update crds
This commit is contained in:
@@ -0,0 +1,373 @@
|
||||
{
|
||||
"description": "EmbeddingServer is the deprecated v1alpha1 version of the EmbeddingServer resource.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "EmbeddingServerSpec defines the desired state of EmbeddingServer",
|
||||
"properties": {
|
||||
"args": {
|
||||
"description": "Args are additional arguments to pass to the embedding inference server",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"env": {
|
||||
"description": "Env are environment variables to set in the container",
|
||||
"items": {
|
||||
"description": "EnvVar represents an environment variable in a container",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the environment variable",
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value of the environment variable",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"value"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"hfTokenSecretRef": {
|
||||
"description": "HFTokenSecretRef is a reference to a Kubernetes Secret containing the huggingface token.\nIf provided, the secret value will be provided to the embedding server for authentication with huggingface.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"image": {
|
||||
"default": "ghcr.io/huggingface/text-embeddings-inference:cpu-latest",
|
||||
"description": "Image is the container image for the embedding inference server.\nImages must be from HuggingFace Text Embeddings Inference (https://github.com/huggingface/text-embeddings-inference).",
|
||||
"type": "string"
|
||||
},
|
||||
"imagePullPolicy": {
|
||||
"default": "IfNotPresent",
|
||||
"description": "ImagePullPolicy defines the pull policy for the container image",
|
||||
"enum": [
|
||||
"Always",
|
||||
"Never",
|
||||
"IfNotPresent"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"model": {
|
||||
"default": "BAAI/bge-small-en-v1.5",
|
||||
"description": "Model is the HuggingFace embedding model to use (e.g., \"sentence-transformers/all-MiniLM-L6-v2\")",
|
||||
"type": "string"
|
||||
},
|
||||
"modelCache": {
|
||||
"description": "ModelCache configures persistent storage for downloaded models\nWhen enabled, models are cached in a PVC and reused across pod restarts",
|
||||
"properties": {
|
||||
"accessMode": {
|
||||
"default": "ReadWriteOnce",
|
||||
"description": "AccessMode is the access mode for the PVC",
|
||||
"enum": [
|
||||
"ReadWriteOnce",
|
||||
"ReadWriteMany",
|
||||
"ReadOnlyMany"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"enabled": {
|
||||
"default": true,
|
||||
"description": "Enabled controls whether model caching is enabled",
|
||||
"type": "boolean"
|
||||
},
|
||||
"size": {
|
||||
"default": "10Gi",
|
||||
"description": "Size is the size of the PVC for model caching (e.g., \"10Gi\")",
|
||||
"type": "string"
|
||||
},
|
||||
"storageClassName": {
|
||||
"description": "StorageClassName is the storage class to use for the PVC\nIf not specified, uses the cluster's default storage class",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"podTemplateSpec": {
|
||||
"description": "PodTemplateSpec allows customizing the pod (node selection, tolerations, etc.)\nThis field accepts a PodTemplateSpec object as JSON/YAML.\nNote that to modify the specific container the embedding server runs in, you must specify\nthe 'embedding' container name in the PodTemplateSpec.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"port": {
|
||||
"default": 8080,
|
||||
"description": "Port is the port to expose the embedding service on",
|
||||
"format": "int32",
|
||||
"maximum": 65535,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"replicas": {
|
||||
"default": 1,
|
||||
"description": "Replicas is the number of embedding server replicas to run",
|
||||
"format": "int32",
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"resourceOverrides": {
|
||||
"description": "ResourceOverrides allows overriding annotations and labels for resources created by the operator",
|
||||
"properties": {
|
||||
"persistentVolumeClaim": {
|
||||
"description": "PersistentVolumeClaim defines overrides for the PVC resource",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"service": {
|
||||
"description": "Service defines overrides for the Service resource",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"statefulSet": {
|
||||
"description": "StatefulSet defines overrides for the StatefulSet resource",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"podTemplateMetadataOverrides": {
|
||||
"description": "PodTemplateMetadataOverrides defines metadata overrides for the pod template",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"resources": {
|
||||
"description": "Resources defines compute resources for the embedding server",
|
||||
"properties": {
|
||||
"limits": {
|
||||
