feat(security): support Restricted game pods and per-server diagnostic opt-in by Baylem · Pull Request #834 · GameplanePanel/Gameplane

Baylem · 2026-11-05T03:54:30Z

Supersedes #764 using the same reviewed commits on an upstream branch, enabling GitHub's native stacking. Prior review discussion remains on that PR. Current-head CI passed.

Native stack, bottom to top: #833 → #834 → #835 → #836.

Restricted admission currently rejects the game workload's security settings and the packet-capture exception. This change renders an opt-in Restricted workload profile and projects rotating Kubernetes credentials only into the agent container.

Capture uses a separate, short-lived node worker when an administrator explicitly opts that server in. Both the installation and server opt-ins default off. The action is audited before granting access, requires administrator scope on the selected cluster, and cannot be inherited by cloning or enabled through generic server edits. Starting capture does not restart or inject a container into the game Pod.

The worker pins the GameServer, Pod and containerd identities, has bounded duration/storage and no Kubernetes token, hostPath or runtime socket. Its hostPID and SYS_ADMIN/SYS_PTRACE/NET_RAW capabilities still require node-level trust. Support is Linux/containerd with standard cgroup paths and eth0. Retained artifacts are served by a separate unprivileged Pod over mTLS; revocation, TTL, direct capture deletion and GameServer deletion drain workers and clean up cross-namespace resources.

Validation: production operator/API/capture builds and changed regression-source compilation passed; actionlint and offline zizmor passed. Tests were not executed locally under repository policy. CI adds real Restricted admission, compatible/incompatible template behavior, persisted data across profile upgrade, projected-token rotation, capture/download without game restart, revocation and garbage collection on amd64/arm64. Runtime guarantees remain subject to those CI results.

Integration: preserve #757's namespace-scoped Secret cache/RBAC and #756's snapshot-source authorization when resolving the overlapping operator/API files. The diagnostics Secret reads use the uncached reader and a diagnostics-only Role.

Closes #714.

Restricted workload upgrades now preserve shared-group access to root-created configuration files. Unsupported Hostport exposure is rejected before template admission or rollout. Generic server edits preserve an omitted administrator capture opt-in; explicit changes still require the dedicated administrator action. Diagnostics defaults also work when upgrading older releases with reused values.

Diagnostics namespace validation now covers every configured managed-game, control-plane, agent-CA and module namespace plus the actual operator deployment namespace. Startup and reconciliation share the same validation and reject missing, wildcard or malformed protected scopes.

Diagnostics authorization checks administrator permissions on the selected cluster even when the caller is a home-cluster administrator. A remote namespace capture grant cannot grant host-level diagnostics. The namespace-validation failure path and capture-sidecar module manifest are also corrected.

CI installs Trivy v0.74.0 directly from its official GitHub release with bounded retries and a pinned SHA-256 checksum. The existing vulnerability scans and failure gates remain enabled.

November 6 follow-up: Includes the reviewed stopped-backup cleanup regression from #833. All six affected standalone Go modules now select github.com/klauspost/compress v1.20.2 to fix GO-2026-6865. Module and workspace checksums are included. The patch was independently reviewed; standalone Linux builds, affected feature builds and controller regression-source compilation passed. Runtime tests and security scans run in CI under repository policy.

Current validation: all 105 main CI jobs passed on fbdb1c25 (CI run). All other applicable workflows passed.

…opt-in Signed-off-by: Baylem <zelathis@gmail.com>

Signed-off-by: Baylem <zelathis@gmail.com>

coderabbitai · 2026-11-05T03:54:36Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 17 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

Source mode: Auto
Repository: GameplanePanel/Gameplane
Branch: stack/pr-764
File: .coderabbit.yaml
Commit: a669276
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 55e1aff2-f8e7-4c99-990c-31e3663b7d56

Commits

Reviewing files that changed from the base of the PR and between cfb7258 and a669276.

