Rcon, spigot, whitelist and some other issues

[talasemico]

Im hosting a kubernetes minecraft server on a cluster media Argocd
im a beginner on the subject and this is my starting project
First off i tried modifing the "whitelist" and "ops" enviroment but its not changing anything, it either ignores the whitelist letting everyone in or doesnt allow anyone in
i dont know what information i can provide to make this useful and to not generate spam im going to wait for an answer, i can provide the yaml files and i can recreate the RCON errors

[talasemico]

minecraft values.yaml

# ref: https://hub.docker.com/r/itzg/minecraft-server/
image:
  repository: itzg/minecraft-server
  tag: latest
  pullPolicy: IfNotPresent
  pullSecret: ""

# ### WARNING ###
# Minecraft is not horizontally scalable, adjusting this will most likely break your setup.
# ### WARNING ###
replicaCount: 1

## Configure resource requests and limits
## ref: http://kubernetes.io/docs/user-guide/compute-resources/
##
resources:
  requests:
    memory: 512Mi
    cpu: 500m

lifecycle:
  postStart: []
  preStop: []

# If true the workload is defined as a StatefulSet instead of a Deployment.
# Make sure to also update the strategyType!
# All configuration options for the Deployment (e.g. annotations) are used for the StatefulSet.
# Regarding persistence: When an existing PVC is provided it will be shared between all Pods.
# Otherwise the PVC configuration is used as a template to create PVCs for each replica.
workloadAsStatefulSet: false

# upgrade strategy type, depending on workload type:
# - for Deployment sets strategy: Recreate or RollingUpdate
# - for StatefulSet sets updateStrategy: OnDelete or RollingUpdate
strategyType: Recreate

nodeSelector: {}

tolerations: []

affinity: {}

podSecurityContext:
  runAsUser: 1000
  runAsGroup: 3000
  runAsNonRoot: true
  fsGroup: 2000
  seccompProfile:
    type: RuntimeDefault

securityContext:
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false

# Most of these map to environment variables. See Minecraft for details:
# https://hub.docker.com/r/itzg/minecraft-server/
livenessProbe:
  command:
    - mc-health
  initialDelaySeconds: 30
  periodSeconds: 5
  failureThreshold: 20
  successThreshold: 1
  timeoutSeconds: 1
readinessProbe:
  exec:
    command: ["/usr/local/bin/mc-monitor", "status", "--host", "localhost"]
  initialDelaySeconds: 20
  periodSeconds: 10
  failureThreshold: 12
  command:
    - mc-health
  initialDelaySeconds: 30
  periodSeconds: 5
  failureThreshold: 20
  successThreshold: 1
  timeoutSeconds: 1
startupProbe:
  command:
    - mc-health
  enabled: false
  failureThreshold: 30
  periodSeconds: 10

# initContainers:
#   - name: do-something
#     image: busybox
#     command: ['do', 'something']
#     volumesMounts:
#       - name: nfs
#         mountPath: /mnt/volume
#         readOnly: true
initContainers: []

# sidecarContainers:
#   - name: do-something
#     image: busybox
#     command: ['do', 'something']
#     volumesMounts:
#       - name: nfs
#         mountPath: /mnt/volume
#         readOnly: true
sidecarContainers: []

# extraVolumes:
#   - volumeMounts:
#       - name: nfs
#         mountPath: /mnt/volume
#         readOnly: true
#     volumes:
#       - name: nfs
#         server: some.nfs.server.com
#         path: /
#         mountOptions:
#           - port=2049
#           - hard
#           - vers=4
extraVolumes: []


