jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-12 04:13:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): authenticate Agones Kubernetes API

Browse Source
This commit is contained in:
Josh Creek
2026-09-02 18:58:57 +01:00
parent 55b88a3aa5
commit 670466dbd7
9 changed files with 238 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/security/test_fleet_manifests.py
+4 -2
View File
@@ -74,11 +74,13 @@ class FleetManifestTest(unittest.TestCase):
for document in (eu, na):
self.assertIn("namespace: cosmic-clash", document)
def test_kustomization_does_not_rewrite_cross_namespace_agones_rbac(self):
def test_allocator_agones_rbac_is_in_the_game_server_namespace(self):
base = self.read("base/kustomization.yaml")
rbac = self.read("base/rbac.yaml")
self.assertNotIn("namespace: cosmic-clash", base)
self.assertIn("namespace: agones-system", rbac)
self.assertNotIn("namespace: agones-system", rbac)
self.assertGreaterEqual(rbac.count("namespace: cosmic-clash"), 3)
self.assertIn("name: allocator", rbac)
def test_control_plane_service_and_game_server_egress_are_declared(self):
service = self.read("base/control-plane-service.yaml")
server/security/test_kubernetes_policies.py
+11 -5
View File
@@ -36,7 +36,8 @@ class KubernetesPolicyTest(unittest.TestCase):
"readOnlyRootFilesystem: true", "drop: [ALL]", "resources:",
"image: ghcr.io/cosmic-clash/allocator@sha256:",
"--metrics-addr=:9091", "containerPort: 9091",
"key: dsn", "key: secret", "automountServiceAccountToken: false",
"key: dsn", "key: secret", "automountServiceAccountToken: true",
"--agones-url=https://kubernetes.default.svc", "--provider-timeout=10s",
):
self.assertIn(required, deployment)
self.assertNotRegex(deployment, r"(?im)^\s*(password|token|private.?key):\s*[^\n]+$")
@@ -86,7 +87,7 @@ class KubernetesPolicyTest(unittest.TestCase):
self.assertIn(required, deployment)
self.assertGreaterEqual(deployment.count("app.kubernetes.io/name: allocator"), 4)
def test_allocator_network_policy_has_only_metrics_data_agones_and_dns_flows(self):
def test_allocator_network_policy_has_only_metrics_data_kubernetes_api_and_dns_flows(self):
policies = self.read("network-policies.yaml")
allocator = policies.split("name: allocator-allowed-flows", 1)[-1]
self.assertIn("port: 9091", allocator)
@@ -94,6 +95,7 @@ class KubernetesPolicyTest(unittest.TestCase):
self.assertIn(port, allocator)
self.assertNotIn("port: 8080", allocator)
self.assertNotIn("ipBlock:", allocator)
self.assertNotIn("agones-system", allocator)
def test_allocator_pdb_preserves_one_replica_during_voluntary_disruption(self):
pdb = self.read("allocator-pdb.yaml")
@@ -104,12 +106,16 @@ class KubernetesPolicyTest(unittest.TestCase):
):
self.assertIn(required, pdb)
def test_rbac_is_scoped_to_allocator_create(self):
def test_rbac_is_scoped_to_allocator_agones_operations(self):
rbac = self.read("rbac.yaml")
self.assertIn("namespace: agones-system", rbac)
self.assertNotIn("namespace: agones-system", rbac)
self.assertGreaterEqual(rbac.count("namespace: cosmic-clash"), 3)
self.assertIn('resources: ["gameservers"]', rbac)
self.assertIn('verbs: ["list"]', rbac)
self.assertIn('resources: ["gameserverallocations"]', rbac)
self.assertIn('verbs: ["create"]', rbac)
self.assertNotRegex(rbac, r"verbs:.*\b(get|list|watch|update|patch|delete|\*)\b")
self.assertIn("name: allocator", rbac)
self.assertNotRegex(rbac, r"verbs:.*\b(watch|update|patch|delete|\*)\b")
self.assertNotIn('resources: ["*"]', rbac)
def test_default_deny_and_only_declared_data_dns_edge_flows_exist(self):