault("COSMIC_CLASH_KUBERNETES_TOKEN_PATH", "/var/run/secrets/kubernetes.io/serviceaccount/token"), "rotating Kubernetes service-account bearer token")
kubernetesCAPath := flag.String("kubernetes-ca-path", envOrDefault("COSMIC_CLASH_KUBERNETES_CA_PATH", "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"), "Kubernetes API cluster CA bundle")
providerTimeout := flag.Duration("provider-timeout", 10*time.Second, "timeout for each Kubernetes/Agones API request")
transport := flag.String("transport", envOrDefault("COSMIC_CLASH_TRANSPORT", "enet"), "game transport: enet or steam_sdr")
interval := flag.Duration("interval", time.Second, "allocation poll interval")
workloadSecret := flag.String("workload-secret", os.Getenv("COSMIC_CLASH_WORKLOAD_SECRET"), "HMAC secret for control-plane-issued workload tokens (see workload/signed_token.go); must match cmd/control-plane's own --workload-secret. Unset skips minting a cosmic-clash.io/workload-token annotation entirely")
@@ -33,8 +36,8 @@ func main() {
if *dsn == "" || *agonesURL == "" {
fatalf("--dsn/COSMIC_CLASH_POSTGRES_DSN and --agones-url/COSMIC_CLASH_AGONES_URL are required")
}
if (*transport != "enet" && *transport != "steam_sdr") || *interval <= 0 {
fatalf("--transport must be enet or steam_sdr and --interval must be positive")
if (*transport != "enet" && *transport != "steam_sdr") || *interval <= 0 || *providerTimeout <= 0 {
fatalf("--transport must be enet or steam_sdr and --interval/--provider-timeout must be positive")
}
if *allocationQuota < 0 || *allocationQuotaWindow <= 0 {
fatalf("--allocation-quota must be non-negative and --allocation-quota-window must be positive")
@@ -65,7 +68,11 @@ func main() {
log.Printf("allocator: enabled per-replica regional allocation quota=%d window=%s", *allocationQuota, *allocationQuotaWindow)
}
metrics := allocator.NewMetrics()
client := agones.Client{BaseURL: *agonesURL, Namespace: *namespace, WorkloadSecret: []byte(*workloadSecret)}
providerHTTP, err := agones.NewKubernetesHTTPClient(*agonesURL, *kubernetesTokenPath, *kubernetesCAPath, *providerTimeout)
if err != nil {
fatalf("configure Kubernetes API client: %v", err)
}
client := agones.Client{BaseURL: *agonesURL, Namespace: *namespace, HTTP: providerHTTP, WorkloadSecret: []byte(*workloadSecret)}
worker := allocator.Worker{
Claims: store.AllocatingMatchClaims{DB: db, Transport: *transport},
Service: allocator.Service{