jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-11 08:23:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): bound workload credential lifetime

Browse Source
This commit is contained in:
Josh Creek
2026-09-03 21:27:26 +01:00
parent 8507472635
commit ea1c65acfb
12 changed files with 46 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/cmd/allocator/main.go
+4 -3
View File
@@ -30,6 +30,7 @@ func main() {
transport := flag.String("transport", envOrDefault("COSMIC_CLASH_TRANSPORT", "enet"), "game transport: enet or steam_sdr")
interval := flag.Duration("interval", time.Second, "allocation poll interval")
workloadSecret := flag.String("workload-secret", os.Getenv("COSMIC_CLASH_WORKLOAD_SECRET"), "HMAC secret for control-plane-issued workload tokens (see workload/signed_token.go); must match cmd/control-plane's own --workload-secret. Unset skips minting a cosmic-clash.io/workload-token annotation entirely")
workloadTokenTTL := flag.Duration("workload-token-ttl", agones.DefaultWorkloadTokenTTL, "lifetime for allocated workload tokens; must cover bounded match play and result retry")
allocationQuota := flag.Int("allocation-quota", 0, "optional per-replica allocation attempts per region per quota window; zero disables this local guard")
allocationQuotaWindow := flag.Duration("allocation-quota-window", time.Minute, "window for --allocation-quota")
metricsAddr := flag.String("metrics-addr", envOrDefault("COSMIC_CLASH_ALLOCATOR_METRICS_ADDR", ":9091"), "allocator Prometheus metrics address; empty disables metrics")
@@ -43,8 +44,8 @@ func main() {
if *readinessMaxStale < *interval+*providerTimeout {
fatalf("--readiness-max-stale must be at least --interval plus --provider-timeout")
}
if *allocationQuota < 0 || *allocationQuotaWindow <= 0 {
fatalf("--allocation-quota must be non-negative and --allocation-quota-window must be positive")
if *allocationQuota < 0 || *allocationQuotaWindow <= 0 || *workloadTokenTTL <= 0 {
fatalf("--allocation-quota must be non-negative and --allocation-quota-window/--workload-token-ttl must be positive")
}
db, err := sql.Open("pgx", *dsn)
if err != nil {
@@ -77,7 +78,7 @@ func main() {
if err != nil {
fatalf("configure Kubernetes API client: %v", err)
}
client := agones.Client{BaseURL: *agonesURL, Namespace: *namespace, HTTP: providerHTTP, WorkloadSecret: []byte(*workloadSecret)}
client := agones.Client{BaseURL: *agonesURL, Namespace: *namespace, HTTP: providerHTTP, WorkloadSecret: []byte(*workloadSecret), WorkloadTokenTTL: *workloadTokenTTL}
worker := allocator.Worker{
Claims: store.AllocatingMatchClaims{DB: db, Transport: *transport},
Service: allocator.Service{