Adding playit.gg Public Access to Your Minecraft Kubernetes Server

Overview

This article adds playit.gg tunnels to your Minecraft server for public access. Friends can connect directly using a public address without needing to install Tailscale or any VPN software on their devices.

Before You Begin

Prerequisites

• Minecraft Paper Server completed

Create playit.gg Account

playit.gg¹ provides free tunnels for game servers. Minecraft Java is specifically supported on the free tier.

1. Go to playit.gg and create an account
2. Navigate to Agents → Add Agent
3. Copy the secret key (you'll need this for the Kubernetes secret)

Add playit.gg Manifests

Secret

k8s/apps/minecraft/secret.sops.yaml (before encryption):

---
apiVersion: v1
kind: Secret
metadata:
  name: playit-secret
  namespace: minecraft
type: Opaque
stringData:
  secret-key: <your-secret-key>

Encrypt:

sops --encrypt --in-place k8s/apps/minecraft/secret.sops.yaml

HelmRelease (Sidecar)

Add postRenderers to k8s/apps/minecraft/helmrelease.yaml under the spec: section:

spec:
  # ... existing chart, values sections ...
  postRenderers:
    - kustomize:
        patches:
          - target:
              kind: Deployment
              name: minecraft
            patch: |
              - op: add
                path: /spec/template/spec/containers/-
                value:
                  name: playit-agent
                  image: ghcr.io/playit-cloud/playit-agent:latest
                  env:
                    - name: SECRET_KEY
                      valueFrom:
                        secretKeyRef:
                          name: playit-secret
                          key: secret-key

Kustomization (Update)

Add the secret to k8s/apps/minecraft/kustomization.yaml:

---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - namespace.yaml
  - pvc.yaml
  - secret.sops.yaml
  - helmrelease.yaml

Deploy playit.gg

Commit Changes

git add k8s/apps/minecraft/
git commit -m "feat(minecraft): add playit.gg for public access"
git push

Reconcile Flux

flux reconcile source git flux-system && flux reconcile kustomization sync

Verify playit.gg

Agent Status

After the pod restarts with the sidecar (2/2 containers), verify the agent is connected:

kubectl get pods -n minecraft
kubectl logs -n minecraft -l app=minecraft -c playit-agent

You should see "tunnel running" - the agent authenticates automatically using the SECRET_KEY.

Tunnel Configuration

1. Go to your agent page in playit.gg (same page where you got the secret key)
2. Add new tunnel:
   • Protocol: TCP (Minecraft Java uses TCP)
   • Local Address: 127.0.0.1
   • Local Port: 25565
3. Save and note your public address (format: xx.ip.gl.ply.gg:xxxxx)

Public Access

Give friends your playit.gg address. They connect directly in Minecraft - no Tailscale needed.

Next Steps

With public access configured, import an existing world or add Bedrock support.

See: Minecraft Import Existing World

Resources