## Array of extra objects to deploy with the release
##
# extraDeploy:
#   - |
#     apiVersion: v1
#     kind: ConfigMap
#     metadata:
#       name: {{ template "minecraft.fullname" . }}-extra-cm
#     data:
#       key: |-
#         {
#           "key": "value"
#         }
extraDeploy: []

minecraftServer:
  # This must be overridden, since we can't accept this for the user.
  eula: "TRUE"
  # One of: LATEST, SNAPSHOT, or a specific version (ie: "1.7.9").
  version: "1.20"
  # This can be one of "VANILLA", "FORGE", "SPIGOT", "BUKKIT", "PAPER", "FTBA", "SPONGEVANILLA", "CURSEFORGE"
  type: "VANILLA"
  # If type is set to FORGE, this sets the version; this is ignored if forgeInstallerUrl is set
  forgeVersion:
  # If type is set to SPONGEVANILLA, this sets the version
  spongeVersion:
  # If type is set to FORGE, this sets the URL to download the Forge installer
  forgeInstallerUrl:
  # If type is set to BUKKIT, this sets the URL to download the Bukkit package
  bukkitDownloadUrl:
  # If type is set to SPIGOT, this sets the URL to download the Spigot package
  spigotDownloadUrl:  https://cdn.getbukkit.org/spigot/spigot-1.12.2.jar
  # If type is set to PAPER, this sets the URL to download the PaperSpigot package
  paperDownloadUrl:
  # If type is set to FTBA, this sets the modpack to run
  ftbModpackId:
  # If type is set to FTBA and a modpack is set, this sets the version to run
  ftbModpackVersionId:
  # If type is set to CURSEFORGE, this sets the server mod to run. Can also provide url to curseforge package.
  cfServerMod:
  # Set to true if running Feed The Beast and get an error like "unable to launch forgemodloader"
  ftbLegacyJavaFixer: default
  # One of: peaceful, easy, normal, and hard
  difficulty: hard
  # A comma-separated list of player names to whitelist.
  whitelist:
  # A comma-separated list of player names who should be admins.
  ops:
  # A server icon URL for server listings. Auto-scaled and transcoded.
  icon: 
  # Max connected players.
  maxPlayers: 20
  # This sets the maximum possible size in blocks, expressed as a radius, that the world border can obtain.
  maxWorldSize: 10000
  # Allows players to travel to the Nether.
  allowNether: default
  # Allows server to announce when a player gets an achievement.
  announcePlayerAchievements: default
  # Enables command blocks.
  enableCommandBlock: default
  # If true, players will always join in the default gameMode even if they were previously set to something else.
  forcegameMode: default
  # Defines whether structures (such as villages) will be generated.
  generateStructures: default
  # If set to true, players will be set to spectator mode if they die.
  hardcore: default
  # The maximum height in which building is allowed.
  maxBuildHeight: 256
  # The maximum number of milliseconds a single tick may take before the server watchdog stops the server with the message. -1 disables this entirely.
  maxTickTime: 60000
  # Determines if animals will be able to spawn.
  spawnAnimals: default
  # Determines if monsters will be spawned.
  spawnMonsters: default
  # Determines if villagers will be spawned.
  spawnNPCs: default
  # Sets the area that non-ops can not edit (0 to disable)
  spawnProtection: 16
  # Max view distance (in chunks).
  viewDistance: 10
  # Define this if you want a specific map generation seed.
  levelSeed:
  # One of: creative, survival, adventure, spectator
  gameMode: survival
  # Message of the Day
  motd: "bienvenidos a la grieta del invocador"
  # If true, enable player-vs-player damage.
  pvp: default
  # One of: DEFAULT, FLAT, LARGEBIOMES, AMPLIFIED, CUSTOMIZED
  levelType: DEFAULT
  # When levelType == FLAT or CUSTOMIZED, this can be used to further customize map generation.
  # ref: https://hub.docker.com/r/itzg/minecraft-server/
  generatorSettings:
  worldSaveName: peronia
  # If set, this URL will be downloaded at startup and used as a starting point
  downloadWorldUrl:
  # force re-download of server file
  forceReDownload: false
  # If set, the modpack at this URL will be downloaded at startup
  downloadModpackUrl:
  # If true, old versions of downloaded mods will be replaced with new ones from downloadModpackUrl
  removeOldMods: false
  # A list of VanillaTweaks Share Codes to download. (https://vanillatweaks.net/share#wUq1iz => "wUq1iz")
  vanillaTweaksShareCodes: []
  # Optional URI to a resource pack. The player may choose to use it.
  resourcePackUrl:
  # Optional SHA-1 digest of the resource pack, in lowercase hexadecimal.
  # It is recommended to specify this, because it is used to verify the integrity of the resource pack.
  resourcePackSha:
  # When true, players will be prompted for a response and will be disconnected if they decline the required pack
  resourcePackEnforce: false
  # Check accounts against Minecraft account service.
  onlineMode: false
  # Require public key to be signed by Mojang to join
  enforceSecureProfile: false
  # If you adjust this, you may need to adjust resources.requests above to match.
  memory: 1024M
  # General JVM options to be passed to the Minecraft server invocation
  jvmOpts: ""
  # Options like -X that need to proceed general JVM options
  jvmXXOpts: ""
  # By default, the server configuration will be created and set based on the following environment variables, but only the first time the server is started
  # If you would like to override the server configuration each time the container starts up, you can set this to true
  # see https://github.com/itzg/docker-minecraft-server#server-configuration
  overrideServerProperties: false
  # DEPRECATED: use top-level rconServiceAnnotations instead
  serviceAnnotations: {}
  serviceType: LoadBalancer
  ## Set the port used if the serviceType is NodePort
  nodePort:
  # Set the external port of the service, usefull when using the LoadBalancer service type
  servicePort: 25565
  clusterIP:
  loadBalancerIP:
  # loadBalancerSourceRanges: []
  ## Set the externalTrafficPolicy in the Service to either Cluster or Local
  # externalTrafficPolicy: Cluster
  externalIPs:

