Skip to content

fix(tunnel): isolate frp identities and report relay connection health - #768

Open
Baylem wants to merge 16 commits into
GameplanePanel:masterfrom
Baylem:fix/audit-relay-health
Open

Baylem wants to merge 16 commits into
GameplanePanel:masterfrom
Baylem:fix/audit-relay-health

Conversation

@Baylem

@Baylem Baylem commented Oct 21, 2026

Copy link
Copy Markdown
Member

Two GameServers using the same template currently collide on frp proxy names, and a live tunnel supervisor can report Ready while the provider is disconnected. This change gives each frp client its GameServer UID identity and makes readiness depend on confirmed relay connection and forward registration.

frp and Playit expose separate liveness, readiness and sanitized status endpoints. Observations expire, child exit clears readiness, and retry escalation resets after one minute of confirmed health. The deterministic capped retry sequence is preserved as requested. Provider Deployments use Recreate so one identity has one active holder, and retain the configurable tunnel resource defaults from #762.

Playit v1.0.10 IPC exposes cached assignments without a connection heartbeat. It therefore reports Unknown after assignment and AwaitingAddress beforehand; it continues running and forwarding without claiming verified connectivity. docs/relay-health.md documents this limitation and the coordinated operator/image upgrade needed for the new frp identity.

Includes #762 (resources), #765 (tsnet forwarding), and #759 (existing web build prerequisite). Review the relay-specific changes after those prerequisites.

Validation: Linux amd64 operator/tunnel builds and compilation of unit, controller/envtest and E2E test sources passed. Required actionlint and offline zizmor passed. Tests run in CI under repository policy. Added a real-frps scenario with two servers, TCP/UDP backend checks, rejected registration, credential failure, replacement and outage/recovery; runtime results are pending CI. No live Playit or tailnet validation is claimed.

Closes #721
Closes #723

Signed-off-by: Baylem <zelathis@gmail.com>
…cement

Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>
@coderabbitai

coderabbitai Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Repository: GameplanePanel/Gameplane/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 9455641c-23c8-46b3-8459-328e51abf8ac
📥 Commits

Reviewing files that changed from the base of the PR and between df1e371 and 8993375.

⛔ Files ignored due to path filters: 3
  • go.work is excluded by !**/*.work
  • go.work.sum is excluded by !**/*.sum
  • tunnel/go.sum is excluded by !**/*.sum
📒 Files selected for processing: 82
  • .github/workflows/ci.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backups.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backupschedules.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_clusters.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gameservers.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gametemplates.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modules.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modulesources.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_networkcaptures.yaml
  • charts/gameplane/charts/gameplane-crds/crds/gameplane.local_restores.yaml
  • charts/gameplane/crd-manifests/gameplane.local_backups.yaml
  • charts/gameplane/crd-manifests/gameplane.local_backupschedules.yaml
  • charts/gameplane/crd-manifests/gameplane.local_clusters.yaml
  • charts/gameplane/crd-manifests/gameplane.local_gameservers.yaml
  • charts/gameplane/crd-manifests/gameplane.local_gametemplates.yaml
  • charts/gameplane/crd-manifests/gameplane.local_modules.yaml
  • charts/gameplane/crd-manifests/gameplane.local_modulesources.yaml
  • charts/gameplane/crd-manifests/gameplane.local_networkcaptures.yaml
  • charts/gameplane/crd-manifests/gameplane.local_restores.yaml
  • charts/gameplane/templates/_helpers.tpl
  • charts/gameplane/templates/api.yaml
  • charts/gameplane/templates/audit-syslog-bridge.yaml
  • charts/gameplane/templates/crd-apply-hook.yaml
  • charts/gameplane/templates/gateway.yaml
  • charts/gameplane/templates/mcp-server.yaml
  • charts/gameplane/templates/operator-strategy-migrate.yaml
  • charts/gameplane/templates/operator.yaml
  • charts/gameplane/templates/poddisruptionbudgets.yaml
  • charts/gameplane/templates/telemetry-receiver.yaml
  • charts/gameplane/templates/validate.yaml
  • charts/gameplane/templates/web.yaml
  • charts/gameplane/values-production.example.yaml
  • charts/gameplane/values.yaml
  • charts/tests/check_workloads.py
  • deploy/kind/e2e.sh
  • docs/production-placement.md
  • docs/relay-health.md
  • docs/release-notes.md
  • docs/tailscale-forwarding-integration.md
  • docs/tunnels.md
  • hack/sync-chart-crds.sh
  • i18n/locales/en/app.json
  • operator/api/v1alpha1/gameserver_types.go
  • operator/cmd/main.go
  • operator/config/crd/gameplane.local_gameservers.yaml
  • operator/hack/condition-ids/main.go
  • operator/internal/controller/auxiliary_resources.go
  • operator/internal/controller/auxiliary_resources_test.go
  • operator/internal/controller/backup_controller.go
  • operator/internal/controller/backup_forget.go
  • operator/internal/controller/gameserver_controller.go
  • operator/internal/controller/gameserver_relay_health_test.go
  • operator/internal/controller/gameserver_sentinel.go
  • operator/internal/controller/gameserver_status.go
  • operator/internal/controller/gameserver_tailscale_test.go
  • operator/internal/controller/gameserver_tunnel.go
  • operator/internal/controller/gameserver_tunnel_envtest_test.go
  • operator/internal/controller/restore_controller.go
  • operator/specs.md
  • specs/done_018-v0-3-release-readiness/OPEN-DECISIONS.md
  • test/e2e/buckets.sh
  • test/e2e/helm_install_e2e_test.go
  • test/e2e/management_placement_e2e_test.go
  • test/e2e/optional_components_e2e_test.go
  • test/e2e/relay_health_e2e_test.go
  • test/e2e/specs.md
  • test/e2e/upgrade_e2e_test.go
  • tunnel/Dockerfile.frp
  • tunnel/Dockerfile.playit
  • tunnel/Dockerfile.tailscale
  • tunnel/go.mod
  • tunnel/main.go
  • tunnel/main_test.go
  • tunnel/playit_reporter.go
  • tunnel/relay_health.go
  • tunnel/relay_health_test.go
  • tunnel/specs.md
  • tunnel/tailscale.go
  • tunnel/tailscale_forward.go
  • tunnel/tailscale_forward_test.go
  • tunnel/tailscale_test.go
  • web/src/routes/CreateServer.tsx
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>
@github-actions github-actions Bot added area: chart Helm chart and deployment area: e2e kind-based end-to-end suite area: operator controller-runtime operator and CRDs area: optional-components sentinel, capture-sidecar, mcp-server, tunnel, audit-syslog-bridge, telemetry-receiver area: shared netguard, gameaction, gameproto, svcutil and other shared packages area: specs spec-kit feature specs and design docs area: web React dashboard type: fix Bug fix labels Oct 21, 2026
Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>
Signed-off-by: Baylem <zelathis@gmail.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: chart Helm chart and deployment area: e2e kind-based end-to-end suite area: operator controller-runtime operator and CRDs area: optional-components sentinel, capture-sidecar, mcp-server, tunnel, audit-syslog-bridge, telemetry-receiver area: shared netguard, gameaction, gameproto, svcutil and other shared packages area: specs spec-kit feature specs and design docs area: web React dashboard type: fix Bug fix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(tunnel): report relay connection health and reserve tunnel resources fix(tunnel): give frp proxies unique identities across GameServers

1 participant