Production Helm installation

Releases up to and including v0.3.0 are published under ghcr.io/valgulnecron, so this page uses that registry; releases after v0.3.0 move to ghcr.io/gameplanepanel.

Establish a production baseline

Pin every artifact and make environment ownership explicit before the first workload reaches the cluster.

Gameplane’s Helm chart is distributed as an OCI artifact on GitHub Container Registry (GHCR). Every release includes pinned component image versions, so locking the chart version locks the software stack:

• Chart version pins the operator, API, and web dashboard images.
• Optional component images — audit-syslog-bridge, telemetry-receiver, sentinel, tunnel-frp, tunnel-tailscale, tunnel-playit, mcp-server and capture-sidecar — are pulled only when the optional component they belong to is enabled (and, for sentinel and capture-sidecar, only for GameServers that opt in). A default install pulls four images: operator, api, web and agent.
• GameServer agent images are pulled per-server, on-demand, so pre-staging is not required.

Before your first production install, document and approve the release you intend to deploy: the specific chart version (e.g., 0.2.0-beta.8) and any image tag or pull secret overrides in your values file.

Render and review

Treat rendered manifests as the production change set, with Secrets kept outside committed values.

Helm’s template rendering step separates two concerns:

1. Values file (safe to commit): Helm defaults, component toggles, namespace, ingress host, resource requests, RBAC settings, storage class.
2. Secrets (kept outside Git): database credentials, OIDC client secrets, syslog endpoints, backup encryption keys, API keys for monitoring or telemetry.

Use helm template to render the chart locally with your values, inspect the YAML for correctness (resource names, labels, selectors, PVCs), and commit the rendered output as your production record. This makes every change reviewable and auditable before it ever touches the cluster.

Install and accept

Use an atomic, waited install, then accept the release only after control-plane and workload smoke tests.

The --atomic and --wait flags ensure Helm rolls back automatically if the control plane fails to become ready during the 5-minute default timeout. This prevents partial or stranded installs.

After the Helm release completes:

1. Control-plane smoke test: Verify the operator and API are running and healthy.

   kubectl -n gameplane-system get deployment
   kubectl -n gameplane-system logs -l app.kubernetes.io/name=gameplane-api --tail=50

2. Workload smoke test: Create a test GameServer and verify it reaches Ready.

3. Accept the release: Only after both tests pass, document the release as accepted in your change log.

Version and prerequisites

Gameplane requires:

• Kubernetes 1.28+
• Helm 3.13+
• A default StorageClass for game-server data PVCs (any RWO CSI driver works)
• Optional: an ingress controller (nginx-ingress by default) and cert-manager for TLS

The current stable release is v0.2.0-beta.8. Install by specifying the version explicitly to ensure reproducibility.

Image signature verification

All released images, the chart, and official game modules are signed with cosign and recorded in the Sigstore Rekor transparency log:

cosign verify --key cosign.pub \
  ghcr.io/valgulnecron/gameplane/operator:0.2.0-beta.8

Pre-rotation releases (v0.2.0-beta.7 and earlier) used the retired Ed25519 key and lack transparency log entries — verify those with cosign-legacy.pub and --insecure-ignore-tlog=true.

Next steps

Once your production baseline is in place, configure networking and ingress: Ingress, TLS, and external access