# Akamai Observability MCP — grafana-mcp chart on gke-central-prd-ase1a
# Chart: helm-templates/grafana-mcp (v2.0.0+)

fullnameOverride: "akamai-observability-mcp"

replicas: 1

image:
  registry: asia-southeast1-docker.pkg.dev
  repository: meesho-devops-admin-0622/prd/devop/grafana-mcp
  tag: "v2026-03-10"
  pullPolicy: IfNotPresent

labels:
  bu: central
  team: devops
  service: akamai-observability-mcp
  env: prd

# -- Grafana connection.
# url: set this to the Akamai/observability Grafana endpoint reachable from
#      gke-central-prd-ase1a (in-cluster DNS preferred; otherwise the prd FQDN).
# apiKeySecret: read GRAFANA_SERVICE_ACCOUNT_TOKEN from the K8s Secret produced
#               by the ExternalSecret below.
grafana:
  url: ""  # TODO: set the Grafana base URL (e.g. https://grafana-akamai.prd.meesho.int)
  apiKeySecret:
    name: "akamai-observability-mcp-vault"
    key: "GRAFANA_SERVICE_ACCOUNT_TOKEN"

# -- Vault-backed secret. Mint the Grafana service-account token in the Grafana
# UI, store it at the path below under key GRAFANA_SERVICE_ACCOUNT_TOKEN, then
# ESO syncs it into the K8s Secret referenced above.
externalSecret:
  enabled: true
  secretName: "akamai-observability-mcp-vault"
  path: "prd/cntr/devop/akamai-observability-mcp"  # TODO: confirm Vault path
  refreshInterval: "0"
  secretStoreRef: "vault-backend"

serviceAccount:
  create: true
  annotations: {}

# SSE transport is long-lived — keep Contour from cutting connections.
contourResponseTimeout: "1h"

createContourGateway: true

ingress:
  enabled: true
  ingressClassName: contour-internal-1
  servicePortNumber: 8000
  enableWebsocket: true
  hosts:
    - host: akamai-observability-mcp.prd.meesho.int
      paths:
        - path: /
          pathType: Prefix
  annotations: {}
  slowStart:
    enabled: false
    window: "120s"
    aggression: 1
    minPercent: 10

resources:
  requests:
    cpu: 250m
    memory: 256Mi
  limits:
    cpu: 500m
    memory: 512Mi

# Scheduling — dedicated MCP node pool on gke-central-prd-ase1a.
nodeSelector:
  cloud.google.com/compute-class: "devops-mcp"

tolerations:
  - key: "cloud.google.com/compute-class"
    operator: "Equal"
    value: "devops-mcp"
    effect: NoSchedule

securityContext:
  fsGroup: 1000
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000

containerSecurityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000