feat: add Kubernetes multiplayer security baseline

server/security/test_kubernetes_policies.py

@@ -0,0 +1,47 @@
+from pathlib import Path
+import re
+import unittest
+
+
+BASE = Path(__file__).parents[2] / "deploy" / "k8s" / "base"
+
+
+class KubernetesPolicyTest(unittest.TestCase):
+    def read(self, name):
+        return (BASE / name).read_text()
+
+    def test_namespace_enforces_restricted_pod_security(self):
+        namespace = self.read("namespace.yaml")
+        for key in ("enforce", "audit", "warn"):
+            self.assertIn(f"pod-security.kubernetes.io/{key}: restricted", namespace)
+
+    def test_workload_is_non_root_immutable_and_unprivileged(self):
+        deployment = self.read("control-plane-deployment.yaml")
+        for required in (
+            "runAsNonRoot: true", "type: RuntimeDefault", "allowPrivilegeEscalation: false",
+            "readOnlyRootFilesystem: true", "drop: [ALL]", "resources:",
+            "image: ghcr.io/cosmic-clash/control-plane@sha256:",
+        ):
+            self.assertIn(required, deployment)
+        self.assertNotRegex(deployment, r"(?im)^\s*(password|token|private.?key):\s*[^\n]+$")
+        self.assertIn("secretKeyRef:", deployment)
+
+    def test_rbac_is_scoped_to_allocator_create(self):
+        rbac = self.read("rbac.yaml")
+        self.assertIn("namespace: agones-system", rbac)
+        self.assertIn('resources: ["gameserverallocations"]', rbac)
+        self.assertIn('verbs: ["create"]', rbac)
+        self.assertNotRegex(rbac, r"verbs:.*\b(get|list|watch|update|patch|delete|\*)\b")
+        self.assertNotIn('resources: ["*"]', rbac)
+
+    def test_default_deny_and_only_declared_data_dns_edge_flows_exist(self):
+        policies = self.read("network-policies.yaml")
+        self.assertIn("name: default-deny-ingress-egress", policies)
+        self.assertIn("policyTypes: [Ingress, Egress]", policies)
+        for port in ("port: 8080", "port: 5432", "port: 6379", "port: 443", "port: 53"):
+            self.assertIn(port, policies)
+        self.assertNotIn("ipBlock:", policies)
+
+
+if __name__ == "__main__":
+    unittest.main()