Common issues running Palworld with this operator (or the Compose path).
Meaning: the Steam client and the dedicated server are on different builds. Palworld rejects the join. After 1.0 patches this is almost always server behind (Steam auto-updates the client; the dedicated image does not).
Confirm server version (REST is cluster-internal by default — port-forward):
kubectl -n game-servers port-forward deploy/palworld-server 8212:8212 &
ADMIN=$(kubectl get secret palworld-server-secrets -n game-servers \
-o jsonpath='{.data.admin-password}' | base64 -d)
curl -s -u "admin:${ADMIN}" http://127.0.0.1:8212/v1/api/info | jq '{version,worldguid,servername,days}'Fix (operator / official image): bump spec.serverImage to a current Pocketpair tag from the GHCR package. Prefer an explicit version tag over a stale node-cached latest.
# Example — use the newest published tag that matches the client
kubectl -n game-servers patch palworldserver palworld-server --type=merge \
-p '{"spec":{"serverImage":"ghcr.io/pocketpairjp/palserver:v1.0.4.102642","imagePullPolicy":"Always"}}'Or enable opt-in auto-update (spec.update.autoUpdateImage: true) so the operator polls GHCR and pins the newest vX.Y.Z.W tag when safe (world pin learned, optional maintenance cron, prefer empty server). Status shows runningVersion, latestAvailableVersion, updateAvailable.
Wait for Ready, then re-check REST version. After a manual roll you can set imagePullPolicy back to IfNotPresent if you pin a digest/tag.
Players: update Palworld via Steam (or your storefront) so the client matches the server. A 1.0.x client needs a matching dedicated build.
Live incident note (prd-apps, Jul 2026): last confirmed REST version was v1.0.0.100427 on image ghcr.io/pocketpairjp/palserver:latest (@sha256:3a36c93e…). Newest published tag was v1.0.1.100619 (same digest as latest on GHCR). Clients on the newer Steam build hit “incapable version” until the CR was bumped / the node pulled the new digest.
Details: PALWORLD_SERVER.md — Updating.
The world has a join password (ServerPassword). Direct connect needs Enter password checked with the server-password Secret value — not the admin password.
kubectl get secret palworld-server-secrets -n game-servers \
-o jsonpath='{.data.server-password}' | base64 -d; echoCredentials come from bring-your-own Secret refs or spec.generateSecrets: true (operator creates {cr-name}-secrets). Full join flow: CONNECT.md.
Admins share status.connectionAddress:status.connectionPort (default 8211 UDP). In Palworld: Join Multiplayer Game → direct-connect IP:PORT → optional join password → Connect.
Step-by-step: CONNECT.md. Landing-page summary: site § Connect.
Palworld loads the world named by DedicatedServerName in GameUserSettings.ini (folder under SaveGames/0/). The operator learns REST worldguid into status.dedicatedServerName and seeds GameUserSettings.ini on the Saved PVC (alongside PalWorldSettings.ini) so Recreate / auto-update rolls keep the world. You can also set spec.dedicatedServerName explicitly (recommended for GitOps).
After any roll, confirm REST worldguid still matches the intended save folder.
See PALWORLD_SERVER.md — World selection.
The seed-settings init overwrites PalWorldSettings.ini on the Saved PVC from the operator ConfigMap every start. Edits made only inside the PVC (or via REST) do not stick across rolls.
Put lasting gameplay settings in spec.optionSettings — a passthrough map of PalWorldSettings.ini OptionSettings keys (Pocketpair’s list is the source of truth). Management keys (ServerName, passwords, ports, RCON/REST, CrossplayPlatforms) come from dedicated CR fields and override the same keys in the map.
spec:
optionSettings:
bExistPlayerAfterLogout: "True"
WorkSpeedRate: "1.5"Apply with a merge-patch (so other spec fields stay), wait for the ConfigMap, then roll the game Deployment so seed-settings re-copies the INI onto the PVC. The world save stays intact — do not delete the CR/PVC; keep dedicatedServerName / worldguid. Players disconnect briefly during the roll.
Yes for community .pak files. Palworld Server does load community pak files. Only .pak is supported. Official Workshop, PalModSettings.ini, -workshopdir, UE4SS, Lua, and Win64 DLLs are not supported. Both the client and the server must have the mod installed. Mods typically align to PC players. If Crossplay is enabled, console players may fail to connect if unsupported mods are enabled on the server.
