Narrow probe and apiserver exceptions and isolate sentinel-to-game traffic per server #713

The default policies admit more internal traffic than the per-server advertised-port rules suggest. A compromised wake sentinel can connect to every game pod on every port. Broad probe ingress also admits other RFC1918/link-local sources if their egress permits it, while the apiserver exception permits game pods to reach arbitrary private HTTPS services. This request tightens these explicit allowances and corrects comments that imply another policy restricts them.

Inspected 04e41075cafc4c1a99bcb3723b0a8745ee810957 statically; no runtime exploit or CNI connectivity test was run. #514 deliberately preserved and documented the broad apiserver fallback. This is a follow-up hardening change, not a claim that its documentation fix was absent.

Evidence:

• Default kubelet CIDRs and probe ports are empty. The resulting probe policy allows RFC1918/link-local sources without a port restriction.
• The agent apiserver allowance opens all private/link-local destinations on TCP 443/6443.
• Both sentinel-to-game policies select all instances and omit ports. Their comments incorrectly suggest per-server ingress narrows these rules. NetworkPolicies are additive: a second deny policy cannot subtract these grants.

Prerequisites and limits: an ordinary compromised game pod remains subject to its own egress rules, so this is not a claim that every game can reach every peer RCON port. Agent and capture mTLS still protect their control endpoints. A compromised sentinel, however, has both matching ingress and egress allowances to other games, including management ports.

Recommended implementation:

• Provide a strict installation profile requiring actual apiserver endpoint CIDRs and kubelet source CIDRs/probe ports. Validate supplied values and document CNI/NAT-specific address selection. Preserve compatibility through an explicit migration path rather than silently assuming universal endpoint addresses.
• Replace the two namespace-wide sentinel allowances with controller-owned per-GameServer policies. Existing game and sentinel pods already carry app.kubernetes.io/instance: <server> (sentinel labels). Generate both policy directions using the owning instance and the template's advertised container ports. Example ingress fragment for server example:

podSelector:
  matchLabels:
    app.kubernetes.io/name: gameplane-game
    app.kubernetes.io/instance: example
policyTypes: [Ingress]
ingress:
  - from:
      - podSelector:
          matchLabels:
            app.kubernetes.io/name: gameplane-waker
            app.kubernetes.io/instance: example
    ports:
      - {protocol: TCP, port: 25565}

• Generate the matching egress half selecting that sentinel and destination game instance. Treat zero advertised ports as no allowance, not an empty unrestricted ports list. Remove old broad policies during upgrade and narrow probe ingress as well.

Acceptance criteria:

• CI verifies complete destination/source/port tuples, not independent presence of CIDRs and ports.
• CNI-backed checks allow each sentinel's intended proxy traffic and deny other servers and unadvertised management ports.
• Heartbeats, game startup, probes, and approved API/operator agent access remain functional.
• An upgrade removes obsolete broad grants; strict settings and comments describe the effective union of all policies accurately.