Skip to content

fix(tunnel): forward advertised TCP and UDP ports through tsnet - #765

Open
Baylem wants to merge 5 commits into
GameplanePanel:masterfrom
Baylem:fix/audit-tailscale-forwarding
Open

Baylem wants to merge 5 commits into
GameplanePanel:masterfrom
Baylem:fix/audit-tailscale-forwarding

Conversation

@Baylem

@Baylem Baylem commented Oct 21, 2026

Copy link
Copy Markdown
Member

The Tailscale relay currently registers a device without forwarding player traffic to the game Service. Embed the official tsnet server and forward each advertised TCP/UDP port to that GameServer's exact backing Service. Unadvertised ports and client-selected destinations are not exposed.

Readiness requires an online authenticated node, the requested tags and exact MagicDNS hostname, and every forwarding listener. The operator withholds Tailscale endpoints until the new deployment and probe are ready. TCP/UDP sessions share a bounded budget, deadlines and shutdown cleanup. Deployment replacement uses Recreate; container restarts retain identity in EmptyDir, while Pod replacement requires a reusable auth key and may require stale-device cleanup as documented.

Pin tsnet v1.102.5 to retain the existing Go1.26 line. The module/workspace minimum is the patched Go1.26.10; tunnel image builders use Go1.27.3. References: upstream module, Go release history, Tailscale bulletin. Operator and tunnel images must be upgraded together because port configuration now includes protocol.

Validation: standalone/workspace tunnel builds, Linux amd64/arm64 builds, operator build and regression-source compilation passed. Tests were not executed locally under repository policy. CI regression sources exercise real local TCP/UDP sockets, peer isolation, limits, expiry, shutdown and status transitions. A documented disposable-tailnet integration procedure covers actual provider ACLs, Service replacement and reauthentication; no live tailnet run is claimed.

Preserve #762's configurable tunnel resources when integrating the overlapping Deployment code. General provider health/backoff and frp identity are handled separately in #721/#723.

Closes #722.

Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>
@coderabbitai

coderabbitai Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Repository: GameplanePanel/Gameplane/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 32c55148-1446-4189-adde-228063d7beb2
📥 Commits

Reviewing files that changed from the base of the PR and between df1e371 and 2d151dd.

⛔ Files ignored due to path filters: 3
  • go.work is excluded by !**/*.work
  • go.work.sum is excluded by !**/*.sum
  • tunnel/go.sum is excluded by !**/*.sum
📒 Files selected for processing: 44
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backups.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backupschedules.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_clusters.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gameservers.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gametemplates.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modules.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modulesources.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_networkcaptures.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_restores.yaml
  • charts/gameplane/crd-manifests/gameplane.local_backups.yaml
  • charts/gameplane/crd-manifests/gameplane.local_backupschedules.yaml
  • charts/gameplane/crd-manifests/gameplane.local_clusters.yaml
  • charts/gameplane/crd-manifests/gameplane.local_gameservers.yaml
  • charts/gameplane/crd-manifests/gameplane.local_gametemplates.yaml
  • charts/gameplane/crd-manifests/gameplane.local_modules.yaml
  • charts/gameplane/crd-manifests/gameplane.local_modulesources.yaml
  • charts/gameplane/crd-manifests/gameplane.local_networkcaptures.yaml
  • charts/gameplane/crd-manifests/gameplane.local_restores.yaml
  • docs/tailscale-forwarding-integration.md
  • docs/tunnels.md
  • hack/sync-chart-crds.sh
  • i18n/locales/en/app.json
  • operator/api/v1alpha1/gameserver_types.go
  • operator/config/crd/gameplane.local_gameservers.yaml
  • operator/hack/condition-ids/main.go
  • operator/internal/controller/gameserver_status.go
  • operator/internal/controller/gameserver_tailscale_test.go
  • operator/internal/controller/gameserver_tunnel.go
  • operator/internal/controller/gameserver_tunnel_envtest_test.go
  • operator/specs.md
  • specs/done_018-v0-3-release-readiness/OPEN-DECISIONS.md
  • test/e2e/helm_install_e2e_test.go
  • tunnel/Dockerfile.frp
  • tunnel/Dockerfile.playit
  • tunnel/Dockerfile.tailscale
  • tunnel/go.mod
  • tunnel/main.go
  • tunnel/main_test.go
  • tunnel/specs.md
  • tunnel/tailscale.go
  • tunnel/tailscale_forward.go
  • tunnel/tailscale_forward_test.go
  • tunnel/tailscale_test.go
  • web/src/routes/CreateServer.tsx
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Signed-off-by: Baylem <zelathis@gmail.com>
@github-actions github-actions Bot added area: chart Helm chart and deployment area: operator controller-runtime operator and CRDs area: optional-components sentinel, capture-sidecar, mcp-server, tunnel, audit-syslog-bridge, telemetry-receiver area: shared netguard, gameaction, gameproto, svcutil and other shared packages area: specs spec-kit feature specs and design docs area: web React dashboard type: fix Bug fix labels Oct 21, 2026
Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: chart Helm chart and deployment area: operator controller-runtime operator and CRDs area: optional-components sentinel, capture-sidecar, mcp-server, tunnel, audit-syslog-bridge, telemetry-receiver area: shared netguard, gameaction, gameproto, svcutil and other shared packages area: specs spec-kit feature specs and design docs area: web React dashboard type: fix Bug fix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(tunnel): complete the Tailscale game forwarding path tracked as F-173

1 participant