[Baylem]

A sentinel currently receives namespace-wide access to game pods, while default probe/API-server allowances use broad private ranges. NetworkPolicies add their grants together, so per-server player rules do not narrow those exceptions.

Add module-controlled GameTemplate.spec.sentinelIsolation. Opted-in pods use owned policies for the same server's advertised protocol/port tuples; legacy chart grants exclude those sources and destinations. Templates that omit the field keep existing behavior. Add an opt-in strict chart profile requiring explicit kubelet CIDRs, probe ports and API-server CIDRs, with validation and migration guidance.

Closes #713.

Validation:

• Operator production, controller test sources and E2E test sources compile for Linux amd64.
• Added policy/ownership regressions, exact rendered policy-tuple checks, and a dedicated Cilium CI bucket exercising allowed/denied traffic, legacy-template opt-in, probes, heartbeats and API-to-agent access.
• CRDs regenerated and canonical chart bundles synchronized. Actionlint and offline zizmor passed. Independent review completed; its Cilium node-CIDR finding is fixed.
• Tests and cluster checks were not run locally, per repository policy.

Module defaults are adopted separately in GameplanePanel/module. Cilium installations with node-hosted API servers need the documented node-CIDR configuration. CI/profile changes overlap #761 and the resource-placement PR and should be retained together. Web/Compose image builds on this base need #759.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 56 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: GameplanePanel/Gameplane
• Branch: master
• File: .coderabbit.yaml
• Commit: 4310255
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4e588ec6-7f21-416a-be9f-721cfbe5e675

Commits

Reviewing files that changed from the base of the PR and between 4310255 and 911020b.

Files selected for processing: 41

• .github/workflows/ci.yaml
• charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backups.yaml
• charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backupschedules.yaml
• charts/gameplane/charts/gameplane-crds/crds/gameplane.local_clusters.yaml
• charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gameservers.yaml
• charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gametemplates.yaml
• charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modules.yaml
• charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modulesources.yaml
• charts/gameplane/charts/gameplane-crds/crds/gameplane.local_networkcaptures.yaml
• charts/gameplane/charts/gameplane-crds/crds/gameplane.local_restores.yaml
• charts/gameplane/crd-manifests/gameplane.local_backups.yaml
• charts/gameplane/crd-manifests/gameplane.local_backupschedules.yaml
• charts/gameplane/crd-manifests/gameplane.local_clusters.yaml
• charts/gameplane/crd-manifests/gameplane.local_gameservers.yaml
• charts/gameplane/crd-manifests/gameplane.local_gametemplates.yaml
• charts/gameplane/crd-manifests/gameplane.local_modules.yaml
• charts/gameplane/crd-manifests/gameplane.local_modulesources.yaml
• charts/gameplane/crd-manifests/gameplane.local_networkcaptures.yaml
• charts/gameplane/crd-manifests/gameplane.local_restores.yaml
• charts/gameplane/templates/networkpolicies.yaml
• charts/gameplane/templates/validate.yaml
• charts/gameplane/values.yaml
• charts/tests/check_network_isolation.py
• deploy/kind/e2e.sh
• docs/module-authoring.md
• docs/networking.md
• hack/ci_scope.py
• hack/test_ci_scope.py
• operator/api/v1alpha1/gametemplate_types.go
• operator/config/crd/gameplane.local_gametemplates.yaml
• operator/internal/controller/gameserver_controller.go
• operator/internal/controller/gameserver_sentinel.go
• operator/internal/controller/gameserver_wipe_inventory_test.go
• operator/internal/controller/sentinel_isolation.go
• operator/internal/controller/sentinel_isolation_test.go
• operator/specs.md
• test/e2e/buckets.sh
• test/e2e/ci_selection_e2e_test.go
• test/e2e/network_isolation_e2e_test.go
• test/e2e/specs.md
• test/e2e/suite-components.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ValgulNecron]

Hey, thanks for this one. The isolation design makes sense, but two things need fixing before merge.

First, the opt-out order. When a template turns sentinelIsolation off, reconcileSentinelIsolation (called at gameserver_controller.go:301) deletes the per-server <gs>-sentinel-ingress / -egress policies right away (sentinel_isolation.go:36). The gameplane.local/sentinel-isolation label only comes off when the pods roll (gameserver_controller.go:1505, gameserver_sentinel.go:234). In between, the pods still have the label, so the legacy chart policies skip them, and the per-server grants are already gone. That blocks sentinel-to-game traffic until the pods restart. Could you flip the order: remove the label first, wait until the running pods no longer carry it, and only then delete the per-server policies?

Second, zero-port templates. With sentinelIsolation: true and no advertised ports, the pods still get the label (gameserver_controller.go:1505), but sentinel_isolation.go:27 deletes both grants. The sentinel then has no path to the game at all, and nothing tells the user. Please either reject that combination at validation time or skip the label when there are no ports, and add a status condition so the user can see what happened.

Thanks!

[Baylem]

Addressed in 2a00660.

Both points are addressed. Opt-out retains the per-server grants while labels roll off, and deletes them only after uncached reads confirm both workload controllers have observed the unlabeled templates, completed their rollouts, and no game/sentinel pod still carries the label. This also covers an empty Pod list while an old template could create a replacement. An opted-in template with no advertised ports now reports Failed/Ready=False before creating or changing workloads. Regression sources cover both cases and compile locally; runtime checks remain CI-only.

[Baylem]

Fixed the operator regression failure in 911020bb. The inventory reader was counting the separate, filtered sentinel drain-proof query as a second full wipe inventory. It now counts only unfiltered namespace-wide pod inventories, while the reconciliation assertion still requires exactly one. A separate regression distinguishes repeated broad inventories from filtered sentinel queries, so duplicate full scans remain detectable. Production behavior is unchanged. Source compilation and workflow checks passed, upstream conflicts are resolved, and fresh CI is running.