This operator defaults to Linux ghcr.io/pocketpairjp/palserver. Pocketpair mods (Mods/, PalModSettings.ini, -workshopdir) remain unsupported on Linux PalServer. The official tree has no Mods/ dir; the saves PVC is /pal/Package/Pal/Saved only.
| Kind | Official Linux PalServer |
|---|---|
Workshop (Mods/, PalModSettings.ini, -workshopdir) |
Not supported. Opt-in PVC still mounts /pal/Package/Mods (forward-looking Pocketpair path). |
.pak |
Yes — Palworld Server does load community pak files (version-matched). Overlay is Paks/~WorkshopMods and Paks/LogicMods only — never the whole Paks/ dir (would hide Pal-LinuxServer.pak). |
| UE4SS / Lua / Win64 | Not supported. |
| Client mods | spec.optionSettings.bAllowClientMod is join policy only — does not install mods on the server. Consoles cannot load PC client mods. |
| Config / balance | Use spec.optionSettings → PalWorldSettings.ini, not the mods PVC. |
spec.mods.enabled: true creates {name}-mods and (by default) those Paks subpath overlays. Enabling rolls the game pod; leave it off on a live world unless you accept the Recreate. Back up the saves PVC and pin spec.serverImage first — a bad PAK can stop the server from starting.
Copy files with a short-lived pod (see PALWORLD_SERVER.md — Mods), or enable the optional Server Manager (spec.serverManager.enabled; spec.modManager is a deprecated alias) — HTTPS UI on https://<spec.serverManager.hostname>/ with basic auth (admin + admin-password). Overview/Controls/Updates/Saves/Settings work without mods; the Mods tab needs spec.mods.enabled and defaults to paks/~WorkshopMods. Restart defaults to save-then-Recreate. Save zip download/restore lives on the Saves tab. Settings apply profile + optionSettings then Recreate; credential rotate is one Secret key at a time. Optional activeModList seeds PalModSettings.ini (unsupported on Linux today). -workshopdir stays off unless useWorkshopDirArg: true.
| Image | How updates land |
|---|---|
Official ghcr.io/pocketpairjp/palserver (operator default) |
Bump spec.serverImage tag, or opt in with spec.update.autoUpdateImage. No SteamCMD on boot. |
| Community SteamCMD images | In-container app_update / UPDATE_ON_BOOT (spec.updateOnBoot); auto-update image bumps are skipped unless the image is from spec.update.imageRepository. |
Auto-update is off by default. When enabled it lists GHCR tags anonymously, compares vX.Y.Z.W, defers the image roll while players are online (onlyWhenEmpty), optional cron windows (checkSchedule / applySchedule, timezone default UTC), and optional staged in-game warns via REST POST /v1/api/announce (notifyPlayers + notifySchedule, default 60m→10s; legacy notifyLeadTime = single stage). Warnings still fire while players are online. Pocketpair has deprecated RCON (docs); this operator uses REST announce + admin basic auth and does not issue RCON commands.
Full table: PALWORLD_SERVER.md — Updating.
No. Pocketpair documents RCON as deprecated (v1.0.3; scheduled to stop in an upcoming update). Use the REST API instead. Documented admin endpoints are POST /v1/api/save and POST /v1/api/shutdown. Intro page URL is /api/rest-api/palwold-rest-api (official typo; spelled-correct 404s). Auth is HTTP basic, user admin, password = AdminPassword.
This operator already uses REST POST /v1/api/announce and admin basic auth. It does not issue RCON commands. Pods still stop with SIGTERM + terminationGracePeriodSeconds (REST save before Recreate is optional later). spec.rcon stays ClusterIP default-on as a legacy listener until Pocketpair removes it.
| Path | When |
|---|---|
| Docker Compose | Gaming PC / laptop, no cluster — LOCAL.md, make compose-up |
| Operator | Shared Kubernetes, Envoy Gateway, PVC, CRDs — README |
Same official Pocketpair image either way. Compose also runs a local Server Manager on
http://127.0.0.1:8088 (REST + Mods). The Updates tab, Settings CR apply, credential
rotate, and Recreate restart need Kubernetes and return 4xx/503 locally.
Palworld dedicated is heavy. Brief sizing hints:
- Prefer a dedicated worker (avoid control-plane / busy game nodes such as Windrose’s).
- Sample CR aims at ~8 Gi nodes: ~3 Gi request / 6 Gi limit, multi-core CPU,
multithreading: true. Raise memory if OOM; keepmaxPlayersmodest. - Compose path: ~8 Gi free RAM recommended; default mem cap
6g— raise if the container is killed. - After a move or restart, confirm you’re still on the intended world (
worldguid) so “empty/glitchy” isn’t actually a fresh save.
More: PALWORLD_SERVER.md resources section, LOCAL.md.
- CONNECT.md — join from the client
- PALWORLD_SERVER.md — ports, REST vs deprecated RCON, mounts, optionSettings, Linux vs Windows mods, optional Server Manager, updates, world pin, crossplay
- Official configuration parameters — PalWorldSettings.ini OptionSettings
- LOCAL.md — Compose on a PC
- ARCHITECTURE.md — owned resources / Gateway