"description": "Limits describes the maximum amount of compute resources allowed",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)",
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"requests": {
|
||||
"description": "Requests describes the minimum amount of compute resources required",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)",
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "EmbeddingServerStatus defines the observed state of EmbeddingServer",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the EmbeddingServer's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message provides additional information about the current phase",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration reflects the generation most recently observed by the controller",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"phase": {
|
||||
"description": "Phase is the current phase of the EmbeddingServer",
|
||||
"enum": [
|
||||
"Pending",
|
||||
"Downloading",
|
||||
"Ready",
|
||||
"Failed",
|
||||
"Terminating"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"readyReplicas": {
|
||||
"description": "ReadyReplicas is the number of ready replicas",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the URL where the embedding service can be accessed",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,373 @@
|
||||
{
|
||||
"description": "EmbeddingServer is the Schema for the embeddingservers API",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "EmbeddingServerSpec defines the desired state of EmbeddingServer",
|
||||
"properties": {
|
||||
"args": {
|
||||
"description": "Args are additional arguments to pass to the embedding inference server",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"env": {
|
||||
"description": "Env are environment variables to set in the container",
|
||||
"items": {
|
||||
"description": "EnvVar represents an environment variable in a container",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the environment variable",
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value of the environment variable",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"value"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"hfTokenSecretRef": {
|
||||
"description": "HFTokenSecretRef is a reference to a Kubernetes Secret containing the huggingface token.\nIf provided, the secret value will be provided to the embedding server for authentication with huggingface.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"image": {
|
||||
"default": "ghcr.io/huggingface/text-embeddings-inference:cpu-latest",
|
||||
"description": "Image is the container image for the embedding inference server.\nImages must be from HuggingFace Text Embeddings Inference (https://github.com/huggingface/text-embeddings-inference).",
|
||||
"type": "string"
|
||||
},
|
||||
"imagePullPolicy": {
|
||||
"default": "IfNotPresent",
|
||||
"description": "ImagePullPolicy defines the pull policy for the container image",
|
||||
"enum": [
|
||||
"Always",
|
||||
"Never",
|
||||
"IfNotPresent"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"model": {
|
||||
"default": "BAAI/bge-small-en-v1.5",
|
||||
"description": "Model is the HuggingFace embedding model to use (e.g., \"sentence-transformers/all-MiniLM-L6-v2\")",
|
||||
"type": "string"
|
||||
},
|
||||
"modelCache": {
|
||||
"description": "ModelCache configures persistent storage for downloaded models\nWhen enabled, models are cached in a PVC and reused across pod restarts",
|
||||
"properties": {
|
||||
"accessMode": {
|
||||
"default": "ReadWriteOnce",
|
||||
"description": "AccessMode is the access mode for the PVC",
|
||||
"enum": [
|
||||
"ReadWriteOnce",
|
||||
"ReadWriteMany",
|
||||
"ReadOnlyMany"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"enabled": {
|
||||
"default": true,
|
||||
"description": "Enabled controls whether model caching is enabled",
|
||||
"type": "boolean"
|
||||
},
|
||||
"size": {
|
||||
"default": "10Gi",
|
||||
"description": "Size is the size of the PVC for model caching (e.g., \"10Gi\")",
|
||||
"type": "string"
|
||||
},
|
||||
"storageClassName": {
|
||||
"description": "StorageClassName is the storage class to use for the PVC\nIf not specified, uses the cluster's default storage class",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"podTemplateSpec": {
|
||||
"description": "PodTemplateSpec allows customizing the pod (node selection, tolerations, etc.)\nThis field accepts a PodTemplateSpec object as JSON/YAML.\nNote that to modify the specific container the embedding server runs in, you must specify\nthe 'embedding' container name in the PodTemplateSpec.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"port": {
|
||||
"default": 8080,
|
||||
"description": "Port is the port to expose the embedding service on",
|
||||
