feat: add authenticated supervisor drain

server/supervisor/supervisor_test.go

@@ -111,3 +111,34 @@ func TestDirectModeDoesNotRequireAgonesReadiness(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestDrainRequiresAndUsesAuthenticatedLocalEndpoint(t *testing.T) {
+	seenToken := ""
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/drain" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		seenToken = r.Header.Get("Authorization")
+		if seenToken != "Bearer secret-token" {
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+		w.WriteHeader(http.StatusAccepted)
+	}))
+	defer server.Close()
+	s, err := New(Config{Command: []string{"/bin/sh", "-c", "exit 0"}, DrainURL: server.URL + "/drain", DrainToken: "secret-token"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.Drain(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if seenToken != "Bearer secret-token" {
+		t.Fatalf("unexpected drain token: %q", seenToken)
+	}
+	missing, _ := New(Config{Command: []string{"/bin/sh", "-c", "exit 0"}})
+	if err := missing.Drain(context.Background()); err == nil {
+		t.Fatal("unauthenticated drain was allowed")
+	}
+}