added repo

2026-08-26 03:39:42 +05:30
parent 45c25a95af
commit b8575bb8b9
6889 changed files with 1217125 additions and 0 deletions
@@ -0,0 +1,162 @@
+fullnameOverride: "kubectl-mcp-server"
+
+replicas: 1
+
+image:
+  repository: asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/prd/devop/kubectl-mcp-server
+  tag: v2
+  pullPolicy: IfNotPresent
+
+labels:
+  bu: infra
+  team: devops
+
+serviceAccount:
+  create: true
+  annotations: {}
+  name: ""
+
+# RBAC — ClusterRole + ClusterRoleBinding for the pod ServiceAccount.
+# The role grants get/list/watch ONLY (no create/update/patch/delete) and
+# deliberately excludes `secrets`. This is the enforcement layer behind the
+# server's own deny-by-default allowlist (no write/secret tools registered).
+rbac:
+  create: true
+
+podAnnotations: {}
+
+podSecurityContext: {}
+
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 1000
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+
+priorityClassName: ""
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+resources:
+  requests:
+    cpu: 250m
+    memory: 512Mi
+  limits:
+    cpu: 1000m
+    memory: 1Gi
+
+# --- MCP server settings ---------------------------------------------------
+# The image ENTRYPOINT is `k8s-rca-mcp`, configured ENTIRELY via env vars
+# (there are NO CLI args). transport: http is streamable-http for Bifrost /
+# HTTP MCP clients.
+mcp:
+  mode: single          # single | multi (federation hub)
+  transport: http
+  host: "0.0.0.0"
+  port: 8000
+
+# --- inbound auth on the MCP endpoint --------------------------------------
+# Bearer token. On http transport the server REFUSES TO START unless the
+# MCP_AUTH_TOKEN env var is present OR allowAnonymous is true. The token is
+# NOT stored in values/git — it is pulled from Vault (see externalSecrets).
+# Clients send:  Authorization: Bearer <token>
+auth:
+  allowAnonymous: false
+
+# --- secrets from Vault (external-secrets.io) ------------------------------
+# One ExternalSecret extracts a Vault path into the Secret `<name>-creds`,
+# which the Deployment injects with `envFrom`. Every key at the Vault path
+# becomes a container env var verbatim, so store them as env var NAMES:
+#   MCP_AUTH_TOKEN              — inbound bearer (always)
+#   <TOKENENV> per backend      — e.g. SUPPLY_MCP_TOKEN (multi mode only),
+#                                 matching the registry's `tokenEnv:` below
+externalSecrets:
+  enabled: true
+  refreshInterval: "150s"
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  dataFrom:
+    # Vault path holding the tokens — set per cluster in the override.
+    secretKey: ""
+    # Optional: pin a specific Vault secret version.
+    version: ""
+  # Override the synced Secret name (default: <name>-creds).
+  secretName: ""
+
+# Extra envFrom sources (merged after the Vault creds secret), e.g. a
+# manually-created Secret for local testing without Vault.
+envFrom: []
+
+# --- federation (only used when mcp.mode == multi) -------------------------
+# The hub holds NO remote kubeconfigs. It forwards each tool call to the
+# target cluster's own single-mode MCP using a per-backend bearer token.
+# Those tokens live in Vault (keys named to match each `tokenEnv:` below).
+federation:
+  forwardTimeout: 30
+  # Rendered into a ConfigMap mounted at /etc/k8s-rca-mcp/clusters.yaml.
+  # Exactly one entry must be `self: true`.
+  clusters:
+    - name: self
+      self: true
+    # - name: supply
+    #   endpoint: https://kubectl-mcp-server.supply.stg.meesho.int/mcp
+    #   tokenEnv: SUPPLY_MCP_TOKEN   # <- must be a key at the Vault path
+
+# NOTE: tcpSocket, not httpGet — under streamable-http transport FastMCP
+# serves ONLY /mcp (GET /health 404s; upstream's chart gets this wrong).
+# /mcp itself returns 406 to plain GETs, so TCP is the reliable signal.
+livenessProbe:
+  tcpSocket:
+    port: 8000
+  initialDelaySeconds: 30
+  periodSeconds: 30
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+readinessProbe:
+  tcpSocket:
+    port: 8000
+  initialDelaySeconds: 10
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+service:
+  port: 8000
+  type: ClusterIP
+
+# Ingress — 2.0.0-chart style. nginx-* classes render a networking.k8s.io
+# Ingress; contour-* classes (with createContourGateway: true) render the
+# standard Meesho HTTPProxy parent/child pair plus the -intra variant.
+createContourGateway: true
+
+ingress:
+  enabled: true
+  ingressClassName: nginx-internal
+  servicePortNumber: 8000
+  hosts:
+    - host: ""
+      paths:
+        - path: /
+          pathType: Prefix
+  annotations:
+    kubernetes.io/ingress.class: nginx-internal
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
+    nginx.ingress.kubernetes.io/limit-rps: "10"
+    nginx.ingress.kubernetes.io/limit-connections: "20"
+  slowStart:
+    enabled: false
+    window: "120s"
+    aggression: 1
+    minPercent: 10