ValgulNecron · Nov 10, 2026 · Nov 10, 2026
@@ -2,7 +2,7 @@
 
 Architecture, commands, and binding rules for AI agents. Humans: [`README.md`](README.md), [`docs/contributing.md`](docs/contributing.md).
 
-**Gameplane:** Kubernetes-native game server control panel (CubeCoders AMP alternative); identical on single-node k3s and multi-node clusters. **Status:** Pre-v1 release (`v0.3.0`); v1 scope feature-complete, stabilizing.
+**Gameplane:** Kubernetes-native game server control panel (CubeCoders AMP alternative); identical on single-node k3s and multi-node clusters. **Status:** Pre-v1 release (`v0.4.0`); v1 scope feature-complete, stabilizing.
 
 ## ⏳ Session start: blocked dependency upgrades (delete an entry once unblocked)
 

@@ -7,15 +7,68 @@ reaches `1.0.0`. Pre-1.0 minor versions may contain breaking changes.
 
 ## [Unreleased]
 
+## [0.4.0] — 2026-11-10
+
+A pre-v1 release with every change made since v0.3.0: an independent central
+panel, languages, the extended telemetry tier, safer backups and restores,
+fleet-wide node inventory, and a pre-release security hardening pass. Read the
+upgrade notes below before upgrading; several of them change behaviour. It
+does not claim v1 or production support; see [`docs/roadmap.md`](docs/roadmap.md).
+
 ### Fixed
 
+- **Backup, restore and wipe exclusion (#718):** backups, restores and wipes
+  of the same server now take one lifecycle ownership, so a backup can no
+  longer read a filesystem a restore or wipe is changing, and wipe workers are
+  drained before workloads come back (PRs #760, #619).
+- **Backup captures:** backup workers are prepared before quiesce, CSI
+  snapshot captures are bounded, and a capture taken across a game container
+  restart is invalidated instead of being kept (PRs #836, #846).
+- **Backups with retention disabled are kept** (PR #618).
+- **Wake on connect:** wake requests are bounded, HostPort hand-offs are
+  preserved, and shared wakes retry within their budget instead of failing on
+  the first cold-start error (PRs #840, #860).
+- **Tunnels:** frp identities are isolated per server and report relay
+  connection health; Tailscale forwards every advertised TCP and UDP port and
+  keeps active UDP sessions (PRs #768, #765).
+- **New files are created atomically** and never overwrite an existing file
+  (PR #621).
 - **Standalone Helm CRD isolation:** the central panel profile excludes bundled
   native CRDs and their apply hook/RBAC without requiring `--skip-crds`.
   Default operator installations keep Helm's native CRD lifecycle; existing
   CRDs and their custom resources are retained when a profile omits them.
 
 ### Upgrade Notes
 
+- **Breaking: admin-level grants need a full administrator:** holders of
+  `users:manage`, `roles:manage` or `config:manage` without `*` can no longer
+  grant `*` or another admin-level permission, edit or reset an administrator,
+  or edit auth providers (`/admin/config/auth`, `/admin/auth` need `*`)
+  (PR #862).
+- **Breaking: kubelet probes reach only probe ports:** a new per-server
+  `<server>-probes` NetworkPolicy admits kubelet CIDRs to the game container's
+  probe ports only, on by default with `networkPolicies.probeIngress.enabled`.
+  The old all-ports `allow-kubelet-probes` rule renders only when that is
+  `false` or extra `probePorts` are listed. Set
+  `networkPolicies.probeIngress.enabled: false` to restore the old rule
+  (PR #862).
+- **Breaking: custom CSS:** stylesheets with `\` escapes or absolute,
+  `http(s):` or protocol-relative `//` references are now rejected (PR #862).
+- **Share links get their own Ingress:** `/share` and `/shares` go through a
+  second Ingress, `gameplane-share`, with access logging off for ingress-nginx
+  (`ingress.shareLinks.*`). Other controllers need their own switch in
+  `ingress.shareLinks.annotations`; see [`docs/install.md`](docs/install.md)
+  (PR #862).
+- **Password reset ends every session** of that account (migration
+  `019_session_epoch.sql`, applied on API startup) (PR #862).
+- **The API is a singleton in every mode:** every database driver uses the
+  `Recreate` strategy and `api.replicas` other than 1 is rejected, so upgrades
+  no longer overlap two API processes (#726, PR #758).
+- **Auxiliary resource requests and management placement:** agent,
+  config-init, sentinel, tunnel and Restic pods now request resources on every
+  install, and chart-managed pods accept placement settings. Game and
+  auxiliary pods can restart on upgrade; see
+  [`docs/release-notes.md`](docs/release-notes.md) (#724, PR #762).
 - **Standalone panel/API:** run the central panel with Docker Compose or the
   standalone Helm profile, without a local game cluster or operator. Compose
   needs no Kubernetes installation on the panel host.
@@ -183,6 +236,17 @@ reaches `1.0.0`. Pre-1.0 minor versions may contain breaking changes.
   bundle's files together up to 4 MiB. `gp-module i18n extract|stamp` and
   `gp-module validate` support authoring. See
   [`docs/module-authoring.md`](docs/module-authoring.md).
+- **Fleet-wide node inventory:** clusters are organized on their own pages and
+  a Nodes page lists the nodes of every cluster you can see, with the same
+  search and filters as Backups (PR #859).
+- **Game performance and relay monitoring:** bounded per-game performance and
+  relay metrics (PR #838).
+- **Stopped multi-volume Restic recovery:** a stopped server with several data
+  volumes can be recovered from its Restic backups (PR #861).
+- **Wake on connect from server settings:** users can turn wake on connect on
+  from the server's Lifecycle settings (PR #818).
+- **Reserve less than the limits:** a server can request less CPU and memory
+  than its limits (Burstable QoS) from Resources and Create Server (PR #815).
 
 ### Changed
 
@@ -202,6 +266,24 @@ reaches `1.0.0`. Pre-1.0 minor versions may contain breaking changes.
 
 ### Security
 
+- **Pre-release hardening (PR #862):** OIDC discovery, key fetches and code
+  exchange, and operator OCI registry dials go through the dial guard; agent
+  and capture proxies can no longer override the API's security headers; a
+  login-device cookie stops failed logins elsewhere from locking the owner
+  out; the API pod no longer mounts the agent CA key; a ValidatingAdmissionPolicy
+  (Kubernetes 1.30+) limits waker service accounts to the wake annotation;
+  template env Secret and ConfigMap references follow the server ownership
+  rule; the agent serves regular files only and confines mod installs to the
+  mods root; the dashboard ships Monaco in the image and sends a
+  Content-Security-Policy and security headers; share tokens stay out of
+  access and error logs.
+- **Snapshot restores** authorize their data source against the live Backup
+  owner and reject unfinished or aborted snapshots (PR #756).
+- **Operator Secret access** is scoped to the configured namespaces (PR #757).
+- **Image CVE fixes:** eMudhra CA distrust and Alpine/Debian updates in game
+  images, the Tailscale tunnel built with fixed Go modules, and updated `expat`,
+  `musl`, `zlib`, `brotli` and `curl` in the dashboard image (PRs #775, #845,
+  #816).
 - **Standalone credential protection:** encryption keys are kept outside
   database volumes, with durable publication, fail-closed file-access checks,
   read-only provisioned custody, and authenticated transactional rotation.
@@ -1294,7 +1376,8 @@ testing. Not yet recommended for unattended production workloads — see
   runner (retry + longer readiness window), eliminating a cascade of flaky
   API e2e failures.
 
-[Unreleased]: https://github.com/GameplanePanel/gameplane/compare/v0.3.0...HEAD
+[Unreleased]: https://github.com/GameplanePanel/gameplane/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/GameplanePanel/gameplane/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/GameplanePanel/gameplane/compare/v0.3.0-rc.1...v0.3.0
 [0.3.0-rc.2]: https://github.com/GameplanePanel/gameplane/compare/v0.3.0-rc.1...v0.3.0
 [0.3.0-rc.1]: https://github.com/GameplanePanel/gameplane/compare/v0.2.0-beta.8...v0.3.0-rc.1

@@ -6,7 +6,7 @@ Default column: **on** (enabled by the chart or the product), **off** (opt-in, s
 
 Notification rows take effect once a notification sink is configured.
 
-Status date: 2026-10-14 (v0.3.0, pre-v1).
+Status date: 2026-11-10 (v0.4.0, pre-v1).
 
 See [docs/roadmap.md](docs/roadmap.md) for what is planned and in progress.
 

