fullnameOverride: "kubectl-mcp-server"

replicas: 1

image:
  # In-house hardened build (helm-templates/kubectl-mcp-server/docker/) —
  # NOT the upstream Docker Hub image. 266→18 HIGH/CRIT vulns, non-root,
  # multi-stage slim base, kubectl v1.33.12 / helm v3.21.0.
  repository: asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/prd/devop/kubectl-mcp-server
  tag: "v2"
  pullPolicy: IfNotPresent

labels:
  bu: infra
  team: devops
  service: kubectl-mcp-server
  env: prd

serviceAccount:
  create: true
  annotations: {}

rbac:
  create: true

podAnnotations: {}

podSecurityContext: {}

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL

priorityClassName: ""

# Admin cluster has no `admin-devops` pool — the general devops nodepool
# is labelled/tainted `dedicated=devops` (verified on k8s-admin-prd-ase1).
nodeSelector:
  dedicated: "devops"

tolerations:
  - key: "dedicated"
    operator: "Equal"
    value: "devops"
    effect: NoSchedule

affinity: {}

resources:
  requests:
    cpu: 250m
    memory: 512Mi
  limits:
    cpu: 1000m
    memory: 1Gi

mcp:
  mode: single
  transport: http
  host: "0.0.0.0"
  port: 8000

auth:
  allowAnonymous: false

externalSecrets:
  enabled: true
  refreshInterval: "150s"
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  dataFrom:
    secretKey: "meesho/prd/cntr/devop/kubectl-mcp-server-admin"

# tcpSocket on purpose — streamable-http transport exposes only /mcp,
# there is no /health route (see chart values.yaml note).
livenessProbe:
  tcpSocket:
    port: 8000
  initialDelaySeconds: 30
  periodSeconds: 30
  timeoutSeconds: 5
  failureThreshold: 3

readinessProbe:
  tcpSocket:
    port: 8000
  initialDelaySeconds: 10
  periodSeconds: 10
  timeoutSeconds: 5
  failureThreshold: 3

service:
  port: 8000
  type: ClusterIP

# admin prd has no Contour — only nginx-external / nginx-internal ingress
# classes. Use the networking.k8s.io Ingress path (nginx-internal), not
# the HTTPProxy/Contour gateway. Verified on k8s-admin-prd-ase1.
createContourGateway: false

ingress:
  enabled: true
  ingressClassName: nginx-internal
  servicePortNumber: 8000
  hosts:
    - host: kubectl-mcp-server-admin.prd.meesho.int
      paths:
        - path: /
          pathType: Prefix
  annotations:
    kubernetes.io/ingress.class: nginx-internal
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
    nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
    nginx.ingress.kubernetes.io/limit-rps: "10"
    nginx.ingress.kubernetes.io/limit-connections: "20"
  slowStart:
    enabled: false
    window: "120s"
    aggression: 1
    minPercent: 10