Skip to content

Commit 49e6a12

Browse files
google-labs-jules[bot]google-labs-jules[bot]
committed
feat: Add Helm chart for kubernetes-mcp-server
This commit introduces a Helm chart for deploying the kubernetes-mcp-server to a Kubernetes cluster. The chart is located in the `charts/kubernetes-mcp-server` directory and includes templates for the deployment, service, service account, RBAC, and a configurable `values.yaml` file. The chart allows for easy configuration of the server, including: - Image repository and tag - Service ports - Resource limits and requests - Application-specific settings via a `ConfigMap` - RBAC permissions for the server to interact with the Kubernetes API Based on user feedback, the chart has been made more flexible and secure: - `serviceAccount.create` defaults to `false`, requiring the user to specify an existing service account. - `readOnly` and `disableDestructive` default to `true`. - A new `rbac.create` flag allows users to disable the creation of the `Role` and `RoleBinding` if they are managing permissions externally. - The chart is designed to work with CI/CD pipelines by allowing sensitive values like the Confluence API token to be passed via `--set-string`, preventing them from being stored in version control. A README.md file is included with instructions on how to install and configure the chart.
1 parent 2e161d8 commit 49e6a12

File tree

11 files changed

+468
-0
lines changed

11 files changed

+468
-0
lines changed

‎charts/kubernetes-mcp-server/Chart.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: kubernetes-mcp-server
3+
description: A Helm chart for the Kubernetes Model Context Protocol (MCP) server
4+
type: application
5+
version: 0.1.0
6+
appVersion: "1.0"

‎charts/kubernetes-mcp-server/README.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Kubernetes MCP Server
2+
3+
A Helm chart for the Kubernetes Model Context Protocol (MCP) server.
4+
5+
## Prerequisites
6+
7+
- Kubernetes 1.16+
8+
- Helm 3+
9+
10+
## Installing the Chart
11+
12+
To install the chart with the release name `my-release`:
13+
14+
```bash
15+
helm install my-release .
16+
```
17+
18+
The command deploys the Kubernetes MCP server on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation.
19+
20+
## Uninstalling the Chart
21+
22+
To uninstall/delete the `my-release` deployment:
23+
24+
```bash
25+
helm delete my-release
26+
```
27+
28+
The command removes all the Kubernetes components associated with the chart and deletes the release.
29+
30+
## Parameters
31+
32+
The following table lists the configurable parameters of the Kubernetes MCP server chart and their default values.
33+
34+
| Parameter | Description | Default |
35+
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- |
36+
| `replicaCount` | Number of replicas to deploy. | `1` |
37+
| `image.repository` | Image repository. | `aihorde/kubernetes-mcp-server` |
38+
| `image.pullPolicy` | Image pull policy. | `IfNotPresent` |
39+
| `image.tag` | Image tag. Overrides the chart's `appVersion`. | `""` |
40+
| `imagePullSecrets` | Image pull secrets. | `[]` |
41+
| `nameOverride` | String to override the name of the chart. | `""` |
42+
| `fullnameOverride` | String to override the fully qualified app name. | `""` |
43+
| `serviceAccount.create` | If `true`, a new service account is created. If `false`, you must provide the name of an existing service account in `serviceAccount.name`. | `false` |
44+
| `serviceAccount.name` | The name of the service account to use. Required if `serviceAccount.create` is `false`. | `""` |
45+
| `podAnnotations` | Annotations to add to the pod. | `{}` |
46+
| `podSecurityContext` | Pod security context. | `{}` |
47+
| `securityContext` | Container security context. | `{}` |
48+
| `service.type` | Service type. | `ClusterIP` |
49+
| `service.port` | Service port. | `8080` |
50+
| `ingress.enabled` | Enable ingress. | `false` |
51+
| `ingress.className` | Ingress class name. | `""` |
52+
| `ingress.annotations` | Ingress annotations. | `{}` |
53+
| `ingress.hosts` | Ingress hosts. | `[]` |
54+
| `ingress.tls` | Ingress TLS configuration. | `[]` |
55+
| `resources` | Resource requests and limits. | `{}` |
56+
| `autoscaling.enabled` | Enable autoscaling. | `false` |
57+
| `nodeSelector` | Node selector. | `{}` |
58+
| `tolerations` | Tolerations. | `[]` |
59+
| `affinity` | Affinity. | `{}` |
60+
| `rbac.create` | If `true`, a `Role` and `RoleBinding` will be created for the service account. If `false`, the chart will rely on existing permissions. | `true` |
61+
| `config` | Application-specific configuration. See the [Application Configuration](#application-configuration) section for more details. | `{}` |
62+
63+
## Application Configuration
64+
65+
The `config` parameter allows you to configure the Kubernetes MCP server. The following options are available:
66+
67+
| Parameter | Description | Default |
68+
| ------------------------------ | ------------------------------------------------------------------------------ | ----------- |
69+
| `logLevel` | Log level (from 0 to 9). | `0` |
70+
| `readOnly` | If true, only tools annotated with `readOnlyHint=true` are exposed. | `true` |
71+
| `disableDestructive` | If true, tools annotated with `destructiveHint=true` are disabled. | `true` |
72+
| `toolsets` | List of MCP toolsets to use. | `[]` |
73+
| `denied_resources` | List of resources to deny access to. | `[]` |
74+
| `confluence.url` | URL of the Confluence instance. | `""` |
75+
| `confluence.username` | Confluence username. | `""` |
76+
| `confluence.token` | Confluence API token. **It is strongly recommended to set this via `--set-string` in a CI/CD pipeline rather than in the values file.** | `""` |
77+
| `oauth.require` | If true, requires OAuth authorization. | `false` |
78+
| `oauth.audience` | OAuth audience for token claims validation. | `""` |
79+
| `oauth.validateToken` | If true, validates the token against the Kubernetes API Server. | `false` |
80+
| `oauth.authorizationUrl` | OAuth authorization server URL. | `""` |
81+
| `oauth.serverUrl` | Server URL of this application. | `""` |
82+
| `oauth.certificateAuthority` | Path to the certificate authority file to verify certificates. | `""` |

