diff --git a/deploy/k8s/base/fleet-autoscaler.yaml b/deploy/k8s/base/fleet-autoscaler.yaml new file mode 100644 index 00000000..d759a4de --- /dev/null +++ b/deploy/k8s/base/fleet-autoscaler.yaml @@ -0,0 +1,17 @@ +apiVersion: autoscaling.agones.dev/v1 +kind: FleetAutoscaler +metadata: + name: cosmic-clash-game + namespace: cosmic-clash + labels: + app.kubernetes.io/name: game-fleet-autoscaler +spec: + fleetName: cosmic-clash-game + policy: + type: Buffer + buffer: + # Ready floor is deliberately independent of Allocated capacity. Agones + # scales Allocated servers down to zero while preserving this buffer. + minReady: 2 + maxReady: 6 + bufferSize: 2 diff --git a/deploy/k8s/base/kustomization.yaml b/deploy/k8s/base/kustomization.yaml index 03d335e3..cd62a0b4 100644 --- a/deploy/k8s/base/kustomization.yaml +++ b/deploy/k8s/base/kustomization.yaml @@ -7,3 +7,4 @@ resources: - network-policies.yaml - control-plane-deployment.yaml - fleet.yaml + - fleet-autoscaler.yaml diff --git a/multiplayer-next.md b/multiplayer-next.md index f289b2bf..2f316024 100644 --- a/multiplayer-next.md +++ b/multiplayer-next.md @@ -127,8 +127,11 @@ product policy are in [`docs/MATCHMAKING.md`](docs/MATCHMAKING.md). Agones integration remains. - [ ] Deliver/verify the signed roster after allocation and expose client tickets only after backend `assignment_ready`. -- [ ] Keep >=2 Ready processes across >=2 on-demand nodes/failure domains per - queue-enabled region; only Allocated count may fall to zero. +- [ ] **IN PROGRESS:** Keep >=2 Ready processes across >=2 on-demand + nodes/failure domains per queue-enabled region; only Allocated count may + fall to zero. A provider-neutral Agones FleetAutoscaler now encodes a + two-process Ready buffer and six-process warm cap; regional node pools, + pre-pull rollout and measured N+1 capacity remain. - [ ] Spread on-demand capacity across zones with N+1 headroom; do not place live matches on interruptible nodes. - [ ] Benchmark native x86_64 boot, p99 CPU/RSS/network and tick health; set diff --git a/multiplayer-todo.md b/multiplayer-todo.md index 382b2988..2cd00bbe 100644 --- a/multiplayer-todo.md +++ b/multiplayer-todo.md @@ -1214,7 +1214,7 @@ the local/CI/community transport, not a silent production fallback. | 8.29 `[D:8.26,8.27]` | **IN PROGRESS.** Supervisor discovers and validates the Agones endpoint, propagates the actual dynamic `--port`, and exports `SDR_LISTEN_PORT`/`SDR_IP` only for Hosted-SDR while preserving an isolated ENet path | `server/supervisor/` tests cover invalid address/port rejection, dynamic port argument/env propagation and SDR-vs-ENet separation; real Agones dynamic/passthrough mapping, POP/cert/firewall/NAT and multi-match fixture remain | | 8.30 `[D:8.18,8.26,8.28,8.29]` | **IN PROGRESS.** Pure Go allocator filters Ready servers by region/build/protocol/transport, atomically claims one with idempotent allocation replay, and now owns the assignment-publication boundary | `server/domain/allocator.go` covers deterministic compatible selection, exhaustion, conflicting/identical allocation replay, unknown allocations, and assignment replay/conflict; Agones `GameServerAllocation`, signed roster metadata, bounded cross-replica retry and live integration remain | | 8.31 `[D:8.9,8.30]` | **IN PROGRESS.** Pure Go assignment gate requires Allocated state, exact allocation ID/match/server/region/build/protocol/transport compatibility, non-empty hosted endpoint and verified manifest signature before exposure; allocator publication cannot expose Ready state | `server/domain/assignment.go` and `allocator.go` plus adversarial fixtures cover early-connect, tampered signature/manifest, wrong compatibility, empty endpoint, unknown allocation and post-publication mutation rejection; Agones metadata watch, hosted-address registration, production signer and client-ticket publication remain | -| 8.32 `[D:8.2,8.26,8.30]` | FleetAutoscaler with >=2 Ready processes across >=2 on-demand nodes/failure domains per queue-enabled region; pre-pull current/rollback; scale **Allocated** count to zero, never the Ready floor | Warm allocation meets p95 5 s/p99 10 s; disabled regions alone scale fully to zero; one-node loss retains certified Ready/headroom | +| 8.32 `[D:8.2,8.26,8.30]` | **IN PROGRESS.** Provider-neutral FleetAutoscaler baseline preserves a two-process Ready buffer, caps warm capacity, and leaves Allocated scale-down independent of the Ready floor; Fleet image references remain digest-pinned for current/rollback pre-pull | `deploy/k8s/base/fleet-autoscaler.yaml` and manifest tests cover Fleet ownership, Buffer policy and floor/cap invariants; regional on-demand node pools/failure domains, pre-pull rollout, warm-allocation p95/p99 and N+1 certification remain | | 8.33 `[D:8.26,8.32]` | On-demand-only live capacity and measured N+1: loss of largest node leaves two Ready slots plus headroom for surviving Allocated matches | Interruptible nodes cannot receive live matches; forced node loss neither overloads survivors nor prevents the next allocation | | 8.34 `[D:8.28,8.29]` | Native x86_64 benchmark of boot-to-process-ready and assignment-ready, p99 CPU/RSS/network and 60 Hz ticks; limits/node cap with 30% headroom | Measurements replace old estimates and certify density with no tick backlog | | 8.35 `[D:8.17,8.19,8.20,8.30,8.31]` | **IN PROGRESS.** Pure Go initial-connect policy decides ranked 30 s no-show cancellation with abandon ladder and casual 60 s bot start only when each team has a human; empty-team casual allocations cancel | `server/domain/noshow.go` covers wait/deadline boundaries, deterministic no-show/innocent ordering, ranked cooldown history and no pre-live rating action; persistent ticket restoration, allocation shutdown, bot spawn and live integration remain | diff --git a/server/security/test_fleet_manifests.py b/server/security/test_fleet_manifests.py index 3ac30c21..72642e16 100644 --- a/server/security/test_fleet_manifests.py +++ b/server/security/test_fleet_manifests.py @@ -20,6 +20,15 @@ class FleetManifestTest(unittest.TestCase): for hardening in ("runAsNonRoot: true", "automountServiceAccountToken: false", "readOnlyRootFilesystem: true", "allowPrivilegeEscalation: false"): self.assertIn(hardening, fleet) + def test_autoscaler_preserves_ready_floor_and_owns_fleet(self): + autoscaler = self.read("base/fleet-autoscaler.yaml") + for field in ( + "kind: FleetAutoscaler", "namespace: cosmic-clash", + "fleetName: cosmic-clash-game", "type: Buffer", + "minReady: 2", "maxReady: 6", "bufferSize: 2", + ): + self.assertIn(field, autoscaler) + def test_eu_and_na_overlays_are_distinct_and_namespaced(self): eu = self.read("overlays/eu/region.yaml") na = self.read("overlays/na/region.yaml")