feat(multiplayer): harden control-plane availability

server/security/test_kubernetes_policies.py

@@ -39,6 +39,27 @@ class KubernetesPolicyTest(unittest.TestCase):
             self.assertIn(required, deployment)
         self.assertNotRegex(deployment, r"(?im)^\s*(password|token|private.?key):\s*[^\n]+$")
 
+    def test_control_plane_has_health_rollout_and_failure_domain_guards(self):
+        deployment = self.read("control-plane-deployment.yaml")
+        for required in (
+            "readinessProbe:", "livenessProbe:", "path: /healthz", "port: http",
+            "topologySpreadConstraints:", "maxSkew: 1",
+            "topologyKey: topology.kubernetes.io/zone",
+            "whenUnsatisfiable: ScheduleAnyway", "podAntiAffinity:",
+            "preferredDuringSchedulingIgnoredDuringExecution:",
+            "topologyKey: kubernetes.io/hostname",
+        ):
+            self.assertIn(required, deployment)
+
+    def test_control_plane_pdb_preserves_one_replica_during_voluntary_disruption(self):
+        pdb = self.read("control-plane-pdb.yaml")
+        for required in (
+            "apiVersion: policy/v1", "kind: PodDisruptionBudget",
+            "name: control-plane", "namespace: cosmic-clash",
+            "minAvailable: 1", "app.kubernetes.io/name: control-plane",
+        ):
+            self.assertIn(required, pdb)
+
     def test_allocator_rollout_keeps_capacity_and_has_health_probes(self):
         deployment = self.read("allocator-deployment.yaml")
         for required in (