129 lines
2.8 KiB
YAML
129 lines
2.8 KiB
YAML
fullnameOverride: "kubectl-mcp-server"
|
|
|
|
replicas: 1
|
|
|
|
image:
|
|
# In-house hardened build (helm-templates/kubectl-mcp-server/docker/) —
|
|
# NOT the upstream Docker Hub image. 266→18 HIGH/CRIT vulns, non-root,
|
|
# multi-stage slim base, kubectl v1.33.12 / helm v3.21.0.
|
|
repository: asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/prd/devop/kubectl-mcp-server
|
|
tag: "v2"
|
|
pullPolicy: IfNotPresent
|
|
|
|
labels:
|
|
bu: infra
|
|
team: devops
|
|
service: kubectl-mcp-server
|
|
env: prd
|
|
|
|
serviceAccount:
|
|
create: true
|
|
annotations: {}
|
|
|
|
rbac:
|
|
create: true
|
|
|
|
podAnnotations: {}
|
|
|
|
podSecurityContext: {}
|
|
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
priorityClassName: ""
|
|
|
|
# Admin cluster has no `admin-devops` pool — the general devops nodepool
|
|
# is labelled/tainted `dedicated=devops` (verified on k8s-admin-prd-ase1).
|
|
nodeSelector:
|
|
dedicated: "devops"
|
|
|
|
tolerations:
|
|
- key: "dedicated"
|
|
operator: "Equal"
|
|
value: "devops"
|
|
effect: NoSchedule
|
|
|
|
affinity: {}
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
|
|
mcp:
|
|
mode: single
|
|
transport: http
|
|
host: "0.0.0.0"
|
|
port: 8000
|
|
|
|
auth:
|
|
allowAnonymous: false
|
|
|
|
externalSecrets:
|
|
enabled: true
|
|
refreshInterval: "150s"
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
dataFrom:
|
|
secretKey: "meesho/prd/cntr/devop/kubectl-mcp-server-admin"
|
|
|
|
# tcpSocket on purpose — streamable-http transport exposes only /mcp,
|
|
# there is no /health route (see chart values.yaml note).
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 8000
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 8000
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
service:
|
|
port: 8000
|
|
type: ClusterIP
|
|
|
|
# admin prd has no Contour — only nginx-external / nginx-internal ingress
|
|
# classes. Use the networking.k8s.io Ingress path (nginx-internal), not
|
|
# the HTTPProxy/Contour gateway. Verified on k8s-admin-prd-ase1.
|
|
createContourGateway: false
|
|
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: nginx-internal
|
|
servicePortNumber: 8000
|
|
hosts:
|
|
- host: kubectl-mcp-server-admin.prd.meesho.int
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
annotations:
|
|
kubernetes.io/ingress.class: nginx-internal
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "10m"
|
|
nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
|
|
nginx.ingress.kubernetes.io/limit-rps: "10"
|
|
nginx.ingress.kubernetes.io/limit-connections: "20"
|
|
slowStart:
|
|
enabled: false
|
|
window: "120s"
|
|
aggression: 1
|
|
minPercent: 10
|