[Baylem]

Closes #869. Closes #885. Part of #867.

Merge order. #889 has merged. #886 supplies tenant namespace admission and credential isolation. Feature commit f6b8b8a1 includes the signed base 3c7b7df8, whose tree matches #886 at 5e44edf7 and includes master at e3826d8d. The PR diff spans 25 files. Once #886 lands, retarget this PR to master, compare the resulting diff and validate that merge tree. Feature CI

Policy changes. The opt-in networkPolicies.tenantIsolation profile installs network policies in every managed game namespace. It requires explicit API and kubelet host CIDRs and repository ports, scopes DNS and backup egress, and confines a tunnel to its own game or wake listener. Provider-specific egress remains a separate administrator grant. The security and monitoring guides show the per-game and legacy kubelet rules and the separate Prometheus scrape policy.

Acceptance tests. The Cilium CI bucket runs two games in one namespace and uses a second tenant with a matching game name. It exercises Pod IP and Service paths, direct external NodePort player traffic, an authenticated frp route, a Restic backup to an external test repository, fresh agent heartbeats and live metrics. Reachable controls verify that denials of private HTTPS, a simulated link-local metadata endpoint and peer administration ports have meaning. The same fixture checks Restricted Pod Security Admission and per-server and fallback probe behavior.

The stacked Linux operator and E2E sources compiled locally. Helm rendered the two-tenant profile, and the fixture scripts passed syntax checks. The Cilium job supplies the live acceptance result.

Enforcing-CNI qualification on e40591583a57f2ea945161fed134557e28c7ff73

The AMD64 Kind/Cilium test passed in 283.91 seconds. Two games in one namespace and a same-name game in another exercised Pod IP and Service NAT paths under Restricted Pod Security Admission. Authorized external NodePort players, an authenticated FRP tunnel, game-local sentinel traffic, agent heartbeats, monitoring and a Restic repository write succeeded. The tenant probes denied cross-game administration, cross-tenant relay access, private HTTPS and the simulated link-local metadata endpoint after their positive controls succeeded. The live profile admitted kubelet TCP 25566 for one game and TCP 25575 for the other. Named startup and numeric readiness references resolved to the same allowed socket for each game. The separate monitoring rule admitted the scrape. Switching to the documented fallback removed the per-game policies and produced the explicit shared two-port grant. Cilium on the network PR · Independent Cilium run on the dependent observability PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: GameplanePanel/Gameplane
• Branch: fix/tenant-network-profile
• File: .coderabbit.yaml
• Commit: f6b8b8a
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 609e0541-acf5-4266-9b8b-3259a3c4f55a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

Pre-merge checks: 1 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Title check		This assessment has not completed. The check will be retried on the next pre-merge check run.

Passed checks: 1 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

CI Report - e405915

run 42988472157 - attempt 1

0 failed - 32 passed - 1 skipped - 206m52s elapsed

Test selection: full (selection-rule change) - per-suite table

Coverage

Module	Measured	Gate	Margin
web	L95.82 S94.18 B88.49 F91.73	L92 S92 B82 F76	+2.18

Changed

Area	Files	+/-
test/	5	+426/-33
operator/	9	+239/-133
charts/	5	+104/-20
docs/	3	+67/-10
deploy/	1	+48/-0
.github/	1	+9/-4

Slowest jobs

Job	Duration
e2e telemetry / amd64 (kind)	22m24s
e2e telemetry / arm64 (kind)	22m8s
build e2e images	15m19s
e2e restricted-workloads / amd64 (kind)	14m44s
e2e web live / amd64 (kind)	14m33s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, backup-preparation, bot-fast, management-placement, monitoring, multicluster, network-isolation, operator, optional-components, postgres-availability, ratelimit, recovery, restricted-workloads, telemetry, upgrade, wake-hostport

[ValgulNecron]

Hey, could you please add changelog entry?

[Baylem]

Added the requested unreleased changelog entry.

CI passed on e4059158. The diff through 2560c240 changes only the changelog entry and its index link. I canceled the repeat CI run because this update changes only Markdown.