122 lines
2.5 KiB
YAML
122 lines
2.5 KiB
YAML
fullnameOverride: "kubectl-mcp-server"
|
|
|
|
replicas: 1
|
|
|
|
image:
|
|
# In-house hardened build (helm-templates/kubectl-mcp-server/docker/) —
|
|
# NOT the upstream Docker Hub image. 266→18 HIGH/CRIT vulns, non-root,
|
|
# multi-stage slim base, kubectl v1.33.12 / helm v3.21.0.
|
|
repository: asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/prd/devop/kubectl-mcp-server
|
|
tag: "v2"
|
|
pullPolicy: IfNotPresent
|
|
|
|
labels:
|
|
bu: infra
|
|
team: devops
|
|
service: kubectl-mcp-server
|
|
env: prd
|
|
|
|
serviceAccount:
|
|
create: true
|
|
annotations: {}
|
|
|
|
rbac:
|
|
create: true
|
|
|
|
podAnnotations: {}
|
|
|
|
podSecurityContext: {}
|
|
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
priorityClassName: ""
|
|
|
|
# dsgpu is a GPU cluster with no `dedicated` nodepools — it uses GKE custom
|
|
# compute classes (NAP). The devops workload class is
|
|
# `datascience-devops`; nodes carry both the
|
|
# label and a matching NoSchedule taint (verified on k8s-dsgpu-prd-ase1).
|
|
nodeSelector:
|
|
cloud.google.com/compute-class: "datascience-devops"
|
|
|
|
tolerations:
|
|
- key: "cloud.google.com/compute-class"
|
|
operator: "Equal"
|
|
value: "datascience-devops"
|
|
effect: NoSchedule
|
|
|
|
affinity: {}
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
|
|
mcp:
|
|
mode: single
|
|
transport: http
|
|
host: "0.0.0.0"
|
|
port: 8000
|
|
|
|
auth:
|
|
allowAnonymous: false
|
|
|
|
externalSecrets:
|
|
enabled: true
|
|
refreshInterval: "150s"
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
dataFrom:
|
|
secretKey: "meesho/prd/cntr/devop/kubectl-mcp-server-dsgpu"
|
|
|
|
# tcpSocket on purpose — streamable-http transport exposes only /mcp,
|
|
# there is no /health route (see chart values.yaml note).
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 8000
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 8000
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
service:
|
|
port: 8000
|
|
type: ClusterIP
|
|
|
|
# Contour standard (2.0.0-style): renders HTTPProxy parent/child + -intra
|
|
# instead of a networking.k8s.io Ingress.
|
|
createContourGateway: true
|
|
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: contour-internal-1
|
|
servicePortNumber: 8000
|
|
hosts:
|
|
- host: kubectl-mcp-server-dsgpu.prd.meesho.int
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
annotations: {}
|
|
slowStart:
|
|
enabled: false
|
|
window: "120s"
|
|
aggression: 1
|
|
minPercent: 10
|