"format": "int32",
|
||||
"maximum": 65535,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"replicas": {
|
||||
"default": 1,
|
||||
"description": "Replicas is the number of embedding server replicas to run",
|
||||
"format": "int32",
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"resourceOverrides": {
|
||||
"description": "ResourceOverrides allows overriding annotations and labels for resources created by the operator",
|
||||
"properties": {
|
||||
"persistentVolumeClaim": {
|
||||
"description": "PersistentVolumeClaim defines overrides for the PVC resource",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"service": {
|
||||
"description": "Service defines overrides for the Service resource",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"statefulSet": {
|
||||
"description": "StatefulSet defines overrides for the StatefulSet resource",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"podTemplateMetadataOverrides": {
|
||||
"description": "PodTemplateMetadataOverrides defines metadata overrides for the pod template",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"resources": {
|
||||
"description": "Resources defines compute resources for the embedding server",
|
||||
"properties": {
|
||||
"limits": {
|
||||
"description": "Limits describes the maximum amount of compute resources allowed",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)",
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"requests": {
|
||||
"description": "Requests describes the minimum amount of compute resources required",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)",
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "EmbeddingServerStatus defines the observed state of EmbeddingServer",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the EmbeddingServer's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message provides additional information about the current phase",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration reflects the generation most recently observed by the controller",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"phase": {
|
||||
"description": "Phase is the current phase of the EmbeddingServer",
|
||||
"enum": [
|
||||
"Pending",
|
||||
"Downloading",
|
||||
"Ready",
|
||||
"Failed",
|
||||
"Terminating"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"readyReplicas": {
|
||||
"description": "ReadyReplicas is the number of ready replicas",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the URL where the embedding service can be accessed",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,149 @@
|
||||
{
|
||||
"description": "MCPGroup is the deprecated v1alpha1 version of the MCPGroup resource.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPGroupSpec defines the desired state of MCPGroup",
|
||||
"properties": {
|
||||
"description": {
|
||||
"description": "Description provides human-readable context",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPGroupStatus defines observed state",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent observations",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"entries": {
|
||||
"description": "Entries lists MCPServerEntry names in this group",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "set"
|
||||
},
|
||||
"entryCount": {
|
||||
"description": "EntryCount is the number of MCPServerEntries",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration reflects the generation most recently observed by the controller",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"phase": {
|
||||
"default": "Pending",
|
||||
"description": "Phase indicates current state",
|
||||
"enum": [
|
||||
"Ready",
|
||||
"Pending",
|
||||
"Failed"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"remoteProxies": {
|
||||
"description": "RemoteProxies lists MCPRemoteProxy names in this group",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "set"
|
||||
},
|
||||
"remoteProxyCount": {
|
||||
"description": "RemoteProxyCount is the number of MCPRemoteProxies",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"serverCount": {
|
||||
"description": "ServerCount is the number of MCPServers",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"servers": {
|
||||
"description": "Servers lists MCPServer names in this group",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "set"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,149 @@
|
||||
{
|
||||
"description": "MCPGroup is the Schema for the mcpgroups API",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPGroupSpec defines the desired state of MCPGroup",
|
||||
"properties": {
|
||||
"description": {
|
||||
"description": "Description provides human-readable context",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPGroupStatus defines observed state",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent observations",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"entries": {
