Merge branch 'main' into refactor-simple-game-server

build/Makefile

@@ -99,6 +99,7 @@ common_mounts = -v $(build_path)/.config/gcloud:/root/.config/gcloud \
 				-v $(build_path)/.gomod:/go/pkg/mod
 
 # Its possible for this to change in the future, so it gets its own variable.
+REGISTRY ?= local
 workdir_path = $(mount_path)
 
 build_version = $(call sha,$(build_path)/build-image/Dockerfile)

cmd/controller/main.go

@@ -68,6 +68,7 @@ const (
 	sidecarCPULimitFlag          = "sidecar-cpu-limit"
 	sidecarMemoryRequestFlag     = "sidecar-memory-request"
 	sidecarMemoryLimitFlag       = "sidecar-memory-limit"
+	sidecarRunAsUserFlag         = "sidecar-run-as-user"
 	sdkServerAccountFlag         = "sdk-service-account"
 	pullSidecarFlag              = "always-pull-sidecar"
 	minPortFlag                  = "min-port"
@@ -214,7 +215,7 @@ func main() {
 	gsController := gameservers.NewController(controllerHooks, health,
 		ctlConf.PortRanges, ctlConf.SidecarImage, ctlConf.AlwaysPullSidecar,
 		ctlConf.SidecarCPURequest, ctlConf.SidecarCPULimit,
-		ctlConf.SidecarMemoryRequest, ctlConf.SidecarMemoryLimit, ctlConf.SdkServiceAccount,
+		ctlConf.SidecarMemoryRequest, ctlConf.SidecarMemoryLimit, ctlConf.SidecarRunAsUser, ctlConf.SdkServiceAccount,
 		kubeClient, kubeInformerFactory, extClient, agonesClient, agonesInformerFactory)
 	gsSetController := gameserversets.NewController(health, gsCounter,
 		kubeClient, extClient, agonesClient, agonesInformerFactory)
@@ -260,6 +261,7 @@ func parseEnvFlags() config {
 	viper.SetDefault(sidecarCPULimitFlag, "0")
 	viper.SetDefault(sidecarMemoryRequestFlag, "0")
 	viper.SetDefault(sidecarMemoryLimitFlag, "0")
+	viper.SetDefault(sidecarRunAsUserFlag, "1000")
 	viper.SetDefault(pullSidecarFlag, false)
 	viper.SetDefault(sdkServerAccountFlag, "agones-sdk")
 	viper.SetDefault(certFileFlag, filepath.Join(base, "certs", "server.crt"))
@@ -284,6 +286,7 @@ func parseEnvFlags() config {
 	pflag.String(sidecarCPURequestFlag, viper.GetString(sidecarCPURequestFlag), "Flag to overwrite the GameServer sidecar container's cpu request. Can also use SIDECAR_CPU_REQUEST env variable")
 	pflag.String(sidecarMemoryLimitFlag, viper.GetString(sidecarMemoryLimitFlag), "Flag to overwrite the GameServer sidecar container's memory limit. Can also use SIDECAR_MEMORY_LIMIT env variable")
 	pflag.String(sidecarMemoryRequestFlag, viper.GetString(sidecarMemoryRequestFlag), "Flag to overwrite the GameServer sidecar container's memory request. Can also use SIDECAR_MEMORY_REQUEST env variable")
+	pflag.Int32(sidecarRunAsUserFlag, viper.GetInt32(sidecarRunAsUserFlag), "Flag to indicate the GameServer sidecar container's UID. Can also use SIDECAR_RUN_AS_USER env variable")
 	pflag.Bool(pullSidecarFlag, viper.GetBool(pullSidecarFlag), "For development purposes, set the sidecar image to have a ImagePullPolicy of Always. Can also use ALWAYS_PULL_SIDECAR env variable")
 	pflag.String(sdkServerAccountFlag, viper.GetString(sdkServerAccountFlag), "Overwrite what service account default for GameServer Pods. Defaults to Can also use SDK_SERVICE_ACCOUNT")
 	pflag.Int32(minPortFlag, 0, "Required. The minimum port that that a GameServer can be allocated to. Can also use MIN_PORT env variable.")
@@ -315,6 +318,7 @@ func parseEnvFlags() config {
 	runtime.Must(viper.BindEnv(sidecarCPURequestFlag))
 	runtime.Must(viper.BindEnv(sidecarMemoryLimitFlag))
 	runtime.Must(viper.BindEnv(sidecarMemoryRequestFlag))
+	runtime.Must(viper.BindEnv(sidecarRunAsUserFlag))
 	runtime.Must(viper.BindEnv(pullSidecarFlag))
 	runtime.Must(viper.BindEnv(sdkServerAccountFlag))
 	runtime.Must(viper.BindEnv(minPortFlag))
@@ -378,6 +382,7 @@ func parseEnvFlags() config {
 		SidecarCPULimit:         limitCPU,
 		SidecarMemoryRequest:    requestMemory,
 		SidecarMemoryLimit:      limitMemory,
+		SidecarRunAsUser:        int(viper.GetInt32(sidecarRunAsUserFlag)),
 		SdkServiceAccount:       viper.GetString(sdkServerAccountFlag),
 		AlwaysPullSidecar:       viper.GetBool(pullSidecarFlag),
 		KeyFile:                 viper.GetString(keyFileFlag),
@@ -430,6 +435,7 @@ type config struct {
 	SidecarCPULimit         resource.Quantity
 	SidecarMemoryRequest    resource.Quantity
 	SidecarMemoryLimit      resource.Quantity
+	SidecarRunAsUser        int
 	SdkServiceAccount       string
 	AlwaysPullSidecar       bool
 	PrometheusMetrics       bool