Files selected for processing: 73

.github/workflows/ci.yaml
agent/specs.md
api/internal/gateway/capture.go
api/internal/handlers/capture.go
api/internal/handlers/capture_node.go
api/internal/handlers/capture_node_test.go
api/internal/handlers/lifecycle.go
api/internal/handlers/resources.go
api/internal/kube/capture.go
api/internal/kube/capture_node.go
api/internal/kube/capture_node_test.go
api/internal/rbac/rbac.go
api/specs.md
capture-sidecar/Dockerfile
capture-sidecar/cmd/main.go
capture-sidecar/go.mod
capture-sidecar/internal/httpserver/artifacts.go
capture-sidecar/internal/httpserver/artifacts_test.go
capture-sidecar/internal/nodecapture/worker.go
capture-sidecar/internal/nodecapture/worker_test.go
capture-sidecar/specs.md
charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backups.yaml
charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backupschedules.yaml
charts/gameplane/charts/gameplane-crds/crds/gameplane.local_clusters.yaml
charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gameservers.yaml
charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gametemplates.yaml
charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modules.yaml
charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modulesources.yaml
charts/gameplane/charts/gameplane-crds/crds/gameplane.local_networkcaptures.yaml
charts/gameplane/charts/gameplane-crds/crds/gameplane.local_restores.yaml
charts/gameplane/crd-manifests/gameplane.local_backups.yaml
charts/gameplane/crd-manifests/gameplane.local_backupschedules.yaml
charts/gameplane/crd-manifests/gameplane.local_clusters.yaml
charts/gameplane/crd-manifests/gameplane.local_gameservers.yaml
charts/gameplane/crd-manifests/gameplane.local_gametemplates.yaml
charts/gameplane/crd-manifests/gameplane.local_modules.yaml
charts/gameplane/crd-manifests/gameplane.local_modulesources.yaml
charts/gameplane/crd-manifests/gameplane.local_networkcaptures.yaml
charts/gameplane/crd-manifests/gameplane.local_restores.yaml
charts/gameplane/templates/_helpers.tpl
charts/gameplane/templates/diagnostics.yaml
charts/gameplane/templates/namespaces.yaml
charts/gameplane/templates/operator.yaml
charts/gameplane/templates/validate.yaml
charts/gameplane/values.yaml
charts/tests/check_workload_security.py
docs/install.md
docs/security.md
hack/ci_scope.py
hack/test_ci_scope.py
operator/api/v1alpha1/gameserver_types.go
operator/cmd/main.go
operator/config/crd/gameplane.local_gameservers.yaml
operator/config/rbac/role_namespace.yaml
operator/internal/controller/gameserver_controller.go
operator/internal/controller/gameserver_envtest_test.go
operator/internal/controller/gameserver_files_test.go
operator/internal/controller/networkcapture_controller.go
operator/internal/controller/networkcapture_node.go
operator/internal/controller/networkcapture_node_stop_test.go
operator/internal/controller/networkcapture_node_test.go
operator/internal/controller/node_diagnostics_namespace.go
operator/internal/controller/node_diagnostics_namespace_test.go
operator/internal/controller/workload_security.go
operator/internal/controller/workload_security_test.go
operator/specs.md
test/e2e/api_login_transport_e2e_test.go
test/e2e/buckets.sh
test/e2e/ci_selection_e2e_test.go
test/e2e/env.go
test/e2e/restricted_workloads_e2e_test.go
test/e2e/specs.md
test/e2e/suite-components.json

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

github-actions · 2026-11-05T06:23:19Z

CI Report - `e4695f6`

run 42295401843 - attempt 1

0 failed - 1 passed - 0 skipped - 32 cancelled - 23m0s elapsed

Test selection: full (selection-rule change) - per-suite table

Coverage

no coverage/* commit statuses found on e4695f6

Changed

Area	Files	+/-
operator/	16	+1568/-26
capture-sidecar/	8	+507/-3
api/	11	+441/-3
test/	7	+431/-4
charts/	25	+285/-23
docs/	2	+66/-28
.github/	1	+15/-5
hack/	2	+11/-1
agent/	1	+10/-0

Slowest jobs

Job	Duration
lint (gp-module)	22m9s
lint (test/e2e)	22m9s
go (telemetry-receiver / amd64)	22m9s
go (agent / amd64)	22m9s
go (sentinel / arm64)	22m9s

