Private Cloud Plan

This page describes the infrastructure architecture available through Metaplay's Private Cloud plan. Private Cloud is designed for customers who require complete control over their infrastructure to design and optimize it precisely for their specific purposes.

If you're interested in self-hosting your game servers with full infrastructure control, contact Metaplay Sales to discuss how we can work together to architect the ideal solution for your needs.

Dependencies

• Public cloud providers - Metaplay's infrastructure is designed on top of AWS cloud services. Prior experience with operating public cloud resources will help with understanding the architecture.
• Docker and Kubernetes - While not strictly necessary, familiarity with Docker containers and Kubernetes clusters will help you get the most out of this article.

Overview

Metaplay Private Cloud provides a production-ready cloud infrastructure architecture for self-hosting your game servers. This architecture is the same foundation we use internally to host and manage game environments, refined through years of operating high-DAU games.

When you choose the Private Cloud plan, Metaplay works with you to deploy and customize this infrastructure for your specific needs. This collaborative approach ensures you benefit from our operational best practices while retaining full control over your infrastructure.

The infrastructure operates in the AWS cloud, utilizing many of their managed services to keep operational complexity low. For example, game servers and associated services run as containers on AWS's managed Kubernetes platform, EKS.

Infrastructure as Code

The Private Cloud infrastructure is managed through industry-standard infrastructure-as-code tooling:

• Terraform modules - For provisioning the full infrastructure stack.
• Helm charts - For managing the Kubernetes applications after infrastructure provisioning.

Infrastructure components and dependencies are regularly updated in Metaplay releases to maintain security and compatibility with the broader infrastructure ecosystem.

💡 Pro Tip

The infrastructure is modular and extensible. As part of the Private Cloud plan, Metaplay can help you customize it for your game's or studio's specific requirements.

AWS Architecture

The Private Cloud infrastructure follows a two-tier architecture designed for high availability, self-healing, and security. Core game services are complemented by specialized services such as file storage, load balancers, content delivery, authentication, observability, backups, and more.

• Application servers - Running in Amazon Elastic Kubernetes Service.
• Data persistence - In Amazon Relational Database Service.

Scaling

Each part of the service stack is designed for high efficiency and scalability. Load balancers, CDN, and file storage are inherently scalable, managed AWS services. Kubernetes and RDS clusters can be scaled both vertically (more powerful VMs) and horizontally (more VMs).

The Metaplay game server architecture is distributed and scales well with more and faster cores, providing flexibility in choosing the best-suited (and cost-optimized) instance types for your deployments.

• Load balancing - Using Amazon NLB
• Content delivery - Through Amazon CloudFront
• File storage - Provided by Amazon S3

DevOps Tooling

Effective daily operations require the right tools. The Private Cloud architecture includes a full stack of industry-standard DevOps tools covering provisioning, configuration, deployments, and daily monitoring of high-DAU games.

• Automated builds - We recommend (and provide pre-configured scripts for) GitHub Actions.
• Metaplay CLI - A utility for easily executing common commands needed to interact with your live deployments, such as uploading a new game server build.
• Backups - Support for AWS Backup to back up and persist game databases and file storage buckets through snapshots, allowing you to revert if errors occur or rebuild your entire stack if needed.
• Metrics - Automatic collection of a wide array of game server metrics, as well as metrics of other supporting systems such as the underlying infrastructure.
• Logs - Collection and persistence of logs from game servers and other systems for efficient debugging and tracing of issues across distributed systems.
• Monitoring dashboard - A curated set of monitoring dashboards providing an at-a-glance view of how your game servers and infrastructure are operating.
• Alerts - An extendable set of alerting rules that notify you if the health of game servers or underlying infrastructure is reduced. Alerts can be delivered to common IM and paging platforms, giving you flexibility in who, when, and how should be contacted.

Kubernetes Architecture

The application layer runs as containers within Kubernetes. All application data is transient and persisted outside of Kubernetes, allowing application containers (or even the whole cluster) to be destroyed without data loss.

• Game server resources - Services directly related to the game server application.
• Supporting services resources - Services that help observe and manage the game server.
• Cluster tooling - Contains the essential services for running a Kubernetes cluster securely and efficiently.

