You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
On k3s and kubeadm single-node installs, the kubernetes Service (for example 10.43.0.1) is DNATed to the node's own IP on port 6443. When that IP is public, the default allow-agent-to-apiserver policy blocks it, because it only allows RFC1918 and link-local ranges. Every agent heartbeat then fails with dial tcp 10.43.0.1:443: i/o timeout, and every game server stays at "Starting" (WaitingForAgent). This was found on a homelab node whose apiserver endpoint is a public IPv4.
Change
New helper:gameplane.apiServerEgressPeers in _helpers.tpl renders the to: peers.
An explicit networkPolicies.apiServerCIDRs list wins, unchanged, so strict mode is unaffected.
When the list is unset, it renders the RFC1918 and link-local fallback. It then adds every address the live cluster reports for the kubernetes Service, meaning its spec.clusterIPs and its EndpointSlice endpoint addresses, as /32 or /128. The list is deduplicated.
Both policies use it:allow-agent-to-apiserver and allow-sentinel-to-apiserver.
Offline renders are unchanged:helm template, client dry-run and Argo CD get empty lookups, so they render exactly as before. The existing chart checks and the e2e default-policy test still hold.
Docs:values.yaml, docs/install.md, docs/security.md and CHANGELOG.md are updated. They note that addresses are read at install or upgrade time, and that offline renderers must set the list explicitly when the endpoint is public.
Verification
Helm isn't available in the authoring environment, so CI's chart render checks are the verification.
The diff was reviewed against the brief, including the template whitespace.
When API server CIDRs are not explicitly configured, network policies now automatically allow detected Kubernetes API server addresses in addition to private and link-local ranges. This can help prevent connection timeouts when the API server uses a public address.
You can still specify API server CIDRs to limit the addresses allowed by these policies.
Documentation
Installation and security guidance now explains automatic address detection, its limitations in offline renders, and when to configure CIDRs explicitly.
On k3s and kubeadm single-node installs the kubernetes Service is
DNATed to the node's own IP. When that IP is public, the default
allow-agent-to-apiserver policy (RFC1918 + link-local only) blocks it,
every agent heartbeat times out and servers stay "Starting".
When networkPolicies.apiServerCIDRs is unset, the chart now also allows
the kubernetes Service ClusterIPs and EndpointSlice addresses it looks
up at install/upgrade time (as /32 or /128). Explicit lists and offline
renders are unchanged. Applies to the sentinel's apiserver policy too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Claude <noreply@anthropic.com>
When networkPolicies.apiServerCIDRs is unset, the chart adds detected Kubernetes Service and EndpointSlice addresses to the API server egress peers. The agent and sentinel policies use the shared peer helper. The documentation describes offline rendering and explicit CIDR configuration.
Changes
API server egress peers
Layer / File(s)
Summary
Peer selection and detection charts/gameplane/templates/_helpers.tpl
The helper uses configured CIDRs when present. Otherwise, it combines RFC1918 and link-local ranges with Kubernetes Service ClusterIPs and matching EndpointSlice addresses. It converts detected addresses to /32 or /128 CIDRs and removes duplicates.
Policy wiring and documentation charts/gameplane/templates/networkpolicies.yaml, charts/gameplane/values.yaml, docs/install.md, docs/security.md, changelog/unreleased/930-detect-apiserver-endpoint.md
The agent and sentinel policies use the shared helper. The values and documentation describe endpoint detection, offline rendering behavior, and explicit CIDR configuration. The changelog records the reported heartbeat and server-status symptoms.
Issue 869 concerns broad private and link-local egress destinations. This PR narrows the API server peer list through detected addresses, but does not cover the issue’s wider game-pod egress scope.
Issue 882 concerns Helm lookup behavior during offline rendering. This PR documents that endpoint detection is unavailable in offline renders and that explicit CIDRs can be set.
Possibly related PRs
GameplanePanel/Gameplane#862: Both PRs define apiServerCIDRs behavior and update the NetworkPolicy documentation. Strict mode in that PR requires a non-empty value, while this PR detects endpoints when the value is unset.
GameplanePanel/Gameplane#837: Both PRs define behavior for apiServerCIDRs. That PR requires a non-empty value in strict mode and includes a manual /32 API endpoint configuration.
Pre-merge checks: 4
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title names the primary change: the agent egress policy now allows detected Kubernetes API server endpoints. The changeset adds a shared helper that looks up the kubernetes Service ClusterIPs and …
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the primary change: the agent egress policy now allows detected Kubernetes API server endpoints. The changeset adds a shared helper that looks up the kubernetes Service ClusterIPs and EndpointSlice addresses, and both apiserver policies use it. The title's "agent" wording omits the sentinel policy, which is a minor gap, but the title is still specific and accurate.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Claude <noreply@anthropic.com>
This branch has not been deployed
No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ValgulNecron
added
area: chart
Claude
Summary
On k3s and kubeadm single-node installs, the
kubernetesService (for example10.43.0.1) is DNATed to the node's own IP on port 6443. When that IP is public, the defaultallow-agent-to-apiserverpolicy blocks it, because it only allows RFC1918 and link-local ranges. Every agent heartbeat then fails withdial tcp 10.43.0.1:443: i/o timeout, and every game server stays at "Starting" (WaitingForAgent). This was found on a homelab node whose apiserver endpoint is a public IPv4.Change
gameplane.apiServerEgressPeersin_helpers.tplrenders theto:peers.networkPolicies.apiServerCIDRslist wins, unchanged, so strict mode is unaffected.kubernetesService, meaning itsspec.clusterIPsand its EndpointSlice endpoint addresses, as/32or/128. The list is deduplicated.allow-agent-to-apiserverandallow-sentinel-to-apiserver.helm template, client dry-run and Argo CD get empty lookups, so they render exactly as before. The existing chart checks and the e2e default-policy test still hold.values.yaml,docs/install.md,docs/security.mdandCHANGELOG.mdare updated. They note that addresses are read at install or upgrade time, and that offline renderers must set the list explicitly when the endpoint is public.Verification
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation