Repository navigation
fix(chart): allow kubelet probes on game ports, not just the agent port - #7
Merged
Merged
Conversation
The allow-kubelet-probes NetworkPolicy hardcoded the ingress to TCP 8090 (the agent), but per-module readiness/liveness probes target game/status ports (Valheim 80, Terraria 7777, the Minecraft game port, etc.), so on clusters that enforce NetworkPolicy for node-to-pod probe traffic those probes were blocked. Add networkPolicies.probePorts (default empty): an empty list omits the ports restriction so the kubelet, already scoped to kubeletCIDRs, can reach any game port; set it to lock down to a known set. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: valgulnecron <39313199+ValgulNecron@users.noreply.github.com>
ValgulNecron
added a commit
that referenced
this pull request
Aug 23, 2026
Fix two critical edge cases in the capture-sidecar: 1. ENOSPC from WritePacket reported as "error" instead of "disk_full" (Z2 #6): When a bufio flush inside WritePacket fails with ENOSPC, the error doesn't wrap ErrLimitReached, so it falls through to the default case and gets reported as a generic "error" reason. This hides the root cause from operators investigating truncated captures. Fixed by checking both the error chain and the writer's LimitReason field in the default case to properly distinguish disk-full from other failures. Added TestCaptureENOSPCDuringWritePacketReportsDiskFull to verify ENOSPC surfaces as disk_full reason in both the writer and the handler. 2. Process shutdown never finalizes in-flight captures (Z2 #7): On SIGTERM, baseCtx is cancelled, causing runCapture to return without calling finish(), leaving the PCAPNG writer unflushed and the file potentially truncated and unreadable (worst failure mode for a forensic tool). Fixed by: - Adding Server.FinalizeCurrentCapture() to safely finalize the current capture with a timeout, logging if the goroutine doesn't exit in time - Calling FinalizeCurrentCapture() in main.go after server.Shutdown() This ensures captures are always properly closed before process exit, regardless of whether shutdown is graceful or forced by the container orchestrator. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016EsywBB1qz8A6F68HPJpxv
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug 9 from BUG_REPORT.md
The
allow-kubelet-probesNetworkPolicy incharts/gameplane/templates/networkpolicies.yamlhardcoded its ingress to TCP8090(the agent port). But per-module readiness/liveness probes hit the game/status ports (Valheim80, Terraria7777, the Minecraft game port, …). On clusters that enforce NetworkPolicy for node-to-pod probe traffic, those probes were silently blocked even though the chart claims to allow kubelet probes.Fix
Add
networkPolicies.probePorts(default[]). When empty, theports:restriction is omitted entirely, so the kubelet — already scoped tokubeletCIDRs— can reach any port on a game pod. Operators who want to lock it down can set an explicit{protocol, port}list. Empty-means-default mirrors the existingkubeletCIDRssemantics, and the templating matches thegameEgress.portsblock.Verification
helm templaterenders:ports:field on the kubelet-probe ingress (all ports allowed)--set networkPolicies.probePorts[0]...→ a restrictedports:listCovered by the chart-render CI job.
🤖 Generated with Claude Code