‎charts/kubernetes-mcp-server/templates/NOTES.txt‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
1. Get the application URL by running these commands:
2+
{{- if .Values.ingress.enabled }}
3+
{{- range .Values.ingress.hosts }}
4+
{{- if .tls }}
5+
https://{{ .host }}{{ .path }}
6+
{{- else }}
7+
http://{{ .host }}{{ .path }}
8+
{{- end }}
9+
{{- end }}
10+
{{- else if contains "NodePort" .Values.service.type }}
11+
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "kubernetes-mcp-server.fullname" . }})
12+
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
13+
echo http://$NODE_IP:$NODE_PORT
14+
{{- else if contains "LoadBalancer" .Values.service.type }}
15+
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
16+
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "kubernetes-mcp-server.fullname" . }}'
17+
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "kubernetes-mcp-server.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
18+
echo http://$SERVICE_IP:{{ .Values.service.port }}
19+
{{- else if contains "ClusterIP" .Values.service.type }}
20+
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "kubernetes-mcp-server.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
21+
echo "Visit http://127.0.0.1:8080 to use the application"
22+
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:{{ .Values.service.port }}
23+
{{- end }}

‎charts/kubernetes-mcp-server/templates/_helpers.tpl‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "kubernetes-mcp-server.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "kubernetes-mcp-server.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "kubernetes-mcp-server.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "kubernetes-mcp-server.labels" -}}
37+
helm.sh/chart: {{ include "kubernetes-mcp-server.chart" . }}
38+
{{ include "kubernetes-mcp-server.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "kubernetes-mcp-server.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "kubernetes-mcp-server.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "kubernetes-mcp-server.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "kubernetes-mcp-server.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎charts/kubernetes-mcp-server/templates/configmap.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{{- if .Values.config -}}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ include "kubernetes-mcp-server.fullname" . }}-config
6+
labels:
7+
{{- include "kubernetes-mcp-server.labels" . | nindent 4 }}
8+
data:
9+
config.toml: |-
10+
log_level = {{ .Values.config.logLevel | default 0 }}
11+
read_only = {{ .Values.config.readOnly | default false }}
12+
disable_destructive = {{ .Values.config.disableDestructive | default false }}
13+
{{- if .Values.config.toolsets }}
14+
toolsets = {{ .Values.config.toolsets | toJson }}
15+
{{- end }}
16+
{{- if .Values.config.denied_resources }}
17+
denied_resources = {{ .Values.config.denied_resources | toJson }}
18+
{{- end }}
19+
{{- if .Values.config.confluence.url }}
20+
[confluence]
21+
url = "{{ .Values.config.confluence.url }}"
22+
username = "{{ .Values.config.confluence.username }}"
23+
token = "{{ .Values.config.confluence.token }}"
24+
{{- end }}
25+
{{- if .Values.config.oauth.require }}
26+
[oauth]
27+
require = {{ .Values.config.oauth.require }}
28+
{{- if .Values.config.oauth.audience }}
29+
audience = "{{ .Values.config.oauth.audience }}"
30+
{{- end }}
31+
{{- if .Values.config.oauth.validateToken }}
32+
validateToken = {{ .Values.config.oauth.validateToken }}
33+
{{- end }}
34+
{{- if .Values.config.oauth.authorizationUrl }}
35+
authorizationUrl = "{{ .Values.config.oauth.authorizationUrl }}"
36+
{{- end }}
37+
{{- if .Values.config.oauth.serverUrl }}
38+
serverUrl = "{{ .Values.config.oauth.serverUrl }}"
39+
{{- end }}
40+
{{- if .Values.config.oauth.certificateAuthority }}
41+
certificateAuthority = "{{ .Values.config.oauth.certificateAuthority }}"
42+
{{- end }}
43+
{{- end }}
44+
{{- end }}