e2e buckets run

bot-fast, multicluster, upgrade

Signed-off-by: Baylem <zelathis@gmail.com>

Baylem added 20 commits October 21, 2026 11:43

feat(security): add Restricted workloads and per-server node capture …

c0e8f40

…opt-in Signed-off-by: Baylem <zelathis@gmail.com>

merge: include shared web build prerequisite

13594aa

Signed-off-by: Baylem <zelathis@gmail.com>

fix: confine capture identity creation to its output directory

16fdc13

Signed-off-by: Baylem <zelathis@gmail.com>

ci: expand restricted workload checks on both architectures

b029fcd

Signed-off-by: Baylem <zelathis@gmail.com>

fix: align capture fixtures with isolated credentials

6663821

Signed-off-by: Baylem <zelathis@gmail.com>

fix(security): preserve shared config access through restricted upgrades

d3968bb

Signed-off-by: Baylem <zelathis@gmail.com>

fix(operator): reject restricted host ports before template admission

34efe8d

Signed-off-by: Baylem <zelathis@gmail.com>

fix(ci): select restricted workload tests after upstream integration

7afe9e8

Signed-off-by: Baylem <zelathis@gmail.com>

test: synchronize closed RCON response fixtures

feca754

Signed-off-by: Baylem <zelathis@gmail.com>

test: handle explicit fixture conflicts and lost login forwards

c7d5592

Signed-off-by: Baylem <zelathis@gmail.com>

test: verify shared PID survives restricted capture

62b25fc

Signed-off-by: Baylem <zelathis@gmail.com>

fix: revalidate node diagnostic namespace authority

0749710

Signed-off-by: Baylem <zelathis@gmail.com>

chore: merge upstream namespace controls into workload security

f47fb6c

Signed-off-by: Baylem <zelathis@gmail.com>

chore: reconcile restricted workloads and refresh CI inputs

af0e29f

Signed-off-by: Baylem <zelathis@gmail.com>

chore: reconcile restricted CRDs with upstream Tailscale schemas

2e4b332

Signed-off-by: Baylem <zelathis@gmail.com>

Merge upstream and address stopped capture review feedback

63486f6

Signed-off-by: Baylem <zelathis@gmail.com>

merge: stack restricted workloads on stopped backup integration

ce65034

Signed-off-by: Baylem <zelathis@gmail.com>

fix(security): isolate node diagnostics from every managed namespace

4f07ac2

Signed-off-by: Baylem <zelathis@gmail.com>

fix(security): require diagnostics admin on selected cluster

31a8851

Signed-off-by: Baylem <zelathis@gmail.com>

merge: carry shared Trivy installer from stopped backups

91f4df6

Signed-off-by: Baylem <zelathis@gmail.com>

Baylem added this pull request to stack #841 November 5, 2026 03:57

Baylem marked this pull request as ready for review November 6, 2026 06:56

Baylem requested a review from ValgulNecron as a code owner November 6, 2026 06:56

Baylem added 8 commits November 6, 2026 02:14

Merge stopped-backup review fixes and compress security update

3ceace2

Signed-off-by: Baylem <zelathis@gmail.com>

Merge workspace checksum for compress security update

fbdb1c2

Signed-off-by: Baylem <zelathis@gmail.com>

merge: carry bounded source admission into restricted workloads

ccb61eb

Signed-off-by: Baylem <zelathis@gmail.com>

merge: carry source-admission regression compatibility

fcff80f

Signed-off-by: Baylem <zelathis@gmail.com>

merge: carry backup source status regression fix

bd17465

Signed-off-by: Baylem <zelathis@gmail.com>

merge: carry patched networking dependencies into restricted workloads

4e56aa3

Signed-off-by: Baylem <zelathis@gmail.com>

merge: normalize networking dependency checksums

e4695f6

Signed-off-by: Baylem <zelathis@gmail.com>

merge: retain required workspace graph checksums

a669276

Signed-off-by: Baylem <zelathis@gmail.com>

Navigation Menu

Repository navigation

feat(security): support Restricted game pods and per-server diagnostic opt-in - #834

feat(security): support Restricted game pods and per-server diagnostic opt-in#834
Baylem wants to merge 28 commits into
stack/pr-766from
stack/pr-764

Baylem commented Nov 5, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Nov 5, 2026 •

edited

Loading

Review limit reached

Uh oh!

github-actions Bot commented Nov 5, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Baylem commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

github-actions Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Report - e4695f6

Coverage

Changed

Slowest jobs

e2e buckets run

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Baylem commented Nov 5, 2026 •

edited

Loading

coderabbitai Bot commented Nov 5, 2026 •

edited

Loading

github-actions Bot commented Nov 5, 2026 •

edited

Loading

CI Report - `e4695f6`