feat(#4668): restricted-compatible security context for the sdk sidecar - #4718
Open
GrowlyX wants to merge 10 commits into
Open
feat(#4668): restricted-compatible security context for the sdk sidecar#4718GrowlyX wants to merge 10 commits into
GrowlyX wants to merge 10 commits into
Conversation
The sdk sidecar container now drops all capabilities and uses the RuntimeDefault seccomp profile by default, so GameServers can run in namespaces enforcing the restricted Pod Security Standard. The full sidecar security context is configurable through the agones.image.sdk.securityContext Helm value, passed to the controller as JSON via SIDECAR_SECURITY_CONTEXT / --sidecar-security-context. Closes agones-dev#4668 Signed-off-by: Subham K. <me@growly.gg>
Signed-off-by: Subham K. <me@growly.gg>
…thub.com/GrowlyX/agones into feat/sidecar-restricted-security-context
GrowlyX
changed the title
Member
|
/gcbrun |
There was a problem hiding this comment.
🟢 Approval recommended
The change set is coherent and well-covered (unit + e2e) and should reliably enable PSA restricted compatibility, with only a minor flag-help wording nit noted.
Pull request overview
Updates the Agones GameServer SDK sidecar to be compatible by default with Kubernetes Pod Security Admission restricted, while allowing operators to override the sidecar container SecurityContext via Helm or controller configuration.
Changes:
- Add a restricted-compatible default
SecurityContextfor the SDK sidecar (drop all caps +seccompProfile: RuntimeDefault) and pass it through controller config. - Expose sidecar security context configuration via Helm (
agones.image.sdk.securityContext) and controller env/flag (SIDECAR_SECURITY_CONTEXT/--sidecar-security-context). - Add unit and e2e coverage plus documentation updates for Pod Security Standards and the new Helm value.
File summaries
| File | Description |
|---|---|
| test/e2e/gameserver_test.go | Adds an e2e test that verifies a GameServer becomes Ready under PSA restricted with the sidecar’s compliant security context. |
| site/content/en/docs/Installation/Install Agones/helm.md | Documents the new Helm value agones.image.sdk.securityContext (version-gated) and links relevant Kubernetes docs. |
| site/content/en/docs/Guides/Best Practices/_index.md | Adds best-practices guidance for running under Pod Security Standards and notes how to override the sidecar context. |
| pkg/gameservers/controller.go | Introduces a default sidecar SecurityContext and wires controller-side configuration to apply it to sidecar containers. |
| pkg/gameservers/controller_test.go | Extends controller unit tests to assert the new default context fields and configurability/copy behavior. |
| install/yaml/install.yaml | Updates the generated install manifest to use SIDECAR_SECURITY_CONTEXT with a restricted-compatible default JSON value. |
| install/helm/agones/values.yaml | Adds default agones.image.sdk.securityContext values compatible with PSA restricted. |
| install/helm/agones/templates/controller.yaml | Switches controller env wiring from SIDECAR_RUN_AS_USER to SIDECAR_SECURITY_CONTEXT (templated via toJson). |
| cmd/controller/main.go | Adds parsing/wiring for --sidecar-security-context / SIDECAR_SECURITY_CONTEXT and passes it into the GameServer controller. |
| cmd/controller/main_test.go | Adds tests for parsing sidecar security context (default fallback, custom JSON, invalid JSON). |
Review details
- Files reviewed: 10/10 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Collaborator
|
Build Failed 😭 Build Id: bb32d3ad-34fd-4d2d-9d93-a92ed4adda9b Status: FAILURE To get permission to view the Cloud Build view, join the agones-discuss Google Group. |
The baseline and restricted Pod Security Standards forbid hostPort, so the GameServer in the test cannot use a Dynamic port. Document the constraint, and clarify the --sidecar-run-as-user help text. Signed-off-by: Subham K. <me@growly.gg>
…thub.com/GrowlyX/agones into feat/sidecar-restricted-security-context
Member
|
/gcbrun |
Collaborator
|
Build Failed 😭 Build Id: f2b116d7-3dd5-4dcc-a2cb-f559df5d768f Status: FAILURE To get permission to view the Cloud Build view, join the agones-discuss Google Group. |
…e2e test On GKE Autopilot, Agones defaults the Pod seccomp profile to Unconfined unless the template sets one, which the restricted Pod Security Standard rejects. Document this, and log GameServer events when a GameServer fails to become Ready in e2e tests. Signed-off-by: Subham K. <me@growly.gg>
Member
|
/gcbrun |
Collaborator
|
Build Succeeded 🥳 Build Id: 9d8174a8-aa62-4d42-b29f-d9bef7d9e466 The following development artifacts have been built, and will exist for the next 30 days:
A preview of the website (the last 30 builds are retained): To install this version: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind feature
What this PR does / Why we need it:
When running a Fleet in a namespace with
pod-security.kubernetes.io/enforceset torestricted, provisioning fails because the Agones SDK sidecar container doesn't satisfy "restricted" pod security requirements.This is fixed by adding
capabilities.drop: ["ALL"]and aseccompProfile.type: RuntimeDefaultto the sidecar container. This is fully configurable through the helm variables set inagones.image.sdk.securityContext, or theSIDECAR_SECURTY_CONTEXTenv.The behavior of
SIDECAR_RUN_AS_USERremains unchanged if NOSIDECAR_SECURTY_CONTEXT, but the value of theSIDECAR_SECURTY_CONTEXT/helm supersecedes the value ofSIDECAR_RUN_AS_USERif both are set.Which issue(s) this PR fixes:
Closes #4668
Did you use AI tools in preparing this PR?:
Y
Special notes for your reviewer:
N/A