tegwick
6d04544368
No MCP server ran on central, so remote agents reached dev-hub only through a reverse tunnel back to the workstation — routing a request for a service on their own machine out to another host and back. Adds a gated mcp Deployment and ClusterIP Service running the same image with `-m mcp_server.server`, API_BASE defaulted to the in-cluster API Service, and tcpSocket probes. No Ingress: the MCP layer proxies an unauthenticated API and must not be reachable from outside the cluster. Two fixes were needed before the manifests could work: - server.py hardcoded host="127.0.0.1". A Service routes to the pod IP, so a loopback bind is unreachable. Now MCP_HOST, still defaulting to loopback so local runs do not silently expose an unauthenticated proxy. - The container runs `-m mcp_server.server`, not the file path, so /app lands on sys.path rather than /app/mcp_server. mcp.enabled stays false in the deploy values: the running image predates MCP_HOST, so enabling it before the tag is bumped would ship a pod that never becomes reachable. Refs CUST-WP-0067-T08 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
17 lines
574 B
YAML
17 lines
574 B
YAML
{{- if .Values.mcp.enabled }}
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: {{ include "statehub.mcpFullname" . }}
|
|
labels: {{- include "statehub.mcpLabels" . | nindent 4 }}
|
|
spec:
|
|
# ClusterIP only, and deliberately no Ingress: the MCP layer proxies an
|
|
# unauthenticated API and must not be reachable from outside the cluster.
|
|
type: ClusterIP
|
|
ports:
|
|
- port: {{ .Values.mcp.service.port }}
|
|
targetPort: {{ .Values.mcp.service.targetPort }}
|
|
protocol: TCP
|
|
name: sse
|
|
selector: {{- include "statehub.mcpSelectorLabels" . | nindent 4 }}
|
|
{{- end }}
|