Baylem · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -8,7 +8,7 @@
 			"username": "vscode"
 		},
 		"ghcr.io/devcontainers/features/go:1": {
-			"version": "1.26"
+			"version": "1.27.3"
 		},
 		"ghcr.io/devcontainers/features/node:1": {
 			"version": "24"

diff --git a/.github/actions/go-cache/action.yml b/.github/actions/go-cache/action.yml
@@ -11,7 +11,7 @@ inputs:
   go-version:
     description: Go version to setup
     required: false
-    default: '1.26'
+    default: '1.27'
 
 runs:
   using: composite
@@ -20,7 +20,7 @@ runs:
       id: go
       with:
         go-version: ${{ inputs.go-version }}
-        # Resolve '1.26' to the newest 1.26.x patch instead of the runner's
+        # Resolve '1.27' to the newest 1.27.x patch (at least 1.27.3) instead of the runner's
         # preinstalled one, so stdlib fixes (spec 013 G1, govulncheck) land
         # without a manual pin bump.
         check-latest: true

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -439,7 +439,8 @@ jobs:
     needs: [changes]
     if: (needs.changes.outputs.images == 'true') || contains(fromJSON(needs.changes.outputs.ci-jobs || '[]'), 'build-images')
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    # Include all image builds, cache exports, artifact upload and cleanup.
+    timeout-minutes: 30
     permissions:
       contents: read
     steps:
@@ -1232,6 +1233,8 @@ jobs:
         run: python3 charts/tests/check_gateway.py
       - name: standalone panel isolation and persistence chart renders
         run: python3 charts/tests/check_standalone.py
+      - name: auxiliary resources and management placement chart renders
+        run: python3 charts/tests/check_workloads.py
       - name: sanity-check rendered manifests
         run: |
           grep -q 'kind: Deployment' /tmp/rendered.yaml
@@ -1793,13 +1796,17 @@ jobs:
         # (operator does zero logins and is wait-dominated, so it runs
         # wide; the api buckets stay within the login limiter's budget).
         # The arm64 job below uses the same steps and per-bucket settings.
-        bucket: [operator, api-auth, api-roles, api-rbac, api-agent, api-mods, telemetry, optional-components]
+        bucket: [operator, api-auth, api-roles, api-rbac, api-agent, api-mods, telemetry, optional-components, management-placement]
         arch: [amd64]
         include:
           - bucket: operator
             parallel: 8
             test_timeout: 20m
             job_timeout: 60 # Boots a kind cluster, installs the chart, runs the bucket's suite.
+          - bucket: management-placement
+            parallel: 1
+            test_timeout: 15m
+            job_timeout: 60
           - bucket: api-auth
             parallel: 4
             test_timeout: 15m
@@ -1827,8 +1834,8 @@ jobs:
             job_timeout: 75 # Boots a kind cluster, installs the chart, runs the bucket's suite.
           - bucket: optional-components
             parallel: 1
-            test_timeout: 20m # one lifecycle test: helm upgrade, then mcp, syslog, frp tunnel and core checks in order
-            job_timeout: 60 # Boots a kind cluster, installs the chart, runs the bucket's suite.
+            test_timeout: 35m # lifecycle plus two-GameServer TCP/UDP relay identity, outage and recovery checks
+            job_timeout: 75 # Boots a kind cluster, installs the chart, runs the bucket's suite.
     env:
       CLUSTER: gameplane-e2e
       CTX: kind-gameplane-e2e
@@ -1856,7 +1863,9 @@ jobs:
           arch: ${{ matrix.arch }}
       - name: bring up cluster + helm install
         if: env.RUN_REGEX != '' || env.TAIL_REGEX != ''
-        run: ./deploy/kind/e2e.sh up "$CLUSTER" e2e
+        env:
+          GAMEPLANE_E2E_PROFILE: ${{ matrix.bucket == 'management-placement' && 'management' || 'default' }}
+        run: ./deploy/kind/e2e.sh up "$CLUSTER" e2e "$GAMEPLANE_E2E_PROFILE"
       - name: run go e2e (${{ matrix.bucket }})
         if: env.RUN_REGEX != ''
         run: |
@@ -1934,8 +1943,8 @@ jobs:
             job_timeout: 75 # Boots a kind cluster, installs the chart, runs the bucket's suite.
           - bucket: optional-components
             parallel: 1
-            test_timeout: 20m # one lifecycle test: helm upgrade, then mcp, syslog, frp tunnel and core checks in order
-            job_timeout: 60 # Boots a kind cluster, installs the chart, runs the bucket's suite.
+            test_timeout: 35m # lifecycle plus two-GameServer TCP/UDP relay identity, outage and recovery checks
+            job_timeout: 75 # Boots a kind cluster, installs the chart, runs the bucket's suite.
     env:
       CLUSTER: gameplane-e2e
       CTX: kind-gameplane-e2e
@@ -2660,7 +2669,7 @@ jobs:
               'go-e2e-unit': (n) => n === 'go (test/e2e)',
               'api-postgres': (n) => n === 'api (postgres)',
               'e2e-buckets': (n) => n === 'e2e bucket coverage',
-              'e2e-go': (n) => /^e2e (operator|api-auth|api-roles|api-rbac|api-agent|api-mods|telemetry|optional-components) \//.test(n) && n.includes('/ amd64 '),
+              'e2e-go': (n) => /^e2e (operator|api-auth|api-roles|api-rbac|api-agent|api-mods|telemetry|optional-components|management-placement) \//.test(n) && n.includes('/ amd64 '),
               'e2e-go-arm64': (n) => /^e2e (operator|api-auth|api-roles|api-rbac|api-agent|api-mods|telemetry|optional-components) \//.test(n) && n.includes('/ arm64 '),
               'e2e-multicluster': (n) => n.startsWith('e2e multicluster /') && n.includes('/ amd64 '),
               'e2e-multicluster-arm64': (n) => n.startsWith('e2e multicluster /') && n.includes('/ arm64 '),
@@ -2813,7 +2822,7 @@ jobs:
             const bucketSet = new Set();
             for (const j of apiJobs) {
               const n = j.name || '';
-              const m = n.match(/^e2e (operator|api-auth|api-roles|api-rbac|api-agent|api-mods|telemetry|optional-components) \//);
+              const m = n.match(/^e2e (operator|api-auth|api-roles|api-rbac|api-agent|api-mods|telemetry|optional-components|management-placement) \//);
               if (m) bucketSet.add(m[1]);
               if (/^e2e multicluster \//.test(n)) bucketSet.add('multicluster');
               if (/^e2e upgrade \//.test(n)) bucketSet.add('upgrade');

diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backups.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backups.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: backups.gameplane.local
 spec:
   group: gameplane.local

diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backupschedules.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_backupschedules.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: backupschedules.gameplane.local
 spec:
   group: gameplane.local

diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_clusters.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_clusters.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: clusters.gameplane.local
 spec:
   group: gameplane.local

diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gameservers.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gameservers.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: gameservers.gameplane.local
 spec:
   group: gameplane.local
@@ -1546,15 +1546,12 @@ spec:
                           tags:
                             description: |-
                               Tags are Tailscale ACL tags requested for the device when it
-                              registers, via `tailscale up --advertise-tags` (tailscaled's
-                              declarative config has no field for tags, and changing the tags of a
-                              registered node needs a fresh login). Each entry is "tag:<name>" or a bare
-                              name, which gets the "tag:" prefix. The tailnet ACL must grant
-                              tagOwners for these tags to the auth key's owner; if the request is
-                              refused, the tunnel pod logs the error and the tunnel runs untagged.
-                              If any entry is invalid, the whole list is logged and ignored and the
-                              device registers untagged. See
-                              tunnel/specs.md.
+                              registers through embedded tsnet. Each entry is "tag:<name>" or a
+                              bare name, which gets the "tag:" prefix. The tailnet policy must grant
+                              tagOwners to the auth key's owner. Invalid or refused tags keep the
+                              tunnel not ready; it never silently registers without requested tags.
+                              Changing tags replaces the Pod and requires a reusable auth key.
+                              See tunnel/specs.md for identity persistence and registration details.
                             items:
                               type: string
                             maxItems: 8

diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gametemplates.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_gametemplates.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: gametemplates.gameplane.local
 spec:
   group: gameplane.local

diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modules.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modules.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: modules.gameplane.local
 spec:
   group: gameplane.local

diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modulesources.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_modulesources.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: modulesources.gameplane.local
 spec:
   group: gameplane.local

diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_networkcaptures.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_networkcaptures.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: networkcaptures.gameplane.local
 spec:
   group: gameplane.local
@@ -209,22 +209,15 @@ spec:
                 format: int64
                 type: integer
               phase:
-                allOf:
-                - enum:
-                  - Pending
-                  - Running
-                  - Completed
-                  - Failed
-                  - Expired
-                - enum:
-                  - Pending
-                  - Running
-                  - Completed
-                  - Failed
-                  - Expired
                 description: |-
                   Phase is the current lifecycle phase of the capture.
                   Valid values: Pending, Running, Completed, Failed, Expired.
+                enum:
+                - Pending
+                - Running
+                - Completed
+                - Failed
+                - Expired
                 type: string
               startTime:
                 description: |-

diff --git a/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_restores.yaml b/charts/gameplane/charts/gameplane-crds/crds/gameplane.local_restores.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: restores.gameplane.local
 spec:
   group: gameplane.local

diff --git a/charts/gameplane/crd-manifests/gameplane.local_backups.yaml b/charts/gameplane/crd-manifests/gameplane.local_backups.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: backups.gameplane.local
 spec:
   group: gameplane.local

diff --git a/charts/gameplane/crd-manifests/gameplane.local_backupschedules.yaml b/charts/gameplane/crd-manifests/gameplane.local_backupschedules.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: backupschedules.gameplane.local
 spec:
   group: gameplane.local

diff --git a/charts/gameplane/crd-manifests/gameplane.local_clusters.yaml b/charts/gameplane/crd-manifests/gameplane.local_clusters.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: clusters.gameplane.local
 spec:
   group: gameplane.local

diff --git a/charts/gameplane/crd-manifests/gameplane.local_gameservers.yaml b/charts/gameplane/crd-manifests/gameplane.local_gameservers.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: gameservers.gameplane.local
 spec:
   group: gameplane.local
@@ -1546,15 +1546,12 @@ spec:
                           tags:
                             description: |-
                               Tags are Tailscale ACL tags requested for the device when it
-                              registers, via `tailscale up --advertise-tags` (tailscaled's
-                              declarative config has no field for tags, and changing the tags of a
-                              registered node needs a fresh login). Each entry is "tag:<name>" or a bare
-                              name, which gets the "tag:" prefix. The tailnet ACL must grant
-                              tagOwners for these tags to the auth key's owner; if the request is
-                              refused, the tunnel pod logs the error and the tunnel runs untagged.
-                              If any entry is invalid, the whole list is logged and ignored and the
-                              device registers untagged. See
-                              tunnel/specs.md.
+                              registers through embedded tsnet. Each entry is "tag:<name>" or a
+                              bare name, which gets the "tag:" prefix. The tailnet policy must grant
+                              tagOwners to the auth key's owner. Invalid or refused tags keep the
+                              tunnel not ready; it never silently registers without requested tags.
+                              Changing tags replaces the Pod and requires a reusable auth key.
+                              See tunnel/specs.md for identity persistence and registration details.
                             items:
                               type: string
                             maxItems: 8

diff --git a/charts/gameplane/crd-manifests/gameplane.local_gametemplates.yaml b/charts/gameplane/crd-manifests/gameplane.local_gametemplates.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: gametemplates.gameplane.local
 spec:
   group: gameplane.local

diff --git a/charts/gameplane/crd-manifests/gameplane.local_modules.yaml b/charts/gameplane/crd-manifests/gameplane.local_modules.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: modules.gameplane.local
 spec:
   group: gameplane.local

diff --git a/charts/gameplane/crd-manifests/gameplane.local_modulesources.yaml b/charts/gameplane/crd-manifests/gameplane.local_modulesources.yaml
@@ -3,8 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    gameplane.local/crd-bundle-sha256: 181aeee1d52a9cb178b0f8a8a862dc5959e772facf11817d5e70e5196574cd4c
-    controller-gen.kubebuilder.io/version: v0.20.1
+    gameplane.local/crd-bundle-sha256: afbe99d46e972c35a07f42486a1f8f6ec895c183017a9d2eef67b7ea07824f6b
+    controller-gen.kubebuilder.io/version: v0.22.0
   name: modulesources.gameplane.local
 spec:
   group: gameplane.local