Skip to content

Conversation

@rr-paras-patel
Copy link
Collaborator

@rr-paras-patel rr-paras-patel commented Oct 19, 2025

This pull request introduces a comprehensive Helm chart for the MCP server, enabling secure, multi-cloud, and multi-cluster Kubernetes management. It adds the main chart definition and several well-documented example configuration files for AWS, Azure, GCP, and production environments. The examples demonstrate best practices for cloud-native authentication (Workload Identity/IRSA), RBAC, security, networking, and resource management.

Helm Chart Definition

  • Added the initial Chart.yaml for the MCP server Helm chart, including metadata such as version, maintainers, keywords, and annotations to support Kubernetes application deployment.

Cloud Provider Workload Identity Examples

  • AWS IRSA Example: Provided a configuration for secure AWS access using IAM Roles for Service Accounts (IRSA), including service account annotations, RBAC, and example IAM policies for cross-cluster access.
  • Azure Workload Identity Example: Added configuration for Azure Workload Identity, detailing service account and pod annotations, environment variables, and step-by-step setup instructions for AKS integration.
  • GCP Workload Identity Example: Introduced a configuration for GCP Workload Identity, with service account annotations, environment variables, and setup steps for GKE integration and cross-cluster access.

Multi-Cluster and Production Examples

  • AWS Multi-Cluster Example: Demonstrated how to manage multiple EKS clusters across different accounts and regions using role assumption, ingress, RBAC, and resource limits suitable for production workloads.
  • Complete Production Example: Provided a full-featured production configuration covering multi-cluster AWS access, advanced security (network policy, pod security), autoscaling, health checks, affinity/tolerations, and RBAC for safe operations.

Note for Reviewer : All changes are kept under helm-chart folder no changes were required on MCP server typescript code so we are not breaking any existing functionality.

rr-paras-patel and others added 14 commits August 22, 2025 00:19
- Add Chart.yaml with metadata and version 2.8.0
- Add values.yaml with multi-cloud kubeconfig support
- Add JSON Schema validation for values configuration
- Support AWS EKS, GCP GKE, Azure AKS, URL, and custom providers
- Include security configurations and resource management
- Add helper functions for labels, names, and multi-architecture support
- Add deployment with init container for kubeconfig fetching
- Add service account with cloud provider IAM annotations
- Add RBAC with least-privilege defaults and legacy mode option
- Add configmap with scripts for AWS, GCP, Azure, URL, and custom providers
- Implement comprehensive retry logic with configurable attempts and delays
- Support multiple clusters per provider with role assumption
- Include validation and error handling for all cloud providers
- Add service template with configurable type and annotations
- Add ingress template with streaming compatibility warnings
- Support for different transport modes (stdio, sse, http)
- Include MCP streaming behavior documentation and recommendations
- Add NetworkPolicy with default deny for ingress and egress
- Implement flexible DNS, Kubernetes API, and cloud provider access
- Support configurable CIDR ranges and service selectors
- Auto-generate essential egress rules for cluster functionality
- Add HorizontalPodAutoscaler with CPU/memory/custom metrics
- Add PodDisruptionBudget for maintaining availability during updates
- Support Kubernetes version compatibility (v2/v2beta2 HPA)
- Include scaling behavior configuration and annotations
- Add connectivity tests for HTTP/SSE transport validation
- Add kubeconfig tests for cloud provider authentication
- Add MCP tools tests for functionality validation
- Add NetworkPolicy support for test pod communication
- Include weighted test execution and cleanup automation
- Add cloud provider IAM integration examples (IRSA, Workload Identity)
- Add multi-cluster deployment configurations
- Add secure NetworkPolicy and production-complete examples
- Add detailed installation guide with troubleshooting
- Include NOTES.txt for post-installation guidance
@rr-paras-patel rr-paras-patel marked this pull request as draft October 19, 2025 22:48
@rr-paras-patel
Copy link
Collaborator Author

rr-paras-patel commented Oct 19, 2025

Going to remove Azure and GCP Support for now as it is not tested we can add it separate subsequent PR.

This PR wil have Helm Chart for:

  • Static Kubeconfig Mount best for Self Hosted k8s (Need help for Testing) @julioc-p
  • Dynamic KubeConfig download for AWS EKS Clusters via Service Account and IAM role.
  • GCP Support (Need help for Testing)
  • Need contributions for publishing our helm chart or we may go with first static helm chart and take care of publishing part in separate PR. Github Packages is good place to start publishing helm manifest.

Future Wrok when we get volunteers to test these method:

  • Azure Support
  • K8s Master API access via Cluster Role

@julioc-p
Copy link

julioc-p commented Oct 20, 2025

@rr-paras-patel I can take care of publishing it. I can maybe add it to Github actions

julioc-p

This comment was marked as outdated.

@julioc-p
Copy link

I tested the static kubeconfig setup and it works. so LGTM overall

@rr-paras-patel
Copy link
Collaborator Author

Thanks @julioc-p i tested on AWS EKS with Multi Account and Multi Context Kubeconfig it works for me.

@Flux159
Copy link
Owner

Flux159 commented Oct 21, 2025

@rr-paras-patel Is this ready for review? Still seeing the gcp stuff & still marked as draft (readme.md also has many different options that may not be tested?) - not sure if you were going to remove that in the PR.

@julioc-p
Copy link

julioc-p commented Oct 21, 2025

I set up the helm chart packaging and publishing here: Could you pull the changes to this PR @rr-paras-patel ?

@rr-paras-patel
Copy link
Collaborator Author

I set up the helm chart packaging and publishing here: Could you pull the changes to this PR @rr-paras-patel ?

@rr-paras-patel
Copy link
Collaborator Author

I set up the helm chart packaging and publishing here: Could you pull the changes to this PR @rr-paras-patel ?

yes i will. Thanks

@rr-paras-patel
Copy link
Collaborator Author

rr-paras-patel commented Oct 22, 2025

Still seeing the gcp stuff & still marked as draft (readme.md also has many different options that may not be tested?) - not sure if you were going to remove that in the PR.

@Flux159 if you have GCP access please test it would be great. i got confirmation from one of the community user saying it is working. we can keep all of this and i only removed azure as i there was some extra work needed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants