[Baylem]

Closes #882. Part of #867. This upstream PR continues the earlier offline-render work in #897 and adds a populated upgrade using the Argo CD application controller.

Merge order. Review against #900’s fix/883-884-mode-scoped-rbac branch. #900 depends on #886. After both parents land, retarget this PR to master and recheck its diff and CI. The signed head 9d4ef832 contains current master e3826d8d and #900 at c957d23c. The GitOps patch covers 18 files with 762 additions and 8 deletions. CI on the updated head

Delivery contract. The opt-in native Argo CD profile uses versioned, externally provisioned CA and client Secrets, separate owners for CRDs and workloads, and explicit retention for the games namespace and the chart-managed SQLite claim. It validates the required admission capabilities and rejects configurations in which Helm and Argo would both apply CRDs.

Populated upgrade. The amd64 Kind upgrade job installs a pinned Argo CD core controller and uses a read-only Git mirror of the candidate commit. After #900 exercises the native permission matrix, the fixture hands the seeded installation to separate CRD and workload Applications. It verifies actual prune of a disposable dashboard, retention of the game and API PVCs and CRD identities, validity of stored versions, waker authorization, and reads of the seeded world through a live authenticated agent. It renews the client certificate and then rotates the CA and client together, checking fresh connections after each rollout.

Argo CD v3.6.1 completed the populated upgrade on commit 6a24ee48. The controller reconciled the CRDs and workload, pruned a dashboard, renewed the client and rotated the issuer while retaining both claims and a readable world marker. Identical offline inputs also produced byte-for-byte identical chart output. Live qualification and CI evidence

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: GameplanePanel/Gameplane
• Branch: fix/882-offline-helm
• File: .coderabbit.yaml
• Commit: 9d4ef83
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 348442dd-e54b-40b2-8dcd-30dadfb688d3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

Pre-merge checks: 1 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Title check		This assessment has not completed. The check will be retried on the next pre-merge check run.

Passed checks: 1 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

CI Report - 6a24ee4

run 43003106254 - attempt 1

0 failed - 23 passed - 10 skipped - 158m41s elapsed

Test selection: partial - per-suite table

Coverage

no coverage/* commit statuses found on 6a24ee4

Changed

Area	Files	+/-
test/	5	+527/-6
charts/	8	+134/-0
docs/	2	+52/-0
deploy/	1	+30/-0
.github/	1	+14/-2

Slowest jobs

Job	Duration
e2e telemetry / amd64 (kind)	23m35s
e2e telemetry / arm64 (kind)	22m30s
e2e restricted-workloads / arm64 (kind)	14m30s
e2e restricted-workloads / amd64 (kind)	14m8s
e2e operator / amd64 (kind)	12m46s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, backup-preparation, bot-fast, management-placement, monitoring, multicluster, network-isolation, operator, optional-components, postgres-availability, ratelimit, recovery, restricted-workloads, telemetry, upgrade, wake-hostport

[ValgulNecron]

Hey, could you please add changelog entry?

[Baylem]

Added the requested unreleased changelog entry.

CI passed on 6a24ee48. The diff through 61c645cd changes only the changelog entry and its index link. I canceled the repeat CI run because this update changes only Markdown.