docs(monitoring): clarify per-server and legacy probe ingress rules #885

Production readiness audit of Gameplane v0.4.0, commit 07bee47b. Tracking issue and PR merge order: #867.

Finding

The monitoring guide suggests listing module probe ports globally. With v0.4.0 per-server probe policy enabled, that list adds cross-game allowances for those ports.

Work

Update the examples to leave shared probePorts empty in per-server mode. Explain explicit exceptions, the legacy fallback and the separate Prometheus scrape rule. Reconcile the security guide’s TCP 9090 example with the chart defaults.

Acceptance criteria

Render two games with different probe ports in each mode. Verify the guide describes the resulting allowed ingress and that the production example grants only the intended kubelet and scrape access.

PR ownership and prior work

Deliver alongside H02 in the same policy/docs PR and reuse its two-game fixture. The per-server ingress policy already landed in #862.

Monitoring guide · Current values · Security guide

Enforcing-CNI qualification on e40591583a57f2ea945161fed134557e28c7ff73

The live profile admitted kubelet TCP 25566 for one game and TCP 25575 for the other. Named startup and numeric readiness references resolved to the same allowed socket for each game. The separate monitoring rule admitted the scrape. Switching to the documented fallback removed the per-game policies and produced the explicit shared two-port grant. Cilium on the network PR · Independent Cilium run on the dependent observability PR