fix(multiplayer): bound workload credential lifetime

server/agones/allocation.go

@@ -38,11 +38,12 @@ type Client struct {
 	// WorkloadTokenTTL bounds how long the minted token remains valid; it
 	// must comfortably exceed the time between allocation and this
 	// GameServer completing process-ready/assignment-ready registration.
-	// Zero defaults to 30 minutes.
+	// Zero defaults to DefaultWorkloadTokenTTL (two hours).
 	WorkloadTokenTTL time.Duration
 }
 
 const DefaultHTTPTimeout = 10 * time.Second
+const DefaultWorkloadTokenTTL = 2 * time.Hour
 
 type AllocatedServer struct {
 	Allocation domain.Allocation
@@ -250,7 +251,7 @@ func (c Client) Allocate(ctx context.Context, request domain.AllocationRequest,
 	if len(c.WorkloadSecret) > 0 {
 		ttl := c.WorkloadTokenTTL
 		if ttl <= 0 {
-			ttl = 30 * time.Minute
+			ttl = DefaultWorkloadTokenTTL
 		}
 		token, err := workload.IssueSignedWorkloadToken(c.WorkloadSecret, request.AllocationID, now, ttl)
 		if err != nil {