fix(operator): restrict tenant-defined probes to the game pod #868

Production readiness audit of Gameplane v0.4.0, commit 07bee47b. Tracking issue and PR merge order: #867.

Finding

GameServer probe overrides can survive reconciliation with an explicit HTTP or TCP host. The kubelet then connects to that destination from the node. The per-server ingress policy only controls which ports it opens.

Work

Reject a nonempty HTTPGet or TCPSocket host in readiness, startup and liveness probes on both templates and server overrides. Cover direct Kubernetes writes and the API, and refuse to render an unsafe resolved pod. Preserve ordinary pod-local and named-port probes.

Acceptance criteria

Exercise IPv4, IPv6 and DNS hosts, creation and update, and an already-stored unsafe CR. Verify rejection or an actionable reconciliation condition without creating the unsafe pod. Confirm valid local probes still become Ready.

PR ownership and prior work

Own the probe-host rule and its tests here. H02 consumes the resulting probe ports and owns NetworkPolicy changes. Reuse any Restricted admission profiles delivered by the parallel hardening work. Per-server probe-port derivation landed in #862.

CRD schema · Pod builder · Probe policy · PSS v1.34 host-probe controls

Qualification evidence

PR #889 passed on 30a24d77. The operator suites exercised probe admission and stored-resource handling on amd64 and arm64. Code generation and the restricted-workload kind checks also passed. Operator amd64 · Operator arm64 · Generated CRDs · Restricted-workload kind check