Adding playit.gg Public Access to Your Minecraft Kubernetes Server

Overview

This article adds playit.gg tunnels to your Minecraft server for public access. Friends can connect directly using a public address without needing to install Tailscale or any VPN software on their devices.

Before You Begin

Prerequisites

• Minecraft Paper Server completed

Create playit.gg Account

playit.gg¹ provides free tunnels for game servers. Minecraft Java is specifically supported on the free tier.

1. Go to playit.gg and create an account
2. Navigate to Agents → Add Agent
3. Copy the secret key (you'll need this for the Kubernetes secret)

Add playit.gg Manifests

Secret

k8s/apps/minecraft/secret.sops.yaml (before encryption):

---
apiVersion: v1
kind: Secret
metadata:
    name: playit-secret
    namespace: minecraft
type: Opaque
stringData:
    secret-key: <your-secret-key>

Encrypt:

sops --encrypt --in-place k8s/apps/minecraft/secret.sops.yaml

HelmRelease (Sidecar)

Add postRenderers to k8s/apps/minecraft/helmrelease.yaml under the spec: section:

spec:
    # ... existing chart, values sections ...
    postRenderers:
        - kustomize:
              patches:
                  - target:
                        kind: Deployment
                        name: minecraft
                    patch: |
                        - op: add
                          path: /spec/template/spec/containers/-
                          value:
                            name: playit-agent
                            image: ghcr.io/playit-cloud/playit-agent:1.0.5
                            args:
                              - "--socket-path"
                              - "/tmp/playitd.sock"
                            env:
                              - name: SECRET_KEY
                                valueFrom:
                                  secretKeyRef:
                                    name: playit-secret
                                    key: secret-key

Kustomization (Update)

Add the secret to k8s/apps/minecraft/kustomization.yaml:

---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
    - namespace.yaml
    - pvc.yaml
    - secret.sops.yaml
    - helmrelease.yaml

Deploy playit.gg

Commit Changes

git add k8s/apps/minecraft/
git commit -m "feat(minecraft): add playit.gg for public access"
git push

Reconcile Flux

flux reconcile source git flux-system && flux reconcile kustomization sync

Verify playit.gg

Agent Status

After the pod restarts with the sidecar (2/2 containers), verify the agent is connected:

kubectl get pods -n minecraft
kubectl logs -n minecraft -l app=minecraft -c playit-agent

You should see "tunnel running" - the agent authenticates automatically using the SECRET_KEY.

Tunnel Configuration

1. Go to your agent page in playit.gg (same page where you got the secret key)
2. Add new tunnel:
   • Protocol: TCP (Minecraft Java uses TCP)
   • Local Address: 127.0.0.1
   • Local Port: 25565
3. Save and note your public address (format: xx.ip.gl.ply.gg:xxxxx)

Public Access

Give friends your playit.gg address. They connect directly in Minecraft - no Tailscale needed.

Next Steps

With public access configured, import an existing world or add Bedrock support.

See: Minecraft Import Existing World

Resources