fullnameOverride: "kubectl-mcp-server"

replicas: 1

image:
  # In-house hardened build (helm-templates/kubectl-mcp-server/docker/) —
  # NOT the upstream Docker Hub image. 266→18 HIGH/CRIT vulns, non-root,
  # multi-stage slim base, kubectl v1.33.12 / helm v3.21.0.
  repository: asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/prd/devop/kubectl-mcp-server
  tag: "v2"
  pullPolicy: IfNotPresent

labels:
  bu: infra
  team: devops
  service: kubectl-mcp-server
  env: prd

serviceAccount:
  create: true
  annotations: {}

rbac:
  create: true

podAnnotations: {}

podSecurityContext: {}

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL

priorityClassName: ""

nodeSelector:
  dedicated: "datascience-devops"

tolerations:
  - key: "dedicated"
    operator: "Equal"
    value: "datascience-devops"
    effect: NoSchedule

affinity: {}

resources:
  requests:
    cpu: 250m
    memory: 512Mi
  limits:
    cpu: 1000m
    memory: 1Gi

mcp:
  mode: single
  transport: http
  host: "0.0.0.0"
  port: 8000

auth:
  allowAnonymous: false

externalSecrets:
  enabled: true
  refreshInterval: "150s"
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  dataFrom:
    secretKey: "meesho/prd/cntr/devop/kubectl-mcp-server-datascience"

# tcpSocket on purpose — streamable-http transport exposes only /mcp,
# there is no /health route (see chart values.yaml note).
livenessProbe:
  tcpSocket:
    port: 8000
  initialDelaySeconds: 30
  periodSeconds: 30
  timeoutSeconds: 5
  failureThreshold: 3

readinessProbe:
  tcpSocket:
    port: 8000
  initialDelaySeconds: 10
  periodSeconds: 10
  timeoutSeconds: 5
  failureThreshold: 3

service:
  port: 8000
  type: ClusterIP

# Contour standard (2.0.0-style): renders HTTPProxy parent/child + -intra
# instead of a networking.k8s.io Ingress.
createContourGateway: true

ingress:
  enabled: true
  ingressClassName: contour-internal-1
  servicePortNumber: 8000
  hosts:
    - host: kubectl-mcp-server-datascience.prd.meesho.int
      paths:
        - path: /
          pathType: Prefix
  annotations: {}
  slowStart:
    enabled: false
    window: "120s"
    aggression: 1
    minPercent: 10