Best Practices

Overview

Running Agones in production takes consideration, from planning your launch to figuring out the best course of action for cluster and Agones upgrades. On this page, we’ve collected some general best practices. We also have cloud specific pages for:

• Google Kubernetes Engine (GKE)

If you are interested in submitting best practices for your cloud prodiver / on-prem, please contribute!

Separation of Agones from GameServer nodes

When running in production, Agones should be scheduled on a dedicated pool of nodes, distinct from where Game Servers are scheduled for better isolation and resiliency. By default Agones prefers to be scheduled on nodes labeled with agones.dev/agones-system=true and tolerates the node taint agones.dev/agones-system=true:NoExecute. If no dedicated nodes are available, Agones will run on regular nodes. See taints and tolerations for more information about Kubernetes taints and tolerations.

If you are collecting Metrics using our standard Prometheus installation, see the installation guide for instructions on configuring a separate node pool for the agones.dev/agones-metrics=true taint.

See Creating a Cluster for initial set up on your cloud provider.

Pod Security Standards

The Agones sdk sidecar container declares a security context that is compatible with the restricted Pod Security Standard by default, so GameServers can be run in namespaces that enforce it. Your game server container, and any other containers in the GameServer Pod template, need to declare their own compliant security contexts.

The baseline and restricted standards also forbid hostPort, which the Dynamic, Static and Passthrough port policies rely on, so GameServers in these namespaces need to use the None port policy.

On GKE Autopilot, Agones sets the Pod seccomp profile to Unconfined unless the GameServer Pod template sets one, which the restricted standard rejects. Set securityContext.seccompProfile.type: RuntimeDefault on the Pod template to run in these namespaces.

The sidecar security context can be changed through the agones.image.sdk.securityContext Helm value, for example to use a different seccomp profile or group.

Redundant Clusters

Allocate Across Clusters

Agones supports Multi-cluster Allocation to avoid a single point of failure when allocating game servers. While earlier versions of Agones included a custom multi-cluster allocation solution, the current best practice is to use a Service Mesh (e.g., Istio, Linkerd, Google Cloud Service Mesh) to handle allocation traffic between clusters.

By deploying a Service Mesh across your Agones clusters and backend services, you can expose and route traffic to each cluster’s agones-allocator endpoint based on cluster priority, latency, or other criteria.

To implement this approach, refer to the full setup and guidance in the Multi-cluster Allocation documentation.

You can also explore the Global Multiplayer Demo for a working example using Google Cloud Service Mesh with Istio.

Spread

You should consider spreading your game servers in two ways:

• Across geographic fault domains (GCP regions, AWS availability zones, separate datacenters, etc.): This is desirable for geographic fault isolation, but also for optimizing client latency to the game server.
• Within a fault domain: Kubernetes Clusters are single points of failure. A single misconfigured RBAC rule, an overloaded Kubernetes Control Plane, etc. can prevent new game server allocations, or worse, disrupt existing sessions. Running multiple clusters within a fault domain also allows for easier upgrades.

Last modified September 6, 2026: Merge branch 'main' into feat/sidecar-restricted-security-context (6c9dfa3)