163 lines
4.8 KiB
YAML
163 lines
4.8 KiB
YAML
fullnameOverride: "kubectl-mcp-server"
|
|
|
|
replicas: 1
|
|
|
|
image:
|
|
repository: asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/prd/devop/kubectl-mcp-server
|
|
tag: v2
|
|
pullPolicy: IfNotPresent
|
|
|
|
labels:
|
|
bu: infra
|
|
team: devops
|
|
|
|
serviceAccount:
|
|
create: true
|
|
annotations: {}
|
|
name: ""
|
|
|
|
# RBAC — ClusterRole + ClusterRoleBinding for the pod ServiceAccount.
|
|
# The role grants get/list/watch ONLY (no create/update/patch/delete) and
|
|
# deliberately excludes `secrets`. This is the enforcement layer behind the
|
|
# server's own deny-by-default allowlist (no write/secret tools registered).
|
|
rbac:
|
|
create: true
|
|
|
|
podAnnotations: {}
|
|
|
|
podSecurityContext: {}
|
|
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
priorityClassName: ""
|
|
|
|
nodeSelector: {}
|
|
|
|
tolerations: []
|
|
|
|
affinity: {}
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
|
|
# --- MCP server settings ---------------------------------------------------
|
|
# The image ENTRYPOINT is `k8s-rca-mcp`, configured ENTIRELY via env vars
|
|
# (there are NO CLI args). transport: http is streamable-http for Bifrost /
|
|
# HTTP MCP clients.
|
|
mcp:
|
|
mode: single # single | multi (federation hub)
|
|
transport: http
|
|
host: "0.0.0.0"
|
|
port: 8000
|
|
|
|
# --- inbound auth on the MCP endpoint --------------------------------------
|
|
# Bearer token. On http transport the server REFUSES TO START unless the
|
|
# MCP_AUTH_TOKEN env var is present OR allowAnonymous is true. The token is
|
|
# NOT stored in values/git — it is pulled from Vault (see externalSecrets).
|
|
# Clients send: Authorization: Bearer <token>
|
|
auth:
|
|
allowAnonymous: false
|
|
|
|
# --- secrets from Vault (external-secrets.io) ------------------------------
|
|
# One ExternalSecret extracts a Vault path into the Secret `<name>-creds`,
|
|
# which the Deployment injects with `envFrom`. Every key at the Vault path
|
|
# becomes a container env var verbatim, so store them as env var NAMES:
|
|
# MCP_AUTH_TOKEN — inbound bearer (always)
|
|
# <TOKENENV> per backend — e.g. SUPPLY_MCP_TOKEN (multi mode only),
|
|
# matching the registry's `tokenEnv:` below
|
|
externalSecrets:
|
|
enabled: true
|
|
refreshInterval: "150s"
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
dataFrom:
|
|
# Vault path holding the tokens — set per cluster in the override.
|
|
secretKey: ""
|
|
# Optional: pin a specific Vault secret version.
|
|
version: ""
|
|
# Override the synced Secret name (default: <name>-creds).
|
|
secretName: ""
|
|
|
|
# Extra envFrom sources (merged after the Vault creds secret), e.g. a
|
|
# manually-created Secret for local testing without Vault.
|
|
envFrom: []
|
|
|
|
# --- federation (only used when mcp.mode == multi) -------------------------
|
|
# The hub holds NO remote kubeconfigs. It forwards each tool call to the
|
|
# target cluster's own single-mode MCP using a per-backend bearer token.
|
|
# Those tokens live in Vault (keys named to match each `tokenEnv:` below).
|
|
federation:
|
|
forwardTimeout: 30
|
|
# Rendered into a ConfigMap mounted at /etc/k8s-rca-mcp/clusters.yaml.
|
|
# Exactly one entry must be `self: true`.
|
|
clusters:
|
|
- name: self
|
|
self: true
|
|
# - name: supply
|
|
# endpoint: https://kubectl-mcp-server.supply.stg.meesho.int/mcp
|
|
# tokenEnv: SUPPLY_MCP_TOKEN # <- must be a key at the Vault path
|
|
|
|
# NOTE: tcpSocket, not httpGet — under streamable-http transport FastMCP
|
|
# serves ONLY /mcp (GET /health 404s; upstream's chart gets this wrong).
|
|
# /mcp itself returns 406 to plain GETs, so TCP is the reliable signal.
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 8000
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 8000
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
service:
|
|
port: 8000
|
|
type: ClusterIP
|
|
|
|
# Ingress — 2.0.0-chart style. nginx-* classes render a networking.k8s.io
|
|
# Ingress; contour-* classes (with createContourGateway: true) render the
|
|
# standard Meesho HTTPProxy parent/child pair plus the -intra variant.
|
|
createContourGateway: true
|
|
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: nginx-internal
|
|
servicePortNumber: 8000
|
|
hosts:
|
|
- host: ""
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
annotations:
|
|
kubernetes.io/ingress.class: nginx-internal
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "10m"
|
|
nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
|
|
nginx.ingress.kubernetes.io/limit-rps: "10"
|
|
nginx.ingress.kubernetes.io/limit-connections: "20"
|
|
slowStart:
|
|
enabled: false
|
|
window: "120s"
|
|
aggression: 1
|
|
minPercent: 10
|