[Baylem]

Closes #881. Parent tracker #867.

hack/rollout/canary.py verifies a signed, pinned Module and independently verifies the pinned game image. Preflight checks every GameServer using the dedicated installation. It qualifies a stopped all-data Restic clone, checks a pod-bound client join, save markers and claim UIDs, rehearses compatible or restore-required rollback on the clone, then requalifies it and admits one fleet target at a time. A resourceVersion-protected ConfigMap journals the active target and receipts outside the per-server lifecycle owner. See docs/template-rollouts.md for the four GitOps phases and recovery.

Validation includes decision tests for a failed join, wrong digest, changed UIDs, stale journals and per-target halts. TestGameServer_RestoredRolloutRehearsal uses the real operator, Restic, kubelet and PVCs in Kind. The Kind rehearsal tests an unpullable image and a running HTTP-only candidate that rejects a real Minecraft handshake. It checks that fleet admission halts, exercises compatible and restore-required rollback, verifies primary and extra save markers, and retains a different rebuildable mod file on each server. The runner supports TCP Pod port-forwarding and UDP client joins to the verified Pod IP from an in-cluster or routed runner. The Minecraft bot in #907 exercises a real game join and save on restored data. An entitled game and production signer matrix remains deployment-specific.

The upstream integration base stack/881-backup-and-wake contains #907 (qualified backups/restores) and #904 (join client). Land the prerequisite PRs, retarget this PR to master and rerun CI. No shared cluster was deployed.

Restored rollout qualification on ae14d5ab74b4b386688914f267d46bd1571db534

The Kind rehearsal passed all four cases on ARM64 (543.65s) and AMD64 (479.37s). Independent AMD64 rehearsal The compatible rollback kept the save readable directly. The format-changing rollback used Restic snapshot b63139d0bcf881bf22167bab7d98d562ef8bdb7b0931cfc3fe933c3350a4d282 in Restore 6acaa54e-c9f2-4333-b8ca-43b505e7b5f6, removed the candidate-only format marker, and returned the primary and extra world values. The excluded mod file retained the clone's own clone-package value.

Clone PVC	Before candidate	After candidate and rollback
Primary world	fe45d715-bcca-4cee-9d30-3eda32546320	fe45d715-bcca-4cee-9d30-3eda32546320
Extra world	2e9c6e49-d664-4817-9367-7754dab0aa27	2e9c6e49-d664-4817-9367-7754dab0aa27
Rebuildable mods	32d84e79-8484-446b-b31c-61bf29ba7efb	32d84e79-8484-446b-b31c-61bf29ba7efb

A running HTTP-only candidate served the world marker but failed the real Minecraft handshake. The journal kept only its baseline receipt and blocked promotion. An unpullable candidate also halted the rollout. The untouched fleet member retained its original pod UID throughout. Kind rehearsal and raw receipts · Fleet admission decision tests · Successful real Minecraft join and save on a restored world in the backup parent

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: GameplanePanel/Gameplane
• Branch: feat/881-staged-template-rollouts
• File: .coderabbit.yaml
• Commit: 6c53726
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1af1322b-fcc0-4dbc-ac22-d360755cdca2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

Pre-merge checks: 1 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Title check		This assessment has not completed. The check will be retried on the next pre-merge check run.

Passed checks: 1 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

CI Report - ae14d5a

run 42985674820 - attempt 1

0 failed - 33 passed - 0 skipped - 180m21s elapsed

Test selection: full (selection-rule change) - per-suite table

Coverage

Module	Measured	Gate	Margin
web	L95.82 S94.18 B88.49 F91.73	L92 S92 B82 F76	+2.18

Changed

Area	Files	+/-
hack/	2	+657/-0
test/	4	+248/-0
docs/	1	+82/-2
.github/	1	+21/-0
operator/	1	+5/-0

Slowest jobs

Job	Duration
e2e telemetry / arm64 (kind)	22m42s
e2e restricted-workloads / arm64 (kind)	14m48s
build e2e images	14m31s
e2e web live / amd64 (kind)	14m25s
e2e capture overhead (kind)	12m37s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, backup-preparation, bot-fast, management-placement, monitoring, multicluster, network-isolation, operator, optional-components, postgres-availability, ratelimit, recovery, restricted-workloads, telemetry, upgrade

[ValgulNecron]

Hey, could you please add changelog entry?

[Baylem]

Added the requested unreleased changelog entry.

CI passed on ae14d5ab. The diff through 6c537267 changes only the changelog entry and its index link. I canceled the repeat CI run because this update changes only Markdown.