  # List with URLs and paths to jar files, additionally may be a directory with jars
  # This works for both mods and plugins depending on server type
  modUrls: []
  pluginUrls: []

  # A list of Spigot resources/plugins IDs to download.
  spigetResources: []

  # Additional service specs to be defined
  extraServiceSpec: {}

  # A list of Modrinth project slugs with optional version after colon
  modrinth:
    projects: []
    # Downloads Modrinth project dependencies marked as optional
    optionalDependencies: false
    # The version type is used to determine the newest version to use from each project. The allowed values are: release, beta, alpha
    allowedVersionType: release

  # Config for AUTO_CURSEFORGE server type
  autoCurseForge:
    # CurseForge API key obtained from developer console
    apiKey:
      key: "CHANGEME!"
      existingSecret: ""
      secretKey: cf-api-key
    # Link to modpack in general or a specific file
    # NOTE: In case of specific file - do not point at server file
    pageUrl: ""
    # Unique id of modpack, can be used instead of url
    slug: ""
    # Id used to specify which exact modpack file needs to be downloaded
    # NOTE: Do not use server file id
    fileId: ""
    # Less restrictive way of specifying modpack version, uses substring match
    filenameMatcher: ""
    # List of project slugs or IDs to be excluded from modpack, useful if mod is incorrectly marked as server side
    excludeMods: []
    # List of project slugs or IDs to be included in modpack, useful if mod is incorrectly marked as client side only
    includeMods: []
    # Path to file with rules for including and excluding mods. If null - use bundled file, if empty - disable it
    excludeIncludeFile: null
    # Reevaluate exclude and include rules
    forceSynchronize: false
    # Can be set to either WORLD_FILE or OVERRIDES to specify where to get LEVEL
    setLevelFrom: ""
    # Sets limit to how many mods can be downloaded in parallel
    parallelDownloads: 4
    # Set to skip files in modpack "overrides" folder that would replace existing files
    # NOTE: World data is always skipped if present
    overridesSkipExisting: false

  rcon:
    # If you enable this, make SURE to change your password below.
    enabled: false
    # By default, the container will generate a random password at startup
    # to ensure internal RCON tooling, including a backup container,
    # can be used, but the password is secure.
    withGeneratedPassword: false
    port: 25575
    password: "xxxx"
    existingSecret:
    secretKey: rcon-password
    serviceType: LoadBalancer
    ## Set the external port if the rcon serviceType is NodePort
    nodePort:
    clusterIP:
    loadBalancerIP:
    # loadBalancerSourceRanges: []
    ## Set the externalTrafficPolicy in the Service to either Cluster or Local
    # externalTrafficPolicy: Cluster

  extraPorts:
    []

