feat: add code server

api/v1alpha1/gameserver_types.go

@@ -31,6 +31,48 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 )
 
+// EditorAuthSpec configures authentication for the code-server sidecar.
+type EditorAuthSpec struct {
+	// Enabled controls whether authentication is required to access the editor.
+	// When set to false, any process that can reach the pod — including other pods in the
+	// same cluster — can access the editor without credentials. Only disable this if
+	// access is restricted by network policies or the cluster is fully trusted.
+	// +kubebuilder:default=true
+	// +optional
+	Enabled *bool `json:"enabled,omitempty"`
+
+	// PasswordSecretRef references an existing Secret that contains a "password" key.
+	// If not set and Enabled is true, the operator creates a Secret with a randomly
+	// generated password automatically. Retrieve it with:
+	//   kubectl get secret <gameserver-name>-editor-password -o jsonpath='{.data.password}' | base64 -d
+	// +optional
+	PasswordSecretRef *corev1.LocalObjectReference `json:"passwordSecretRef,omitempty"`
+}
+
+// EditorSpec defines the configuration for the web-based editor sidecar.
+type EditorSpec struct {
+	// Enabled indicates whether the code-server (VS Code in browser) sidecar is added to the pod.
+	// Access it via: kubectl port-forward pod/<name> 8080:8080
+	// +kubebuilder:default=false
+	// +optional
+	Enabled bool `json:"enabled,omitempty"`
+
+	// Auth configures authentication for the editor. If omitted, a Secret with a
+	// randomly generated password is created automatically (secure default).
+	// +optional
+	Auth *EditorAuthSpec `json:"auth,omitempty"`
+
+	// ShareProcessNamespace enables sharing the process namespace between the gameserver
+	// and editor containers, allowing the editor terminal to inspect and signal gameserver processes.
+	// +kubebuilder:default=false
+	// +optional
+	ShareProcessNamespace bool `json:"shareProcessNamespace,omitempty"`
+
+	// Resources defines resource requests and limits for the editor sidecar container.
+	// +optional
+	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
+}
+
 // GameServerSpec defines the desired state of GameServer
 // leave out for now //+kubebuilder:validation:XValidation:rule="size(self.gameConfigs) <= 1",message="Cannot specify more than one game-specific configuration block."
 type GameServerSpec struct {
@@ -78,6 +120,11 @@ type GameServerSpec struct {
 	// If not specified, Kubernetes scheduler defaults apply.
 	// +optional
 	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
+
+	// Editor defines the configuration for the web-based editor sidecar.
+	// When enabled, a code-server (VS Code in browser) container is injected into the pod.
+	// +optional
+	Editor *EditorSpec `json:"editor,omitempty"`
 }
 
 type GameConfigs struct {

charts/chart/templates/_helpers.tpl

@@ -31,6 +31,13 @@ Always uses the Helm release namespace.
 {{- .Release.Namespace }}
 {{- end }}
 
+{{/*
+ServiceAccount name used by the controller manager.
+*/}}
+{{- define "gameserver-operator.serviceAccountName" -}}
+{{- include "gameserver-operator.fullname" . }}
+{{- end }}
+
 {{/*
 Resource name with proper truncation for Kubernetes 63-character limit.
 Takes a dict with:

charts/chart/templates/crd/gameservers.games.idebeijer.github.io.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.crd.enable }}
+{{- if .Values.crd.enabled }}
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
@@ -42,6 +42,116 @@ spec:
           spec:
             description: spec defines the desired state of GameServer
             properties:
+              editor:
+                description: |-
+                  Editor defines the configuration for the web-based editor sidecar.
+                  When enabled, a code-server (VS Code in browser) container is injected into the pod.
+                properties:
+                  auth:
+                    description: |-
+                      Auth configures authentication for the editor. If omitted, a Secret with a
+                      randomly generated password is created automatically (secure default).
+                    properties:
+                      enabled:
+                        default: true
+                        description: |-
+                          Enabled controls whether authentication is required to access the editor.
+                          When set to false, any process that can reach the pod — including other pods in the
+                          same cluster — can access the editor without credentials. Only disable this if
+                          access is restricted by network policies or the cluster is fully trusted.
+                        type: boolean
+                      passwordSecretRef:
+                        description: |-
+                          PasswordSecretRef references an existing Secret that contains a "password" key.
+                          If not set and Enabled is true, the operator creates a Secret with a randomly
+                          generated password automatically. Retrieve it with:
+                            kubectl get secret <gameserver-name>-editor-password -o jsonpath='{.data.password}' | base64 -d
+                        properties:
+                          name:
+                            default: ""
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                            type: string
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    type: object
+                  enabled:
+                    default: false
+                    description: |-
+                      Enabled indicates whether the code-server (VS Code in browser) sidecar is added to the pod.
+                      Access it via: kubectl port-forward pod/<name> 8080:8080
+                    type: boolean
+                  resources:
+                    description: Resources defines resource requests and limits for
+                      the editor sidecar container.
+                    properties:
+                      claims:
+                        description: |-
+                          Claims lists the names of resources, defined in spec.resourceClaims,
+                          that are used by this container.
+
+                          This field depends on the
+                          DynamicResourceAllocation feature gate.
+
+                          This field is immutable. It can only be set for containers.
+                        items:
+                          description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                          properties:
+                            name:
+                              description: |-
+                                Name must match the name of one entry in pod.spec.resourceClaims of
+                                the Pod where this field is used. It makes that resource available
+                                inside a container.
+                              type: string
+                            request:
+                              description: |-
+                                Request is the name chosen for a request in the referenced claim.
+                                If empty, everything from the claim is made available, otherwise
+                                only the result of this request.
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                        x-kubernetes-list-map-keys:
+                        - name
+                        x-kubernetes-list-type: map
+                      limits:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        description: |-
+                          Limits describes the maximum amount of compute resources allowed.
+                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                        type: object
+                      requests:
+                        additionalProperties:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                          x-kubernetes-int-or-string: true
+                        description: |-
+                          Requests describes the minimum amount of compute resources required.
+                          If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                          otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                          More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                        type: object
+                    type: object
+                  shareProcessNamespace:
+                    default: false
+                    description: |-
+                      ShareProcessNamespace enables sharing the process namespace between the gameserver
+                      and editor containers, allowing the editor terminal to inspect and signal gameserver processes.
+                    type: boolean
+                type: object
               gameConfigs:
                 description: GameConfigs holds game-specific configuration options.
                 properties:

