From 7ba6ebcab721130004c4618e76a5fb3eae6acbd8 Mon Sep 17 00:00:00 2001 From: Hendrik Brombeer Date: Thu, 13 Aug 2026 19:35:03 +0200 Subject: [PATCH] feat(grounds-velocity): mount the floodgate key for a bedrock proxy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Floodgate is what lets an online-mode proxy accept a player who has an Xbox Live account and no Mojang one: Geyser signs the Bedrock player's data with a shared key and Floodgate verifies the signature. Both sides have to see byte-identical keys, so the Secret is referenced and never generated — the same reason velocity-forwarding-secret is provisioned out of band. Mounted somewhere neutral rather than onto plugins/floodgate. Floodgate also creates a config.yml in its data directory on first start, and a read-only mount there stops the plugin initialising — the same trap Geyser has with its own config, found by running the image rather than rendering it. The velocity image's start.sh copies the key in from FLOODGATE_KEY_FILE. Off by default and inert when off: no env, no volume, no mount, so nothing changes for a proxy that has no Bedrock players. Enabling it also means setting VELOCITY_FORCE_KEY_AUTHENTICATION=false, which is not something to do on a proxy serving Java players — hence a separate release for Bedrock rather than a flag on the shared ones. --- .../templates/deployment.yaml | 20 ++++++++++++++++ charts/grounds-velocity/values.yaml | 23 +++++++++++++++++++ 2 files changed, 43 insertions(+) diff --git a/charts/grounds-velocity/templates/deployment.yaml b/charts/grounds-velocity/templates/deployment.yaml index 9d74ef4..caeed5b 100644 --- a/charts/grounds-velocity/templates/deployment.yaml +++ b/charts/grounds-velocity/templates/deployment.yaml @@ -159,6 +159,13 @@ spec: - name: PERMISSIONS_TOKEN_FILE value: {{ .Values.permissions.token.mountPath | quote }} {{- end }} + {{- if .Values.floodgateKey.enabled }} + # start.sh copies this into the plugin's data directory. It is not + # mounted there directly because Floodgate creates a config.yml in + # that directory on first start, which a read-only mount prevents. + - name: FLOODGATE_KEY_FILE + value: {{ printf "%s/%s" .Values.floodgateKey.mountPath .Values.floodgateKey.key | quote }} + {{- end }} # Readiness gates the rollout: with maxUnavailable 0 the old pod is # only terminated once the new one accepts Minecraft connections. readinessProbe: @@ -211,7 +218,20 @@ spec: mountPath: {{ $permissionsTokenDirectory }} readOnly: true {{- end }} + {{- if .Values.floodgateKey.enabled }} + - name: floodgate-key + mountPath: {{ .Values.floodgateKey.mountPath }} + readOnly: true + {{- end }} volumes: + {{- if .Values.floodgateKey.enabled }} + - name: floodgate-key + secret: + secretName: {{ .Values.floodgateKey.secretName }} + items: + - key: {{ .Values.floodgateKey.key }} + path: {{ .Values.floodgateKey.key }} + {{- end }} {{- with .Values.plugins }} - name: plugins emptyDir: {} diff --git a/charts/grounds-velocity/values.yaml b/charts/grounds-velocity/values.yaml index e2b8b20..cba9818 100644 --- a/charts/grounds-velocity/values.yaml +++ b/charts/grounds-velocity/values.yaml @@ -107,6 +107,29 @@ forwardingSecret: name: "velocity-forwarding-secret" key: "secret" +# The Floodgate key, for a proxy that admits Bedrock players. +# +# Floodgate is what lets an online-mode proxy accept a player who has an Xbox +# Live account and no Mojang one: Geyser signs the player data with this key and +# Floodgate verifies the signature. Both sides must see byte-identical keys, so +# it is referenced and never generated — the same reason velocity-forwarding- +# secret is provisioned out-of-band. +# +# Mounted somewhere neutral rather than onto plugins/floodgate, because +# Floodgate also creates a config.yml in that directory on first start and a +# read-only mount there stops the plugin initialising. The image's start.sh +# copies the key in from FLOODGATE_KEY_FILE, which this renders. +# +# Requires a velocity image that reads FLOODGATE_KEY_FILE. Off by default: +# a proxy with no Bedrock players has no use for it, and enabling it also means +# setting VELOCITY_FORCE_KEY_AUTHENTICATION=false, which is not something to do +# on a proxy that serves Java players. +floodgateKey: + enabled: false + secretName: "floodgate-key" + key: "key.pem" + mountPath: /var/run/secrets/floodgate + # Graceful proxy drain. When enabled, the pod's preStop hook calls the drain # endpoint of the baked plugin-agones (loopback only) and waits until the proxy # is empty: lobby players are moved to another proxy right away with a