‎charts/kubernetes-mcp-server/templates/deployment.yaml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "kubernetes-mcp-server.fullname" . }}
5+
labels:
6+
{{- include "kubernetes-mcp-server.labels" . | nindent 4 }}
7+
spec:
8+
{{- if not .Values.autoscaling.enabled }}
9+
replicas: {{ .Values.replicaCount }}
10+
{{- end }}
11+
selector:
12+
matchLabels:
13+
{{- include "kubernetes-mcp-server.selectorLabels" . | nindent 6 }}
14+
template:
15+
metadata:
16+
{{- with .Values.podAnnotations }}
17+
annotations:
18+
{{- toYaml . | nindent 8 }}
19+
{{- end }}
20+
labels:
21+
{{- include "kubernetes-mcp-server.selectorLabels" . | nindent 8 }}
22+
spec:
23+
{{- with .Values.imagePullSecrets }}
24+
imagePullSecrets:
25+
{{- toYaml . | nindent 8 }}
26+
{{- end }}
27+
serviceAccountName: {{ include "kubernetes-mcp-server.serviceAccountName" . }}
28+
securityContext:
29+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
30+
containers:
31+
- name: {{ .Chart.Name }}
32+
securityContext:
33+
{{- toYaml .Values.securityContext | nindent 12 }}
34+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
35+
imagePullPolicy: {{ .Values.image.pullPolicy }}
36+
command:
37+
- /usr/local/bin/kubernetes-mcp-server
38+
args:
39+
- --config=/etc/kubernetes-mcp-server/config.toml
40+
- --port={{ .Values.service.port }}
41+
volumeMounts:
42+
- name: config
43+
mountPath: /etc/kubernetes-mcp-server
44+
readOnly: true
45+
ports:
46+
- name: http
47+
containerPort: {{ .Values.service.port }}
48+
protocol: TCP
49+
livenessProbe:
50+
httpGet:
51+
path: /
52+
port: http
53+
readinessProbe:
54+
httpGet:
55+
path: /
56+
port: http
57+
resources:
58+
{{- toYaml .Values.resources | nindent 12 }}
59+
volumes:
60+
- name: config
61+
configMap:
62+
name: {{ include "kubernetes-mcp-server.fullname" . }}-config
63+
{{- with .Values.nodeSelector }}
64+
nodeSelector:
65+
{{- toYaml . | nindent 8 }}
66+
{{- end }}
67+
{{- with .Values.affinity }}
68+
affinity:
69+
{{- toYaml . | nindent 8 }}
70+
{{- end }}
71+
{{- with .Values.tolerations }}
72+
tolerations:
73+
{{- toYaml . | nindent 8 }}
74+
{{- end }}

‎charts/kubernetes-mcp-server/templates/role.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if .Values.rbac.create -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: Role
4+
metadata:
5+
name: {{ include "kubernetes-mcp-server.fullname" . }}
6+
labels:
7+
{{- include "kubernetes-mcp-server.labels" . | nindent 4 }}
8+
rules:
9+
- apiGroups: [""]
10+
resources: ["pods", "pods/log", "services", "configmaps", "secrets", "persistentvolumeclaims", "events"]
11+
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
12+
- apiGroups: ["apps"]
13+
resources: ["deployments", "daemonsets", "replicasets", "statefulsets"]
14+
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
15+
- apiGroups: ["batch"]
16+
resources: ["jobs", "cronjobs"]
17+
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
18+
- apiGroups: ["networking.k8s.io"]
19+
resources: ["ingresses"]
20+
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
21+
{{- end }}

‎charts/kubernetes-mcp-server/templates/rolebinding.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{- if .Values.rbac.create -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: RoleBinding
4+
metadata:
5+
name: {{ include "kubernetes-mcp-server.fullname" . }}
6+
labels:
7+
{{- include "kubernetes-mcp-server.labels" . | nindent 4 }}
8+
roleRef:
9+
apiGroup: rbac.authorization.k8s.io
10+
kind: Role
11+
name: {{ include "kubernetes-mcp-server.fullname" . }}
12+
subjects:
13+
- kind: ServiceAccount
14+
name: {{ include "kubernetes-mcp-server.serviceAccountName" . }}
15+
namespace: {{ .Release.Namespace }}
16+
{{- end }}

‎charts/kubernetes-mcp-server/templates/service.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: {{ include "kubernetes-mcp-server.fullname" . }}
5+
labels:
6+
{{- include "kubernetes-mcp-server.labels" . | nindent 4 }}
7+
spec:
8+
type: {{ .Values.service.type }}
9+
ports:
10+
- port: {{ .Values.service.port }}
11+
targetPort: http
12+
protocol: TCP
13+
name: http
14+
selector:
15+
{{- include "kubernetes-mcp-server.selectorLabels" . | nindent 4 }}

‎charts/kubernetes-mcp-server/templates/serviceaccount.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{- if .Values.serviceAccount.create -}}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "kubernetes-mcp-server.serviceAccountName" . }}
6+
labels:
7+
{{- include "kubernetes-mcp-server.labels" . | nindent 4 }}
8+
{{- with .Values.serviceAccount.annotations }}
9+
annotations:
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
{{- end }}

0 commit comments

Comments
 (0)