    # These options allow you to expose another port from the Minecraft server, plugins such
    # as dynmap (8123) and bluemap (8100) will require this for access to their web interfaces
    #
    # - name: map
    #   containerPort: 8123
    #   protocol: TCP
    #   service:
    #     enabled: false
    #     embedded: false
    #     annotations: {}
    #     type: ClusterIP
    #     ## Set the external port if the rcon serviceType is NodePort
    ##     nodePort:
    #     loadBalancerIP: ""
    #     loadBalancerSourceRanges: []
    #     externalTrafficPolicy: Cluster
    #     port: 8123
    #   ingress:
    #     ingressClassName: nginx
    #     enabled: false
    #     annotations:
    ## Deprecated way for specifying the ingressClass. Kube.version < 1.18
    ##       kubernetes.io/ingress.class: nginx
    #       kubernetes.io/tls-acme: "true"
    #     hosts:
    #       - name: map.local
    #         path: /
    #     tls:
    #       - secretName: map-tls
    #         hosts:
    #           - map.local

  query:
    # If you enable this, your server will be "published" to Gamespy
    enabled: false
    port: 25565

## Additional minecraft container environment variables
## Values can be either variable values or `valueFrom` yaml
##
extraEnv:
  {}
  # some_variable: some value
  # another_variable:
  #   valueFrom:
  #     fieldRef:
  #       fieldPath: status.hostIP

## Additional environment variables to add to the minecraft container from
## ConfigMaps and Secrets
##
envFrom: []

persistence:
  labels: {}
  annotations: {}
  ## minecraft data Persistent Volume Storage Class
  ## If defined, storageClassName: <storageClass>
  ## If set to "-", storageClassName: "", which disables dynamic provisioning
  ## If undefined (the default) or set to null, no storageClassName spec is
  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
  ##   GKE, AWS & OpenStack)
  ##
  # storageClass: "-"
  dataDir:
    # Set this to false if you don't care to persist state between restarts.
    enabled: true
    Size: 10Gi
    # existingClaim: nil
    ## specify a subpath in the volume where the data is. Useful when sharing volumes with other apps.
    # subPath: /path/to/dataDir

podAnnotations: {}
podLabels: {}

deploymentAnnotations: {}
deploymentLabels: {}

serviceAnnotations: {}
serviceLabels: {}

rconServiceAnnotations: {}
rconServiceLabels: {}

# PLEASE NOTE! rcon must be enabled above!  It does NOT require a nodePort or loadBalancerIP
mcbackup:
  enabled: false

  image:
    repository: itzg/mc-backup
    tag: latest
    pullPolicy: IfNotPresent

  #  wait 2 minutes before starting
  initialDelay: 2m

  # ***set to 0 or smaller, script will run once and exit.  DO NOT SET TO 0 or smaller, this will cause K8s to kill your pod!***
  # backupInterval="1.5d" -> backup every one and a half days (36 hours)
  # backupInterval="2h 30m" -> backup every two and a half hours
  backupInterval: 24h

  # option lets you pause backups if no players are online.
  pauseIfNoPlayers: "false"

  # is set to a positive number, it'll delete old .tgz backup files from DEST_DIR. By default deletes backups older than a week.
  pruneBackupsDays: 7

  # Set to a negative value to retry indefinitely
  rconRetries: 5
  rconRetryInterval: 10s

  # is a comma-separated list of glob(3) patterns to exclude from backups. By default excludes all jar files (plugins, server files),
  # logs folder and cache (used by i.e. PaperMC server).
  excludes: "*.jar,cache,logs"

  # backup methods, see https://github.com/itzg/docker-mc-backup e.g. tar, rclone, restic
  backupMethod: tar
  # tar and rclone methods
  destDir: /backups
  # is a true/false flag that creates a symbolic link to the latest backup
  linkLatest: "false"
  # is the compression method used by tar. Valid value: gzip bzip2 zstd
  compressMethod: "gzip"
  # sets the parameters for zstd compression. The --long parameter affects RAM requirements for both compression and decompression
  # (the default of 25 means 2^25 bytes = 32 MB).
  zstdParameters: "-3 --long=25 --single-thread"
  # the name of the remote you've configured in your rclone.conf
  rcloneRemote:
  rcloneDestDir:
  rcloneCompressMethod: gzip