@@ -13,7 +13,7 @@ The dashboard and API can also run on a host without Kubernetes using
 [standalone Docker Compose](docs/standalone-panel.md). Game servers still run
 on registered Kubernetes clusters, each with its own operator and agents.
 
-> Status: **pre-v1 release** (`v0.3.0`). The operator, API, agent, and dashboard
+> Status: **pre-v1 release** (`v0.4.0`). The operator, API, agent, and dashboard
 > are feature-complete for the v1 scope and stabilized for external testing.
 > See [Pre-v1 status & known limitations](#pre-v1-status--limitations) before
 > running it for anything you can't afford to lose.
@@ -44,7 +44,7 @@ Screenshots are captured against mocked data for consistency and reproducibility
 
 ## Pre-v1 Status & Limitations
 
-Gameplane is a **pre-v1 release** (`v0.3.0`). Core workflows — server deployment, live consoles, file management, backups/restores, game modules, multi-cluster management, and RBAC — work end-to-end and are verified by automated unit, integration, upgrade, and end-to-end test suites on every commit.
+Gameplane is a **pre-v1 release** (`v0.4.0`). Core workflows — server deployment, live consoles, file management, backups/restores, game modules, multi-cluster management, and RBAC — work end-to-end and are verified by automated unit, integration, upgrade, and end-to-end test suites on every commit.
 
 Here are a few items to keep in mind:
 
@@ -66,7 +66,7 @@ and Agones (a Kubernetes operator library). While not direct competitors,
 Agones is included as a reference point for teams building on Kubernetes
 primitives.
 
-Status: **pre-v1 release** (`v0.3.0`). The operator, API, agent, and dashboard
+Status: **pre-v1 release** (`v0.4.0`). The operator, API, agent, and dashboard
 are feature-complete for the v1 scope and stabilized for external testing.
 
 | Dimension | Gameplane | Pterodactyl | CubeCoders AMP | Agones |

@@ -1,6 +1,6 @@
 # agent — Specification
 
-**Status:** pre-v1 (v0.3.0)  
+**Status:** pre-v1 (v0.4.0)  
 **Module / package:** `github.com/GameplanePanel/gameplane/agent`
 
 ## Purpose

@@ -1,6 +1,6 @@
 # api — Specification
 
-**Status:** pre-v1 (v0.3.0)  
+**Status:** pre-v1 (v0.4.0)  
 **Module / package:** github.com/GameplanePanel/gameplane/api
 
 ## Purpose

@@ -1,6 +1,6 @@
 # audit-syslog-bridge — Specification
 
-**Status:** pre-v1 (v0.3.0)  
+**Status:** pre-v1 (v0.4.0)  
 **Module / package:** `github.com/GameplanePanel/gameplane/audit-syslog-bridge`
 
 ## Purpose

@@ -1,6 +1,6 @@
 # capture-sidecar — Specification
 
-**Status:** pre-v1 (v0.3.0), Phase 2 Foundational (implementation complete)  
+**Status:** pre-v1 (v0.4.0), Phase 2 Foundational (implementation complete)  
 **Module / command:** `github.com/GameplanePanel/gameplane/capture-sidecar`  
 **Dependencies (current):** stdlib + external libraries for packet capture and filtering (github.com/gopacket/gopacket v1.7.2, github.com/packetcap/go-pcap, golang.org/x/net)
 

@@ -2,8 +2,8 @@ apiVersion: v2
 name: gameplane
 description: Kubernetes-native game server control panel (open-source alternative to CubeCoders AMP).
 type: application
-version: 0.3.0
-appVersion: "0.3.0"
+version: 0.4.0
+appVersion: "0.4.0"
 home: https://github.com/GameplanePanel/gameplane
 sources:
   - https://github.com/GameplanePanel/gameplane
@@ -19,5 +19,5 @@ dependencies:
   # Vendored locally so installs never fetch another chart. Helm resolves this
   # condition before installing native CRDs, including on a fresh cluster.
   - name: gameplane-crds
-    version: 0.3.0
+    version: 0.4.0
     condition: operator.enabled
@@ -2,4 +2,4 @@ apiVersion: v2
 name: gameplane-crds
 description: Native CRDs bundled with the Gameplane operator.
 type: application
-version: 0.3.0
+version: 0.4.0
@@ -786,7 +786,7 @@ defaultModuleSource:
     # own cluster). Bump this ref only in lockstep with a chart release that
     # was actually tested against the matching module-repo tag. Set to
     # "main" explicitly if you want the bleeding edge instead.
-    ref: v0.3.0
+    ref: v0.4.0
     subPath: ""           # module directories live at the repo root
   oci:
     url: ghcr.io/gameplanepanel/gameplane-modules

@@ -26,11 +26,11 @@ to find call sites (or `go mod why -m <path>` from inside the module). For
 Toolchain versions come from `Makefile`, `.github/workflows/*.yaml`, and
 `.devcontainer/versions.toml` (dev container pins; `.devcontainer/setup.sh` installs them).
 
-Accurate as of **2026-09-02**, repo state `v0.3.0`; the `gameproto`,
+Accurate as of **2026-09-02**, repo state `v0.3.0`; the `gameproto`, <!-- doc-versions: historical -->
 `svcutil`, `sentinel`, `capture-sidecar`, `tunnel`, and `gp-module` sections
 were added and verified on **2026-09-26**.
 
-> **Note:** The dependency versions listed in the table below reflect the state at v0.3.0. For the most current versions, refer to [CHANGELOG.md](../CHANGELOG.md).
+> **Note:** The dependency versions listed in the table below reflect the state at v0.3.0. For the most current versions, refer to [CHANGELOG.md](../CHANGELOG.md). <!-- doc-versions: historical -->
 
 ## At a glance
 
@@ -334,7 +334,7 @@ package a game module before publishing it. Direct deps from
 ### web
 
 React 18 + TypeScript strict + Vite dashboard (`web/package.json` version
-`0.3.0`, matching the repo version):
+`0.4.0`, matching the repo version):
 
 **Framework / core**
 - `react` `^19.2.8`, `react-dom` `^19.2.8` — base UI framework, rendered via `createRoot` in `src/main.tsx`, used throughout every component.

@@ -16,7 +16,7 @@ installation, with an operator and a local game cluster.
 
 The chart and its images are published to the GitHub Container Registry (GHCR)
 as OCI artifacts — no `helm repo add` needed. Install a tagged release straight
-from the registry (replace `<version>` with a release, e.g. `0.3.0`):
+from the registry (replace `<version>` with a release, e.g. `0.4.0`):
 
 ```sh
 helm upgrade --install gameplane oci://ghcr.io/gameplanepanel/charts/gameplane \
@@ -166,7 +166,7 @@ Top-level knobs (see `values.yaml` for the full list):
   `--config-init-image` / `--restic-image` flags, mirroring `operator.agentImage`
 - `operator.backupJobBackoffLimit` / `operator.backupJobActiveDeadlineSeconds` — retry limit (default `2`, must be >= 0) and wall-clock deadline in seconds (default `86400`, must be > 0) for the restic backup/restore Jobs. They map to the operator's `--backup-job-backoff-limit` / `--backup-job-active-deadline-seconds` flags. Negative or non-integer values fail the render; an unset key (e.g. `helm upgrade --reuse-values` from an older release) or a `0` deadline uses the default, while an explicit `0` backoff is honoured.
 - `operator.gameDataStorage.storageClassName` — install-time default storage class
-  for game server data volumes (since v0.3.0) (default `""`). Empty string uses the cluster's
+  for game server data volumes (since v0.3.0) (default `""`). Empty string uses the cluster's <!-- doc-versions: historical -->
   default StorageClass. Applies to all GameServers where neither the GameTemplate
   nor GameServer-level override specifies a class. **Precedence**: GameServer
   override > GameTemplate default > install-time default > cluster default.
@@ -188,7 +188,7 @@ Top-level knobs (see `values.yaml` for the full list):
   - Core connection: `issuer` / `clientID` / `clientSecretRef` / `redirectURL` /
     `displayName` — OIDC provider credentials and endpoints. Per-IdP walkthroughs
     (Keycloak, Authentik, Google) live in [oidc.md](oidc.md)
-  - Role mapping (new, seeded at install time) (since v0.3.0):
+  - Role mapping (new, seeded at install time) (since v0.3.0): <!-- doc-versions: historical -->
     - `groupsClaim` — OIDC claim name containing group memberships (default `""`).
       Typically `"groups"` or `"roles"` depending on your IdP. Empty/omitted =
       read the `"groups"` claim. This only chooses which claim is read; it does

@@ -18,7 +18,7 @@ Fill in:
 
 The callback URL is automatically set to `{External URL}/auth/oidc/{provider-name}/callback`.
 
-**Note**: The Helm-flag single OIDC provider supports group→role mapping via Helm values `api.oidc.groupsClaim` and `api.oidc.roleMappings.{admin,operator,viewer}` (or CLI flags `--oidc-groups-claim` and `--oidc-role-mapping-{admin,operator,viewer}`) (since v0.3.0). See "Role Mapping at Install Time (No Bootstrap-Admin Required)" below for setup details and worked examples.
+**Note**: The Helm-flag single OIDC provider supports group→role mapping via Helm values `api.oidc.groupsClaim` and `api.oidc.roleMappings.{admin,operator,viewer}` (or CLI flags `--oidc-groups-claim` and `--oidc-role-mapping-{admin,operator,viewer}`) (since v0.3.0). See "Role Mapping at Install Time (No Bootstrap-Admin Required)" below for setup details and worked examples. <!-- doc-versions: historical -->
 
 ## Provider guides
 

@@ -1,4 +1,4 @@
-# Unreleased operational changes
+# v0.4.0 operational changes
 
 ## Auxiliary resource requests and management placement (#724)
 

@@ -2,21 +2,21 @@
 
 ## Current release
 
-- **Version:** `v0.3.0` (pre-v1), released 2026-10-05. See the [changelog](../CHANGELOG.md).
-- **Status as of 2026-10-14:** The CRDs, operator, API, agent, and dashboard are
+- **Version:** `v0.4.0` (pre-v1), released 2026-11-10. See the [changelog](../CHANGELOG.md).
+- **Status as of 2026-11-10:** The CRDs, operator, API, agent, and dashboard are
   feature-complete for the v1 scope and stabilized for external testing, but the
   project is not yet recommended for unattended production. This page tracks what
-  stands between v0.3 and a v1 GA release.
+  stands between v0.4 and a v1 GA release.
 - **What works today:** see [`README.md`](../README.md) and [`architecture.md`](architecture.md).
 
 It is a living document: items move out of it as they ship, and anything
 discovered along the way gets added.
 
 ---
 
-## Shipped in v0.3.0 and since
+## Shipped releases
 
-### Since v0.3.0 (Unreleased)
+### Shipped in v0.4.0
 
 - Independent central panel: Docker Compose runs the API and dashboard without a host Kubernetes cluster; a standalone Helm profile runs without the central operator or workloads ([changelog](../CHANGELOG.md)).
 - Credential maintenance: standalone key custody, offline `rotate-panel-key`, `PUT /clusters/{name}/kubeconfig`, and `PUT`/`DELETE /clusters/{name}/gateway` ([changelog](../CHANGELOG.md)).
@@ -34,7 +34,7 @@ discovered along the way gets added.
 - Breaking: selected-cluster module and template grants need a cluster-wide grant for remote catalogs ([changelog](../CHANGELOG.md)).
 - Feature catalog: [FEATURES.md](../FEATURES.md) lists every capability with its maturity and default, mirrored on the website and kept in step by `make check-features-sync` (spec 024, PR #703).
 
-### Shipped in v0.3.0
+### Shipped in v0.3.0 <!-- doc-versions: historical -->
 
 - Configurable backup/restore Job retry limit and deadline Helm values ([changelog](../CHANGELOG.md)).
 - Multicluster gateways and unified server management across clusters ([changelog](../CHANGELOG.md)).
@@ -57,7 +57,7 @@ discovered along the way gets added.
 - Multi-cluster request scoping, OIDC role re-evaluation, bootstrap-admin reset, cluster registration removal, mod bundle integrity, and tunnel credential handling hardened ([changelog](../CHANGELOG.md)).
 - Upgrade note: every game pod gains an empty capture `emptyDir`, so existing GameServers roll once on upgrade ([changelog](../CHANGELOG.md)).
 
-### Earlier releases (before v0.3.0)
+### Earlier releases (before v0.3.0) <!-- doc-versions: historical -->
 
 #### Multi-cluster: dashboard cluster selector (PR #107) (shipped v0.2.0-beta.6) <!-- doc-versions: historical -->