examples/simple-game-server/Dockerfile.windows

@@ -19,6 +19,7 @@
 
 # Build Stage
 ARG WINDOWS_VERSION=ltsc2019
+ARG IMAGE_TAG=""
 
 FROM --platform=linux/amd64 golang:1.21.6 as builder
 WORKDIR /go/src
@@ -29,7 +30,7 @@ WORKDIR /go/src/agones.dev/agones/examples/simple-game-server
 RUN GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -o simple-game-server.exe *.go
 
 RUN ls -ltr /go/src/agones.dev/agones/examples/simple-game-server
-FROM mcr.microsoft.com/windows/servercore:${WINDOWS_VERSION}
+FROM mcr.microsoft.com/windows/servercore:${WINDOWS_VERSION}${IMAGE_TAG}
 
 WORKDIR /
 

examples/simple-game-server/Makefile

@@ -30,6 +30,10 @@ BUILDX_WINDOWS_BUILDER = windows-builder
 # For the full list of tags see https://hub.docker.com/_/microsoft-windows-servercore.
 # GKE-Windows version map: https://cloud.google.com/kubernetes-engine/docs/how-to/creating-a-cluster-windows#version_mapping
 WINDOWS_VERSIONS = ltsc2019 ltsc2022
+
+# https://github.com/microsoft/Windows-Containers/issues/493: Pin the LTSC2019 image to an older sha
+LTSC2019_IMAGE_TAG = "@sha256:6fdf140282a2f809dae9b13fe441635867f0a27c33a438771673b8da8f3348a4"
+
 WINDOWS_DOCKER_PUSH_ARGS = # When pushing set to --push.
 # Build with Windows support
 WITH_WINDOWS ?= 1
@@ -108,7 +112,7 @@ push-windows-image-%:
 build-windows-image-%: ensure-windows-buildx
 	cd $(root_path) && DOCKER_CLI_EXPERIMENTAL=enabled \
 		docker buildx build --platform windows/amd64 --builder $(BUILDX_WINDOWS_BUILDER) -f $(project_path)Dockerfile.windows \
-	 	--tag=$(server_tag)-windows_amd64-$* --build-arg WINDOWS_VERSION=$* . $(WINDOWS_DOCKER_PUSH_ARGS)
+	 	--tag=$(server_tag)-windows_amd64-$* --build-arg WINDOWS_VERSION=$* --build-arg IMAGE_TAG=$(if $(filter ltsc2019,$*),$(LTSC2019_IMAGE_TAG),) . $(WINDOWS_DOCKER_PUSH_ARGS)
 
 ensure-windows-buildx:
 # Windows image builds must be directed to a specific buildx context.

examples/xonotic/Dockerfile.windows

@@ -35,6 +35,7 @@
 # See https://docs.microsoft.com/en-us/virtualization/windowscontainers/deploy-containers/version-compatibility
 # for details.
 ARG WINDOWS_VERSION=ltsc2019
+ARG IMAGE_TAG=""
 
 # Build Stage
 FROM --platform=linux/amd64 golang:1.21.6 as base
@@ -53,7 +54,7 @@ RUN curl -o xonotic.zip https://dl.xonotic.org/xonotic-0.8.6.zip && \
 
 
 # Final Image
-FROM mcr.microsoft.com/windows/servercore:${WINDOWS_VERSION}
+FROM mcr.microsoft.com/windows/servercore:${WINDOWS_VERSION}${IMAGE_TAG}
 
 WORKDIR C:/Xonotic
 

examples/xonotic/Makefile

@@ -29,6 +29,9 @@ PROD_REPO ?= us-docker.pkg.dev/agones-images/examples
 WINDOWS_VERSIONS = ltsc2019 ltsc2022
 BUILDX_WINDOWS_BUILDER = windows-builder
 
+# https://github.com/microsoft/Windows-Containers/issues/493: Pin the LTSC2019 image to an older sha
+LTSC2019_IMAGE_TAG = "@sha256:6fdf140282a2f809dae9b13fe441635867f0a27c33a438771673b8da8f3348a4"
+
 # Build with Windows support
 WITH_WINDOWS ?= 1
 
@@ -86,7 +89,7 @@ push-windows-image-%:
 
 build-windows-image-%: ensure-windows-buildx
 	docker buildx build --platform windows/amd64 --builder $(BUILDX_WINDOWS_BUILDER) -f $(project_path)Dockerfile.windows \
-	--tag=$(server_tag)-windows_amd64-$* --build-arg WINDOWS_VERSION=$* . $(WINDOWS_DOCKER_PUSH_ARGS)
+	--tag=$(server_tag)-windows_amd64-$* --build-arg WINDOWS_VERSION=$* --build-arg IMAGE_TAG=$(if $(filter ltsc2019,$*),$(LTSC2019_IMAGE_TAG),) . $(WINDOWS_DOCKER_PUSH_ARGS)
 
 ensure-windows-buildx:
 # Windows image builds must be directed to a specific buildx context.

install/helm/agones/templates/controller.yaml

@@ -134,6 +134,8 @@ spec:
           value: {{ .Values.agones.image.sdk.memoryRequest | quote }}
         - name: SIDECAR_MEMORY_LIMIT
           value: {{ .Values.agones.image.sdk.memoryLimit | quote }}
+        - name: SIDECAR_RUN_AS_USER
+          value: "1000"
         - name: SDK_SERVICE_ACCOUNT
           value: {{ .Values.agones.serviceaccount.sdk.name | quote }}
         - name: PROMETHEUS_EXPORTER

install/yaml/install.yaml

@@ -17084,6 +17084,8 @@ spec:
           value: "0"
         - name: SIDECAR_MEMORY_LIMIT
           value: "0"
+        - name: SIDECAR_RUN_AS_USER
+          value: "1000"
         - name: SDK_SERVICE_ACCOUNT
           value: "agones-sdk"
         - name: PROMETHEUS_EXPORTER

pkg/apis/agones/v1/gameserver.go

@@ -528,6 +528,14 @@ func (gss *GameServerSpec) validateFeatureGates(fldPath *field.Path) field.Error
 		}
 	}
 
+	if !runtime.FeatureEnabled(runtime.FeaturePortPolicyNone) {
+		for i, p := range gss.Ports {
+			if p.PortPolicy == None {
+				allErrs = append(allErrs, field.Forbidden(fldPath.Child("ports").Index(i).Child("portPolicy"), fmt.Sprintf("Value cannot be set to %s unless feature flag %s is enabled", None, runtime.FeaturePortPolicyNone)))
+			}
+		}
+	}
+
 	return allErrs
 }
 

pkg/apis/agones/v1/gameserver_test.go

@@ -1256,6 +1256,52 @@ func TestGameServerValidateFeatures(t *testing.T) {
 				},
 			},
 		},
+		{
+			description: "PortPolicyNone is disabled, PortPolicy field set to None",
+			feature:     fmt.Sprintf("%s=false", runtime.FeaturePortPolicyNone),
+			gs: GameServer{
+				Spec: GameServerSpec{
+					Ports: []GameServerPort{
+						{
+							Name:          "main",
+							ContainerPort: 7777,
+							PortPolicy:    None,
+						},
+					},
+					Container: "testing",
+					Lists:     map[string]ListStatus{},
+					Template: corev1.PodTemplateSpec{
+						Spec: corev1.PodSpec{Containers: []corev1.Container{{Name: "testing", Image: "testing/image"}}},
+					},
+				},
+			},
+			want: field.ErrorList{
+				field.Forbidden(
+					field.NewPath("spec.ports[0].portPolicy"),
+					"Value cannot be set to None unless feature flag PortPolicyNone is enabled",
+				),
+			},
+		},
+		{
+			description: "PortPolicyNone is enabled, PortPolicy field set to None",
+			feature:     fmt.Sprintf("%s=true", runtime.FeaturePortPolicyNone),
+			gs: GameServer{
+				Spec: GameServerSpec{
+					Ports: []GameServerPort{
+						{
+							Name:          "main",
+							ContainerPort: 7777,
+							PortPolicy:    None,
+						},
+					},
+					Container: "testing",
+					Lists:     map[string]ListStatus{},
+					Template: corev1.PodTemplateSpec{
+						Spec: corev1.PodSpec{Containers: []corev1.Container{{Name: "testing", Image: "testing/image"}}},
+					},
+				},
+			},
+		},
 	}
 
 	for _, tc := range testCases {
@@ -1499,7 +1545,8 @@ func TestGameServerPassthroughPortAnnotation(t *testing.T) {
 					{Name: "containerOne", Image: "container/image"},
 					{Name: "containerTwo", Image: "container/image"},
 					{Name: "containerThree", Image: "container/image"},
-					{Name: "containerFour", Image: "container/image"}},
+					{Name: "containerFour", Image: "container/image"},
+				},
 			},
 		},
 	}}

pkg/gameservers/controller.go

@@ -56,6 +56,7 @@ import (
 	"k8s.io/client-go/tools/cache"
 	"k8s.io/client-go/tools/record"
 	"k8s.io/client-go/util/workqueue"
+	"k8s.io/utils/pointer"
 )
 
 const (
@@ -83,6 +84,7 @@ type Controller struct {
 	sidecarCPULimit        resource.Quantity
 	sidecarMemoryRequest   resource.Quantity
 	sidecarMemoryLimit     resource.Quantity
+	sidecarRunAsUser       int
 	sdkServiceAccount      string
 	crdGetter              apiextclientv1.CustomResourceDefinitionInterface
 	podGetter              typedcorev1.PodsGetter
@@ -114,6 +116,7 @@ func NewController(
 	sidecarCPULimit resource.Quantity,
 	sidecarMemoryRequest resource.Quantity,
 	sidecarMemoryLimit resource.Quantity,
+	sidecarRunAsUser int,
 	sdkServiceAccount string,
 	kubeClient kubernetes.Interface,
 	kubeInformerFactory informers.SharedInformerFactory,
@@ -133,6 +136,7 @@ func NewController(
 		sidecarCPURequest:      sidecarCPURequest,
 		sidecarMemoryLimit:     sidecarMemoryLimit,
 		sidecarMemoryRequest:   sidecarMemoryRequest,
+		sidecarRunAsUser:       sidecarRunAsUser,
 		alwaysPullSidecarImage: alwaysPullSidecarImage,
 		sdkServiceAccount:      sdkServiceAccount,
 		crdGetter:              extClient.ApiextensionsV1().CustomResourceDefinitions(),
@@ -763,6 +767,13 @@ func (c *Controller) sidecar(gs *agonesv1.GameServer) corev1.Container {
 	if c.alwaysPullSidecarImage {
 		sidecar.ImagePullPolicy = corev1.PullAlways
 	}
+
+	sidecar.SecurityContext = &corev1.SecurityContext{
+		AllowPrivilegeEscalation: pointer.Bool(false),
+		RunAsNonRoot:             pointer.Bool(true),
+		RunAsUser:                pointer.Int64(int64(c.sidecarRunAsUser)),
+	}
+
 	return sidecar
 }
 

pkg/gameservers/controller_test.go

@@ -51,9 +51,10 @@ import (
 )
 
 const (
-	ipFixture       = "12.12.12.12"
-	ipv6Fixture     = "2001:0db8:85a3:0000:0000:8a2e:0370:7334"
-	nodeFixtureName = "node1"
+	ipFixture        = "12.12.12.12"
+	ipv6Fixture      = "2001:0db8:85a3:0000:0000:8a2e:0370:7334"
+	nodeFixtureName  = "node1"
+	sidecarRunAsUser = 1000
 )
 
 var GameServerKind = metav1.GroupVersionKind(agonesv1.SchemeGroupVersion.WithKind("GameServer"))
@@ -1306,6 +1307,9 @@ func TestControllerCreateGameServerPod(t *testing.T) {
 			assert.Equal(t, "FEATURE_GATES", sidecarContainer.Env[2].Name)
 			assert.Equal(t, "LOG_LEVEL", sidecarContainer.Env[3].Name)
 			assert.Equal(t, string(fixture.Spec.SdkServer.LogLevel), sidecarContainer.Env[3].Value)
+			assert.Equal(t, *sidecarContainer.SecurityContext.AllowPrivilegeEscalation, false)
+			assert.Equal(t, *sidecarContainer.SecurityContext.RunAsNonRoot, true)
+			assert.Equal(t, *sidecarContainer.SecurityContext.RunAsUser, int64(sidecarRunAsUser))
 
 			gsContainer := pod.Spec.Containers[1]
 			assert.Equal(t, fixture.Spec.Ports[0].HostPort, gsContainer.Ports[0].HostPort)
@@ -2257,7 +2261,7 @@ func newFakeController() (*Controller, agtesting.Mocks) {
 		map[string]portallocator.PortRange{agonesv1.DefaultPortRange: {MinPort: 10, MaxPort: 20}},
 		"sidecar:dev", false,
 		resource.MustParse("0.05"), resource.MustParse("0.1"),
-		resource.MustParse("50Mi"), resource.MustParse("100Mi"), "sdk-service-account",
+		resource.MustParse("50Mi"), resource.MustParse("100Mi"), sidecarRunAsUser, "sdk-service-account",
 		m.KubeClient, m.KubeInformerFactory, m.ExtClient, m.AgonesClient, m.AgonesInformerFactory)
 	c.recorder = m.FakeRecorder
 	return c, m

sdks/csharp/sdk/AgonesSDK.cs

@@ -103,18 +103,6 @@ public IAgonesBetaSDK Beta()
 			return beta;
 		}
 
-
-
-		/// <summary>
-		/// Connect the underlying gRPC channel.
-		/// </summary>
-		/// <returns>Always return true</returns>
-		[Obsolete("No need to call ConnectAsync anymore")]
-		public async Task<bool> ConnectAsync()
-		{
-			return true;
-		}
-
 		/// <summary>
 		/// Tells Agones that the Game Server is ready to take player connections
 		/// </summary>

sdks/csharp/sdk/IAgonesSDK.cs

@@ -21,7 +21,6 @@ namespace Agones
 {
     public interface IAgonesSDK : IDisposable
     {
-        Task<bool> ConnectAsync();
         Task<Status> ReadyAsync();
         Task<Status> AllocateAsync();
         Task<Status> ReserveAsync(long seconds);

sdks/unity/AgonesSdk.cs

@@ -360,17 +360,37 @@ private void OnRequestCompleted(AsyncOperation _)
         private class GameServerHandler : DownloadHandlerScript
         {
             private WatchGameServerCallback callback;
+            private StringBuilder stringBuilder;
+
             public GameServerHandler(WatchGameServerCallback callback)
             {
                 this.callback = callback;
+                this.stringBuilder = new StringBuilder();
             }
 
             protected override bool ReceiveData(byte[] data, int dataLength)
             {
-                string json = Encoding.UTF8.GetString(data);
-                var dictionary = (Dictionary<string, object>) Json.Deserialize(json);
-                var gameServer = new GameServer(dictionary["result"] as Dictionary<string, object>);
-                this.callback(gameServer);
+                string dataString = Encoding.UTF8.GetString(data);
+                this.stringBuilder.Append(dataString);
+
+                string bufferString = stringBuilder.ToString();
+                int newlineIndex;
+
+                while ((newlineIndex = bufferString.IndexOf('\n')) >= 0)
+                {
+                    string fullLine = bufferString.Substring(0, newlineIndex);
+                    try
+                    {
+                        var dictionary = (Dictionary<string, object>) Json.Deserialize(fullLine);
+                        var gameServer = new GameServer(dictionary["result"] as Dictionary<string, object>);
+                        this.callback(gameServer);
+                    }
+                    catch (Exception ignore) {} // Ignore parse errors
+                    bufferString = bufferString.Substring(newlineIndex + 1);
+                }
+
+                stringBuilder.Clear();
+                stringBuilder.Append(bufferString);
                 return true;
             }
         }