feat(multiplayer): wire allocated fleet runtime

deploy/k8s/base/control-plane-service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: control-plane
+  namespace: cosmic-clash
+  labels:
+    app.kubernetes.io/name: control-plane
+spec:
+  selector:
+    app.kubernetes.io/name: control-plane
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http

deploy/k8s/base/fleet.yaml

@@ -17,6 +17,11 @@ spec:
         cosmic-clash.io/build: build-1
         cosmic-clash.io/protocol: "1"
         cosmic-clash.io/transport: enet
+      annotations:
+        # The release process replaces this with the immutable image digest;
+        # the Downward API passes the same value to the supervisor so the
+        # allocated child can validate its assignment manifest.
+        cosmic-clash.io/image-digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
     spec:
       ports:
         - name: game
@@ -49,7 +54,49 @@ spec:
           containers:
             - name: game-server
               image: ghcr.io/cosmic-clash/game-server@sha256:0000000000000000000000000000000000000000000000000000000000000000
-              args: ["--port=7777"]
+              args:
+                - --sdk-base-url=http://127.0.0.1:9357
+                - --ready-url=http://127.0.0.1:7780/ready
+                - --drain-url=http://127.0.0.1:7780/drain
+                - --drain-token-env=COSMIC_CLASH_DRAIN_TOKEN
+                - --control-plane-url=http://control-plane.cosmic-clash.svc.cluster.local:8080
+                - --server-id-env=COSMIC_CLASH_SERVER_ID
+                - --image-digest-env=COSMIC_CLASH_IMAGE_DIGEST
+                - --roster-path=/run/cosmic-clash/join-roster.json
+                - --transport=enet
+                - --
+                - --allocated-mode
+                - --match-id=allocation-placeholder
+                - --server-id=allocation-placeholder
+                - --playlist-version=casual
+                - --client-build=build-1
+                - --assignment-expiry-unix=1
+                - --server-image-digest=sha256:0000000000000000000000000000000000000000000000000000000000000000
+                - --transport=enet
+                - --region=EU
+                - --join-authorisations-file=/run/cosmic-clash/join-roster.json
+                - --join-authorisations-key-file=/run/secrets/cosmic-clash/join-signing-key
+                - --readiness-port=7780
+              env:
+                - name: COSMIC_CLASH_SERVER_ID
+                  valueFrom:
+                    fieldRef:
+                      fieldPath: metadata.name
+                - name: COSMIC_CLASH_IMAGE_DIGEST
+                  valueFrom:
+                    fieldRef:
+                      fieldPath: metadata.annotations['cosmic-clash.io/image-digest']
+                - name: COSMIC_CLASH_DRAIN_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: cosmic-clash-game-server
+                      key: drain-token
+              volumeMounts:
+                - name: allocated-roster
+                  mountPath: /run/cosmic-clash
+                - name: join-signing-key
+                  mountPath: /run/secrets/cosmic-clash
+                  readOnly: true
               securityContext:
                 allowPrivilegeEscalation: false
                 readOnlyRootFilesystem: true
@@ -62,3 +109,12 @@ spec:
                 limits:
                   cpu: 1
                   memory: 512Mi
+          volumes:
+            - name: allocated-roster
+              emptyDir: {}
+            - name: join-signing-key
+              secret:
+                secretName: cosmic-clash-game-server
+                items:
+                  - key: join-signing-key
+                    path: join-signing-key

deploy/k8s/base/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - rbac.yaml
   - network-policies.yaml
   - control-plane-deployment.yaml
+  - control-plane-service.yaml
   - fleet.yaml
   - fleet-autoscaler.yaml
   - game-server-pdb.yaml

deploy/k8s/base/network-policies.yaml

@@ -66,3 +66,34 @@ spec:
           podSelector:
             matchLabels:
               k8s-app: kube-dns
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: game-server-allowed-egress
+  namespace: cosmic-clash
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: game-server
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: control-plane
+      ports:
+        - protocol: TCP
+          port: 8080
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns