feat(ragnarok-breaker): add gs-gateway proxy for V8 connection (#3342)

Workers were each opening their own V8 GameServer SDK connection, which
kicked both ends with duplicate_connection (4009) and crashed the SDK on
the next emitter.emit. Introduce a singleton gs-gateway HTTP service that
owns the V8 connection; workers now RPC over http://gs-gateway:3000.

- New Deployment/Service `gs-gateway` (replicas=1, strategy=Recreate,
  liveness/readiness on /health:3000). HPA must never be attached —
  scaling beyond 1 reintroduces the duplicate-connection problem.
- Worker Deployments gain GS_GATEWAY_URL env and an initContainer that
  waits for gs-gateway /health before the worker process starts.
- gs-gateway reuses the existing ragnarok-breaker-env secret (AGENT8_*
  values) and the ragnarok-breaker-regcred image pull secret.

AGENT8_AUTH in AWS Secrets Manager must be rotated from the short-lived
game token to a long-lived V8 access token JWT; gs-gateway exchanges it
for a game token at boot and refreshes every ~25 min.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Atralupus

charts/ragnarok-breaker/templates/gs-gateway.yaml

@@ -0,0 +1,74 @@
+{{- if .Values.gsGateway.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: gs-gateway
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: gs-gateway
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: gs-gateway
+spec:
+  type: ClusterIP
+  selector:
+    app: gs-gateway
+  ports:
+    - name: http
+      port: {{ .Values.gsGateway.port }}
+      targetPort: {{ .Values.gsGateway.port }}
+      protocol: TCP
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gs-gateway
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: gs-gateway
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: gs-gateway
+spec:
+  replicas: {{ .Values.gsGateway.replicas }}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: gs-gateway
+  template:
+    metadata:
+      labels:
+        app: gs-gateway
+    spec:
+      {{- if .Values.imagePullSecret.secretKey }}
+      imagePullSecrets:
+        - name: {{ .Values.imagePullSecret.name }}
+      {{- end }}
+      containers:
+        - name: gs-gateway
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+            {{- toYaml .Values.gsGateway.command | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.gsGateway.port }}
+          env:
+            - name: GS_GATEWAY_HOST
+              value: {{ .Values.gsGateway.host | quote }}
+            - name: GS_GATEWAY_PORT
+              value: {{ .Values.gsGateway.port | quote }}
+          envFrom:
+            - secretRef:
+                name: ragnarok-breaker-env
+          livenessProbe:
+            {{- toYaml .Values.gsGateway.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.gsGateway.readinessProbe | nindent 12 }}
+          resources:
+            {{- toYaml .Values.gsGateway.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      restartPolicy: Always
+{{- end }}

charts/ragnarok-breaker/templates/worker-deployments.yaml

@@ -25,12 +25,28 @@ spec:
       imagePullSecrets:
         - name: {{ $.Values.imagePullSecret.name }}
       {{- end }}
+      {{- if and $.Values.gsGateway.enabled $.Values.gsGateway.waitForReady }}
+      initContainers:
+        - name: wait-for-gs-gateway
+          image: busybox:1.36
+          command:
+            - sh
+            - -c
+            - |
+              until wget -q -O /dev/null {{ $.Values.gsGateway.serviceUrl }}/health; do
+                echo "waiting for gs-gateway..."
+                sleep 2
+              done
+      {{- end }}
       containers:
         - name: worker
           image: "{{ $.Values.image.repository }}:{{ $.Values.image.tag }}"
           imagePullPolicy: {{ $.Values.image.pullPolicy }}
           command:
             {{- toYaml $w.command | nindent 12 }}
+          env:
+            - name: GS_GATEWAY_URL
+              value: {{ $.Values.gsGateway.serviceUrl | quote }}
           envFrom:
             - secretRef:
                 name: ragnarok-breaker-env

charts/ragnarok-breaker/values.yaml

@@ -9,6 +9,38 @@ imagePullSecret:
   name: ragnarok-breaker-regcred
   secretKey: ""
 
+# Single-instance HTTP proxy that owns the V8 GameServer connection.
+# NEVER scale beyond 1 — duplicate connections cause V8 to kick both with 4009.
+gsGateway:
+  enabled: true
+  replicas: 1
+  command: ["bun", "run", "worker/src/entry/gs-gateway.entry.ts"]
+  host: "0.0.0.0"
+  port: 3000
+  serviceUrl: "http://gs-gateway:3000"
+  waitForReady: true
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+  livenessProbe:
+    httpGet:
+      path: /health
+      port: 3000
+    initialDelaySeconds: 30
+    periodSeconds: 15
+    failureThreshold: 3
+  readinessProbe:
+    httpGet:
+      path: /health
+      port: 3000
+    initialDelaySeconds: 10
+    periodSeconds: 10
+    failureThreshold: 3
+
 workers:
   scheduler:
     enabled: true