145 lines
3.1 KiB
YAML
145 lines
3.1 KiB
YAML
fullnameOverride: "kubectl-mcp-server"
|
|
|
|
replicas: 1
|
|
|
|
image:
|
|
# In-house hardened build (helm-templates/kubectl-mcp-server/docker/) —
|
|
# NOT the upstream Docker Hub image. 266→18 HIGH/CRIT vulns, non-root,
|
|
# multi-stage slim base, kubectl v1.33.12 / helm v3.21.0.
|
|
repository: asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/prd/devop/kubectl-mcp-server
|
|
tag: "v2"
|
|
pullPolicy: IfNotPresent
|
|
|
|
labels:
|
|
bu: infra
|
|
team: devops
|
|
service: kubectl-mcp-server
|
|
env: prd
|
|
|
|
serviceAccount:
|
|
create: true
|
|
annotations: {}
|
|
|
|
rbac:
|
|
create: true
|
|
|
|
podAnnotations: {}
|
|
|
|
podSecurityContext: {}
|
|
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
priorityClassName: ""
|
|
|
|
nodeSelector:
|
|
dedicated: "central-devops"
|
|
|
|
tolerations:
|
|
- key: "dedicated"
|
|
operator: "Equal"
|
|
value: "central-devops"
|
|
effect: NoSchedule
|
|
|
|
affinity: {}
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
|
|
mcp:
|
|
mode: multi
|
|
transport: http
|
|
host: "0.0.0.0"
|
|
port: 8000
|
|
|
|
auth:
|
|
allowAnonymous: false
|
|
|
|
externalSecrets:
|
|
enabled: true
|
|
refreshInterval: "150s"
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
dataFrom:
|
|
secretKey: "meesho/prd/cntr/devop/kubectl-mcp-server"
|
|
|
|
federation:
|
|
forwardTimeout: 30
|
|
clusters:
|
|
- name: self
|
|
self: true
|
|
- name: admin
|
|
endpoint: http://kubectl-mcp-server-admin.prd.meesho.int/mcp
|
|
tokenEnv: ADMIN_MCP_TOKEN
|
|
- name: dataengg
|
|
endpoint: http://kubectl-mcp-server-dataengg.prd.meesho.int/mcp
|
|
tokenEnv: DATAENGG_MCP_TOKEN
|
|
- name: datascience
|
|
endpoint: http://kubectl-mcp-server-datascience.prd.meesho.int/mcp
|
|
tokenEnv: DATASCIENCE_MCP_TOKEN
|
|
- name: demand
|
|
endpoint: http://kubectl-mcp-server-demand.prd.meesho.int/mcp
|
|
tokenEnv: DEMAND_MCP_TOKEN
|
|
- name: dsgpu
|
|
endpoint: http://kubectl-mcp-server-dsgpu.prd.meesho.int/mcp
|
|
tokenEnv: DSGPU_MCP_TOKEN
|
|
- name: farmiso
|
|
endpoint: http://kubectl-mcp-server-farmiso.prd.meesho.int/mcp
|
|
tokenEnv: FARMISO_MCP_TOKEN
|
|
- name: supply
|
|
endpoint: http://kubectl-mcp-server-supply.prd.meesho.int/mcp
|
|
tokenEnv: SUPPLY_MCP_TOKEN
|
|
|
|
# tcpSocket on purpose — streamable-http transport exposes only /mcp,
|
|
# there is no /health route (see chart values.yaml note).
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 8000
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 8000
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
service:
|
|
port: 8000
|
|
type: ClusterIP
|
|
|
|
# Contour standard (2.0.0-style): renders HTTPProxy parent/child + -intra
|
|
# instead of a networking.k8s.io Ingress.
|
|
createContourGateway: true
|
|
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: contour-internal-1
|
|
servicePortNumber: 8000
|
|
hosts:
|
|
- host: kubectl-mcp-server-central.prd.meesho.int
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
annotations: {}
|
|
slowStart:
|
|
enabled: false
|
|
window: "120s"
|
|
aggression: 1
|
|
minPercent: 10
|