Repository navigation
fix(networking): isolate tenant traffic across games, sentinels and tunnels #869
Description
Production readiness audit of Gameplane v0.4.0, commit 07bee47b. Tracking issue and PR merge order: #867.
Finding
The chart permits game-pod heartbeat egress to broad private/link-local TCP destinations. The legacy sentinel and optional tunnel modes and additionally managed game namespaces have different isolation boundaries.
Work
Provide a tested tenant isolation configuration with exact reachable API/heartbeat endpoints, per-server sentinel access, scoped backup/provider egress, and an explicit provisioning path for baseline policies and Pod Security Admission in every managed namespace. Document provider exceptions and the compatibility path for legacy templates.
Acceptance criteria
On an enforcing CNI, test direct pod IPs and Services across two independent tenants and across two servers sharing a namespace. Verify authorized player traffic, DNS, API heartbeat, game-specific probes, monitoring and repository/relay paths. Confirm peer RCON/agent, private HTTPS and metadata destinations are denied where intended. Include actual Service NAT behavior.
PR ownership and prior work
Own the network-policy templates, fixtures and installation examples. Ship L02 in this PR. Coordinate namespace labels with the active hardening work. Reuse the test environment for M03 scrape discovery. Reuse the strict API endpoint, per-server sentinel settings and Cilium fixture from #713, #837 and #862. Provider-specific Playit policy history is in #488.
Chart policies · Legacy sentinel allowances · Tunnel egress · Additional namespaces
Enforcing-CNI qualification on e40591583a57f2ea945161fed134557e28c7ff73
The AMD64 Kind/Cilium test passed in 283.91 seconds. Two games in one namespace and a same-name game in another exercised Pod IP and Service NAT paths under Restricted Pod Security Admission. Authorized external NodePort players, an authenticated FRP tunnel, game-local sentinel traffic, agent heartbeats, monitoring and a Restic repository write succeeded. The tenant probes denied cross-game administration, cross-tenant relay access, private HTTPS and the simulated link-local metadata endpoint after their positive controls succeeded. Cilium on the network PR · Independent Cilium run on the dependent observability PR
Activity
[-][High H02] Constrain tenant network access across games, sentinels and tunnels[/-][+]fix(networking): isolate tenant traffic across games, sentinels and tunnels[/+]