  # see https://rclone.org/ for details
  # this value is evaluated as a template
  rcloneConfig:
  # [remote]
  # type = google cloud storage
  # client_id =
  # client_secret =
  # token = {"AccessToken":"super","RefreshToken":"secret","Expiry":"date","Extra":null}
  # project_number = 12345678
  # object_acl = private
  # bucket_acl = private

  # if you prefer to create a secret from file (e.g. kubectl create secret generic my-rclone-config --from-file=~/.config/rclone/rclone.conf)
  # rcloneConfigExistingSecret: my-rclone-config

  resticRepository: ""
  # variable to define a space separated list of additional restic tags. see https://hub.docker.com/r/itzg/mc-backup
  resticAdditionalTags: "mc_backups"
  # see https://restic.readthedocs.io/en/latest/060_forget.html
  pruneResticRetention: "--keep-daily 7 --keep-weekly 5 --keep-monthly 12 --keep-yearly 75"

  # At least one of RESTIC_PASSWORD* env variables need to be defined, see https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html
  resticEnvs:
    {}
    # RESTIC_PASSWORD: restic-password

  ## Additional minecraft container environment variables
  ## Values can be either variable values or `valueFrom` yaml
  ##
  extraEnv:
    {}
    # some_variable: some value
    # another_variable:
    #   valueFrom:
    #     fieldRef:
    #       fieldPath: status.hostIP

  ## Additional environment variables to add to the mc-backup container from
  ## ConfigMaps and Secrets
  ##
  envFrom: []

  resources:
    requests:
      memory: 512Mi
      cpu: 500m

  persistence:
    annotations: {}
    ## minecraft data Persistent Volume Storage Class
    ## If defined, storageClassName: <storageClass>
    ## If set to "-", storageClassName: "", which disables dynamic provisioning
    ## If undefined (the default) or set to null, no storageClassName spec is
    ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
    ##   GKE, AWS & OpenStack)
    ##
    # storageClass: "-"
    backupDir:
      # Set this to false if you don't care to persist state between restarts.
      enabled: true
      # existingClaim: nil
      Size: 10Gi

[talasemico]

rcon-web-admin values.yaml

# Default values for rcon-web-admin.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicaCount: 1

image:
  repository: docker.io/itzg/rcon
  pullPolicy: Always
  # Overrides the image tag whose default is the chart appVersion.
  tag: ""

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

podAnnotations: {}

podSecurityContext:
  runAsUser: 1000
  runAsGroup: 3000
  runAsNonRoot: true
  fsGroup: 2000
  seccompProfile:
    type: RuntimeDefault

securityContext:
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false

# This will expose 2 different services - http and websockets
# If you want to know why it's separate - ask developer of original project
# because I have no clue
service:
  # Supported options: Ingress + ClusterIP or LoadBalancer
  type: LoadBalancer
  httpPort: 80
  wsPort: 4327

ingress:
  enabled: false
  className: ""
  annotations:
    {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  host: chart-example.local
  path: /
  pathType: ImplementationSpecific
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

resources:
  {}
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi

nodeSelector: {}

tolerations: []

affinity: {}

rconWeb:
  # Sets the initial user as an admin
  isAdmin: true
  # Sets the initial user's username
  username: admin
  # Sets the initial user's password
  password: "xxxx"
  # Name of existing secret with UI password
  passwordExistingSecret:
  passwordKey: "password"
  # The initial game you wish to control (minecraft / rust / csgo / other)
  game: minecraft
  # The display name of the initial server (if unset; defaults to value of RWA_GAME)
  serverName: minecraft
  # The initial RCON server to control
  rconHost: localhost
  # The port number of the initial RCON server to control
  rconPort: 25575
  # The password for the initial RCON server to control
  rconPassword: "xxxx"
  # Name of existing secret with RCON password
  rconPasswordExistingSecret:
  rconPasswordKey: "rcon-password"
  # Prevent the initial user user executing these commands
  restrictCommands: []
  # Hide this list of widgets from the initial user
  restrictWidgets: []
  # Prevent the initial user changing options in the widget options tab
  immutableWidgetOptions: false
  # Enables 'web rcon' if supported by the game server
  websocketRcon: true