charts/chart/templates/manager/manager.yaml

@@ -74,7 +74,7 @@ spec:
       {{- end }}
       containers:
       - args:
-        {{- if .Values.metrics.enable }}
+        {{- if .Values.metrics.enabled }}
         - --metrics-bind-address=:{{ .Values.metrics.port }}
         {{- if not .Values.metrics.secure }}
         - --metrics-secure=false

charts/chart/templates/metrics/controller-manager-metrics-service.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.metrics.enable }}
+{{- if .Values.metrics.enabled }}
 apiVersion: v1
 kind: Service
 metadata:

charts/chart/templates/monitoring/servicemonitor.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.prometheus.enable }}
+{{- if .Values.prometheus.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -17,7 +17,7 @@ spec:
       scheme: https
       bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
       tlsConfig:
-        {{- if .Values.certManager.enable }}
+        {{- if .Values.certManager.enabled }}
         serverName: {{ include "gameserver-operator.resourceName" (dict "suffix" "controller-manager-metrics-service" "context" $) }}.{{ .Release.Namespace }}.svc
         # Apply secure TLS configuration with cert-manager
         insecureSkipVerify: false

charts/chart/templates/network-policy/allow-metrics-traffic.yaml

@@ -0,0 +1,25 @@
+{{- if .Values.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/name: {{ include "gameserver-operator.name" . }}
+  name: {{ include "gameserver-operator.resourceName" (dict "suffix" "allow-metrics-traffic" "context" $) }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  podSelector:
+    matchLabels:
+      control-plane: controller-manager
+      app.kubernetes.io/name: {{ include "gameserver-operator.name" . }}
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+      - namespaceSelector:
+          matchLabels:
+            metrics: enabled
+      ports:
+        - port: {{ .Values.metrics.port }}
+          protocol: TCP
+{{- end }}

charts/chart/templates/prometheus/controller-manager-metrics-monitor.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.prometheus.enable }}
+{{- if .Values.prometheus.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -21,7 +21,7 @@ spec:
     {{- if .Values.metrics.secure }}
     tlsConfig:
       serverName: {{ include "gameserver-operator.resourceName" (dict "suffix" "controller-manager-metrics-service" "context" $) }}.{{ .Release.Namespace }}.svc
-      {{- if .Values.certManager.enable }}
+      {{- if .Values.certManager.enabled }}
       ca:
         secret:
           name: metrics-server-cert

charts/chart/templates/rbac/controller-manager.yaml

@@ -1,4 +1,4 @@
-{{- if ne .Values.serviceAccount.enable false }}
+{{- if ne .Values.serviceAccount.enabled false }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:

charts/chart/templates/rbac/gameserver-admin-role.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.rbac.helpers.enable }}
+{{- if .Values.rbac.helpers.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 {{- if .Values.rbac.namespaced }}
 kind: Role

charts/chart/templates/rbac/gameserver-editor-role.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.rbac.helpers.enable }}
+{{- if .Values.rbac.helpers.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 {{- if .Values.rbac.namespaced }}
 kind: Role

charts/chart/templates/rbac/gameserver-viewer-role.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.rbac.helpers.enable }}
+{{- if .Values.rbac.helpers.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 {{- if .Values.rbac.namespaced }}
 kind: Role

charts/chart/templates/rbac/manager-role.yaml

@@ -10,6 +10,15 @@ metadata:
 {{- end }}
   name: {{ include "gameserver-operator.resourceName" (dict "suffix" "manager-role" "context" $) }}
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
 - apiGroups:
   - ""
   resources:

charts/chart/templates/rbac/metrics-auth-role.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.metrics.enable .Values.metrics.secure }}
+{{- if and .Values.metrics.enabled .Values.metrics.secure }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:

charts/chart/templates/rbac/metrics-auth-rolebinding.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.metrics.enable .Values.metrics.secure }}
+{{- if and .Values.metrics.enabled .Values.metrics.secure }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:

charts/chart/templates/rbac/metrics-reader.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.metrics.enable .Values.metrics.secure }}
+{{- if and .Values.metrics.enabled .Values.metrics.secure }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata: