fix(multiplayer): deploy reconnect abandonment maintenance

server/security/test_kubernetes_policies.py

@@ -44,6 +44,19 @@ class KubernetesPolicyTest(unittest.TestCase):
             self.assertIn(required, deployment)
         self.assertNotRegex(deployment, r"(?im)^\s*(password|token|private.?key):\s*[^\n]+$")
 
+    def test_maintenance_runs_the_live_abandonment_reconciler_hardened(self):
+        deployment = self.read("maintenance-deployment.yaml")
+        for required in (
+            "replicas: 1", "serviceAccountName: maintenance", "automountServiceAccountToken: false",
+            "runAsNonRoot: true", "type: RuntimeDefault", "allowPrivilegeEscalation: false",
+            "readOnlyRootFilesystem: true", "drop: [ALL]",
+            "image: ghcr.io/cosmic-clash/maintenance@sha256:",
+            "--initial-connect-interval=1s", "--live-abandonment-batch=100",
+            "name: COSMIC_CLASH_POSTGRES_DSN", "key: dsn",
+        ):
+            self.assertIn(required, deployment)
+        self.assertNotRegex(deployment, r"(?im)^\s*(password|token|private.?key):\s*[^\n]+$")
+
     def test_control_plane_has_health_rollout_and_failure_domain_guards(self):
         deployment = self.read("control-plane-deployment.yaml")
         for required in (
@@ -128,6 +141,14 @@ class KubernetesPolicyTest(unittest.TestCase):
             self.assertIn(port, policies)
         self.assertNotIn("ipBlock:", policies)
 
+    def test_maintenance_network_policy_only_allows_postgres_and_dns(self):
+        policies = self.read("network-policies.yaml")
+        maintenance = policies.split("name: maintenance-allowed-egress", 1)[-1]
+        self.assertIn("app.kubernetes.io/name: maintenance", maintenance)
+        for port in ("port: 5432", "port: 53"):
+            self.assertIn(port, maintenance)
+        self.assertNotIn("port: 8080", maintenance)
+
 
 if __name__ == "__main__":
     unittest.main()