feat(multiplayer): wire allocated fleet runtime

server/security/test_fleet_manifests.py

@@ -19,6 +19,18 @@ class FleetManifestTest(unittest.TestCase):
             self.assertIn(label, fleet)
         for hardening in ("runAsNonRoot: true", "automountServiceAccountToken: false", "readOnlyRootFilesystem: true", "allowPrivilegeEscalation: false"):
             self.assertIn(hardening, fleet)
+        for runtime in (
+            "ghcr.io/cosmic-clash/game-server@sha256:",
+            "--sdk-base-url=http://127.0.0.1:9357",
+            "--control-plane-url=http://control-plane.cosmic-clash.svc.cluster.local:8080",
+            "--roster-path=/run/cosmic-clash/join-roster.json",
+            "--allocated-mode",
+            "--join-authorisations-key-file=/run/secrets/cosmic-clash/join-signing-key",
+            "fieldPath: metadata.annotations['cosmic-clash.io/image-digest']",
+            "secretName: cosmic-clash-game-server",
+            "emptyDir: {}",
+        ):
+            self.assertIn(runtime, fleet)
         for scheduling in (
             "cosmic-clash.io/capacity-type: on-demand",
             "topologyKey: topology.kubernetes.io/zone",
@@ -60,6 +72,16 @@ class FleetManifestTest(unittest.TestCase):
         self.assertNotIn("namespace: cosmic-clash", base)
         self.assertIn("namespace: agones-system", rbac)
 
+    def test_control_plane_service_and_game_server_egress_are_declared(self):
+        service = self.read("base/control-plane-service.yaml")
+        network = self.read("base/network-policies.yaml")
+        base = self.read("base/kustomization.yaml")
+        for field in ("kind: Service", "name: control-plane", "port: 8080", "targetPort: http"):
+            self.assertIn(field, service)
+        for field in ("name: game-server-allowed-egress", "app.kubernetes.io/name: game-server", "port: 8080"):
+            self.assertIn(field, network)
+        self.assertIn("control-plane-service.yaml", base)
+
 
 if __name__ == "__main__":
     unittest.main()