mirror of
https://github.com/jcreek/CosmicClash.git
synced 2026-09-10 16:04:04 +00:00
Josh Creek
a4b362cb01
The Steam adapter took --steam-publisher-key/--steam-app-id and the matching env vars, but no manifest supplied them, so a deployed control plane would have kept sign-in returning 503 even once the App ID from #15 arrived -- that issue would have unblocked nothing on landing. Mount them from a new cosmic-clash-steam Secret, into the control-plane Deployment alone: the publisher key is issued to us, never to a client, and no other workload (least of all a game server) has any use for it. A manifest test asserts both the wiring and that the Secret appears in no other manifest; verified it fails in both directions. Both keys are optional, so the Deployment still rolls out before the App ID exists and sign-in simply stays 503. Also correct task rows this branch made stale: 7.4 (durable ban storage landed), 8.7 (adapter, bans and secret store landed), 8.39 (cross-replica fan-out landed), and 8.5's migration range, which stopped at 0013. Move the branch review into docs/ with a header marking it a point-in-time artefact -- all thirteen findings are addressed, and its present tense would otherwise read as current behaviour. Record gotcha 52: the integration scripts use `docker run --rm`, which reclaims the container but not its anonymous volume. Sixty-four of them, ~4 GB, accumulated during this session until PostgreSQL stopped starting -- surfacing only as the script's own readiness timeout, not as a disk error. That is the real cause behind the "Docker storage exhausted locally" notes those rows carried.
117 lines
3.9 KiB
YAML
117 lines
3.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: control-plane
|
|
namespace: cosmic-clash
|
|
labels:
|
|
app.kubernetes.io/name: control-plane
|
|
spec:
|
|
replicas: 2
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 0
|
|
maxSurge: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: control-plane
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: control-plane
|
|
spec:
|
|
terminationGracePeriodSeconds: 10
|
|
serviceAccountName: control-plane
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
runAsGroup: 10001
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
topologyKey: topology.kubernetes.io/zone
|
|
whenUnsatisfiable: ScheduleAnyway
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: control-plane
|
|
affinity:
|
|
podAntiAffinity:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- weight: 100
|
|
podAffinityTerm:
|
|
topologyKey: kubernetes.io/hostname
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: control-plane
|
|
containers:
|
|
- name: control-plane
|
|
image: ghcr.io/cosmic-clash/control-plane@sha256:0000000000000000000000000000000000000000000000000000000000000000
|
|
args:
|
|
- --rate-limit=120
|
|
- --rate-limit-window=1m
|
|
- --rate-limit-max-keys=10000
|
|
# Ingress NetworkPolicy admits only the labelled edge gateway.
|
|
# Cover common private/CGNAT/ULA pod networks; overlays should
|
|
# narrow this to their actual gateway CIDR where available.
|
|
- --trusted-proxy-cidrs=10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16,fc00::/7
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /readyz
|
|
port: http
|
|
periodSeconds: 5
|
|
timeoutSeconds: 2
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: http
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 2
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: [ALL]
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 1
|
|
memory: 512Mi
|
|
env:
|
|
- name: COSMIC_CLASH_POSTGRES_DSN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: cosmic-clash-database
|
|
key: dsn
|
|
- name: COSMIC_CLASH_WORKLOAD_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: cosmic-clash-workload
|
|
key: secret
|
|
# Player sign-in. The publisher key is the credential Valve issues
|
|
# to us, never to a client, so it is mounted only here -- no other
|
|
# workload and no game server ever sees it. Both values must be
|
|
# present or POST /v1/session/steam keeps returning 503: silently
|
|
# accepting an unverified ticket would be worse than refusing to
|
|
# authenticate. Optional until the App ID exists (issue #15), so the
|
|
# Deployment still rolls out without the Secret.
|
|
- name: COSMIC_CLASH_STEAM_PUBLISHER_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: cosmic-clash-steam
|
|
key: publisher-key
|
|
optional: true
|
|
- name: COSMIC_CLASH_STEAM_APP_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: cosmic-clash-steam
|
|
key: app-id
|
|
optional: true
|