An Ansible collection for deploying MCP (Model Context Protocol) demo and lab environments on Red Hat OpenShift.
This collection provides automation for setting up a complete MCP demonstration environment, including:
-
MCP OpenShift Server - Kubernetes/OpenShift MCP server for cluster interaction
-
MCP Gitea Server - Git repository MCP server integration
-
LibreChat - AI chat interface with MCP support
-
AI Agent - Autonomous agent service
The collection uses GitOps (ArgoCD ApplicationSets) to deploy and manage all components.
Namespace |
|
Name |
|
Version |
1.0.0 |
License |
GPL-2.0-or-later |
Author |
Wolfgang Kulhanek <wkulhane@redhat.com> |
-
Red Hat OpenShift 4.x cluster
-
OpenShift GitOps (ArgoCD) installed and configured
-
Gitea instance with users pre-configured (typically via Gitea Operator)
-
LiteMaaS or compatible LLM API endpoint
-
kubernetes.coreAnsible collection installed -
agnosticd.coreAnsible collection installed
Install the collection from Ansible Galaxy:
ansible-galaxy collection install rhpds.mcp_workloadsOr include in your requirements.yml:
collections:
- name: rhpds.mcp_workloads
version: ">=1.0.0"Deploys a complete MCP lab environment for multiple users on OpenShift.
This role provisions:
-
Gitea API Tokens - Creates tokens for each user to enable MCP Gitea integration
-
MCP OpenShift Server - Per-user MCP server for OpenShift/Kubernetes API interactions
-
MCP Gitea Server - Per-user MCP server for Git repository operations
-
LibreChat - Per-user AI chat interface preconfigured with MCP endpoints
-
AI Agent - Per-user autonomous agent service
-
Metrics Access - Optionally enables user workload monitoring in OpenShift
The role supports two actions controlled by the ACTION variable:
-
provision- Deploy the MCP workload environment -
destroy- Remove the deployed workload (not fully implemented)
| Variable | Default | Description |
|---|---|---|
|
|
Number of users to provision |
|
|
Base username prefix (users will be |
| Variable | Default | Description |
|---|---|---|
|
LiteMaaS API endpoint URL |
|
|
|
List of API keys for LiteMaaS (set from secrets/vaults) |
|
|
List of available AI models |
| Variable | Default | Description |
|---|---|---|
|
GitOps repository URL |
|
|
|
Git branch/tag to use |
|
|
Path to Helm chart in GitOps repo |
|
|
Base namespace for OpenShift MCP server |
|
|
Container image for OpenShift MCP server |
| Variable | Default | Description |
|---|---|---|
|
|
Path to Helm chart in GitOps repo |
|
|
Base namespace for Gitea MCP server |
|
|
Container image for Gitea MCP server |
|
|
External Gitea URL |
|
Internal Gitea service URL |
|
|
|
Default repository name |
|
|
Base username for Gitea (matches user base) |
|
|
Gitea user password (set from secrets/vaults) |
| Variable | Default | Description |
|---|---|---|
|
|
Base namespace for LibreChat |
|
LibreChat Helm chart repository |
|
|
|
LibreChat version/tag |
|
|
Path to LibreChat Helm chart |
|
|
Path to LibreChat config chart |
|
|
Email domain for LibreChat user accounts |
|
|
LibreChat user password (set from secrets/vaults) |
| Variable | Default | Description |
|---|---|---|
|
|
Path to Agent Helm chart in GitOps repo |
|
|
Base namespace for Agent service |
|
|
AI model for the agent |
The following variables must be provided from secure sources (Ansible Vault, external secrets manager):
-
ocp4_workload_mcp_user_litemaas_keys- LiteMaaS API keys -
ocp4_workload_mcp_user_gitea_user_password- Gitea user password -
ocp4_workload_mcp_user_librechat_password- LibreChat user password
- name: Deploy MCP Demo Environment
hosts: localhost
vars:
ACTION: provision
ocp4_workload_mcp_user_num_users: 5
ocp4_workload_mcp_user_user_base: student
ocp4_workload_mcp_user_gitea_user_password: "{{ vault_gitea_password }}"
ocp4_workload_mcp_user_librechat_password: "{{ vault_librechat_password }}"
ocp4_workload_mcp_user_litemaas_keys:
- "{{ vault_litemaas_key_1 }}"
- "{{ vault_litemaas_key_2 }}"
roles:
- rhpds.mcp_workloads.ocp4_workload_mcp_userAfter provisioning, the role saves user-specific information using agnosticd.core.agnosticd_user_info:
| Key | Description |
|---|---|
|
Username (e.g., |
|
LibreChat instance URL |
|
LibreChat login email |
|
LibreChat password |
|
OpenShift MCP server SSE endpoint |
|
Gitea MCP server endpoint |
The role creates the following ArgoCD ApplicationSets:
-
applicationset-mcp-openshift - MCP server for Kubernetes/OpenShift API
-
applicationset-mcp-gitea - MCP server for Gitea Git operations
-
applicationset-librechat-config - LibreChat configuration
-
applicationset-librechat - LibreChat application
-
applicationset-agent - AI Agent service
A custom SCC is created to allow the MCP containers to run with the required permissions.
+-------------------+
| OpenShift |
| GitOps/ArgoCD |
+--------+----------+
|
+--------------------+--------------------+
| | |
v v v
+--------+--------+ +--------+--------+ +--------+--------+
| MCP OpenShift | | MCP Gitea | | LibreChat |
| Server | | Server | | + Agent |
| (per user) | | (per user) | | (per user) |
+-----------------+ +-----------------+ +-----------------+
| | |
v v v
+--------+--------+ +--------+--------+ +--------+--------+
| OpenShift API | | Gitea API | | LiteMaaS LLM |
+-----------------+ +-----------------+ +-----------------+- Gitea token creation fails
-
Ensure the Gitea users exist and the password is correct. Verify Gitea is accessible at the configured URL.
- ApplicationSets not syncing
-
Check ArgoCD logs and ensure the GitOps repository is accessible. Verify the repository path and tag are correct.
- LibreChat not accessible
-
Verify the OpenShift routes are created and the ingress domain is correct.
Wolfgang Kulhanek <wkulhane@redhat.com>