The base Kubernetes resource types are extended with Metaplay resource types and an operator, allowing for easier control of the game server lifecycle. All Kubernetes payloads can be split into three main categories: game server resources, supporting service resources, and cluster tooling. The applications between these categories are segregated and can be managed in separate lifecycles and cadences.

Game Server Resources

Game server resources are services directly related to the game server application.

The game server cluster has dedicated endpoints for the various sub-services.

• Game server - Docker containerized game server builds running in Kubernetes pods. The specific configuration of different types of shards and their workloads can be fine-tuned for your game's specific needs.
• LiveOps Dashboard - Web-based tools for the game development, support, and operations teams to manage the game. Hosted by ASP.NET running on the game server cluster.
• Ingress & endpoints
  • Game endpoint - Kubernetes load balancer service that provides an endpoint for game client communication.
  • Public HTTP endpoint - Support for setting up public HTTP endpoints as needed. A typical use case is webhook endpoints where other services can send calls to.
  • LiveOps Dashboard and the game server API - Protected private HTTP endpoint for providing administrators access to the LiveOps Dashboard, observability tools, and for making calls to the game server APIs.

Supporting Service Resources

Supporting services are those that help observe and manage the game server.

• Metaplay operator - Operates the lifecycle of game servers.
• Observability stack
  • Metrics - Collected by Grafana Alloy and stored in Mimir.
  • Logs - Server logs collected by Grafana Alloy and stored in Loki.
  • Dashboards - Collected metrics and logs are visualized in pre-configured Grafana dashboards.

Cluster Tooling

Cluster tooling contains the essential services for running a Kubernetes cluster securely and efficiently. These services generally require the least customization.

• Networking and connectivity services
  • DNS - Managing external DNS resources on behalf of the cluster.
  • Reverse proxy - Handling all incoming HTTP traffic and routing it securely within the cluster.
  • Authentication - Resolving the roles & permissions of connecting users.
  • Network security - Enforcing network policies between different systems within the Kubernetes cluster.
• Autoscaler - Karpenter automatically scales Kubernetes compute nodes up and down based on resource requests. This enables an efficient Kubernetes setup and makes it easy to tap into spot instances for significant cost savings.
• Spot termination handler - Allows for more safely running Kubernetes nodes as spot instances, which can yield up to 70% savings in compute costs.
• Certificate manager - Allows in-cluster systems to request certificates for securing communication.

🔍 Extensible by Design

The Private Cloud infrastructure stack is fully extensible. As part of your Private Cloud engagement, Metaplay can help you replace default components with your own solutions or add additional services to meet your specific requirements.

Cloud Security

The Private Cloud architecture implements modern cloud security best practices:

• Identity and access control - Users and their roles are handled through a combination of AWS IAM for infrastructure access management and intra-game server accounts and RBAC for application-level security. Additionally, external identity providers are supported through industry-standard OAuth2/OIDC protocols.
• Transport-level security - Data is encrypted in transport using Transport Layer Security (TLS) between endpoints using AWS-managed certificates in AWS ACM.
• Network-level security - The infrastructure is designed to run in private VPCs using security groups and a public/private subnet split to enhance security. In-cluster networking is secured with Calico and Network Policies and configured to restrict cross-namespace connectivity.
• Data security - All game data is encrypted at rest in AWS RDS and AWS S3 services. Additionally, access to these data sources is controlled via security groups and credentials or role-based access.
• Backups - Backups are taken using AWS Backup. Backup routines and destinations can be customized based on your project's specific needs.
• Monitoring and alerting - Metrics and logs are collected both in-cluster via Mimir and Loki and on a cloud level with CloudWatch's metrics, logs, and AWS CloudTrail. Grafana is provided for holistic visibility across data sources. Customizable alerting can be managed with Mimir Alertmanager.

No amount of best practices can replace continuous monitoring of the online security landscape and frequent updates to keep all systems up to date. Metaplay ships regular updates to infrastructure components and can help you roll those out into your self-hosted environments.

For games that need to remain on older Metaplay versions, we can work with you to prevent possible security vulnerabilities by backporting critical security fixes as needed.

Interested in Private Cloud?

If you're looking for complete control over your game infrastructure, the Private Cloud plan may be right for you. Contact Metaplay Sales to discuss your requirements and learn how we can work together to architect the ideal solution for your game.