|
||||
"description": "Entries lists MCPServerEntry names in this group",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "set"
|
||||
},
|
||||
"entryCount": {
|
||||
"description": "EntryCount is the number of MCPServerEntries",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration reflects the generation most recently observed by the controller",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"phase": {
|
||||
"default": "Pending",
|
||||
"description": "Phase indicates current state",
|
||||
"enum": [
|
||||
"Ready",
|
||||
"Pending",
|
||||
"Failed"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"remoteProxies": {
|
||||
"description": "RemoteProxies lists MCPRemoteProxy names in this group",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "set"
|
||||
},
|
||||
"remoteProxyCount": {
|
||||
"description": "RemoteProxyCount is the number of MCPRemoteProxies",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"serverCount": {
|
||||
"description": "ServerCount is the number of MCPServers",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"servers": {
|
||||
"description": "Servers lists MCPServer names in this group",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "set"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,286 @@
|
||||
{
|
||||
"description": "MCPOIDCConfig is the deprecated v1alpha1 version of the MCPOIDCConfig resource.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPOIDCConfigSpec defines the desired state of MCPOIDCConfig.\nMCPOIDCConfig resources are namespace-scoped and can only be referenced by\nMCPServer resources in the same namespace.",
|
||||
"properties": {
|
||||
"inline": {
|
||||
"description": "Inline contains direct OIDC configuration.\nOnly used when Type is \"inline\".",
|
||||
"properties": {
|
||||
"caBundleRef": {
|
||||
"description": "CABundleRef references a ConfigMap containing the CA certificate bundle.\nWhen specified, ToolHive auto-mounts the ConfigMap and auto-computes ThvCABundlePath.",
|
||||
"properties": {
|
||||
"configMapRef": {
|
||||
"description": "ConfigMapRef references a ConfigMap containing the CA certificate bundle.\nIf Key is not specified, it defaults to \"ca.crt\".",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
},
|
||||
"optional": {
|
||||
"description": "Specify whether the ConfigMap or its key must be defined",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"clientId": {
|
||||
"description": "ClientID is the OIDC client ID",
|
||||
"type": "string"
|
||||
},
|
||||
"clientSecretRef": {
|
||||
"description": "ClientSecretRef is a reference to a Kubernetes Secret containing the client secret",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"insecureAllowHTTP": {
|
||||
"default": false,
|
||||
"description": "InsecureAllowHTTP allows HTTP (non-HTTPS) OIDC issuers for development/testing.\nWARNING: This is insecure and should NEVER be used in production.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"introspectionUrl": {
|
||||
"description": "IntrospectionURL is the URL for token introspection endpoint",
|
||||
"type": "string"
|
||||
},
|
||||
"issuer": {
|
||||
"description": "Issuer is the OIDC issuer URL",
|
||||
"type": "string"
|
||||
},
|
||||
"jwksAllowPrivateIP": {
|
||||
"default": false,
|
||||
"description": "JWKSAllowPrivateIP allows JWKS/OIDC endpoints on private IP addresses.\nNote: at runtime, if either JWKSAllowPrivateIP or ProtectedResourceAllowPrivateIP\nis true, private IPs are allowed for all OIDC HTTP requests (JWKS, discovery, introspection).",
|
||||
"type": "boolean"
|
||||
},
|
||||
"jwksAuthTokenPath": {
|
||||
"description": "JWKSAuthTokenPath is the path to file containing bearer token for JWKS/OIDC requests",
|
||||
"type": "string"
|
||||
},
|
||||
"jwksUrl": {
|
||||
"description": "JWKSURL is the URL to fetch the JWKS from",
|
||||
"type": "string"
|
||||
},
|
||||
"protectedResourceAllowPrivateIP": {
|
||||
"default": false,
|
||||
"description": "ProtectedResourceAllowPrivateIP allows protected resource endpoint on private IP addresses.\nNote: at runtime, if either ProtectedResourceAllowPrivateIP or JWKSAllowPrivateIP\nis true, private IPs are allowed for all OIDC HTTP requests (JWKS, discovery, introspection).",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"issuer"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"kubernetesServiceAccount": {
|
||||
"description": "KubernetesServiceAccount configures OIDC for Kubernetes service account token validation.\nOnly used when Type is \"kubernetesServiceAccount\".",
|
||||
"properties": {
|
||||
"introspectionUrl": {
|
||||
"description": "IntrospectionURL is the URL for token introspection endpoint.\nIf empty, OIDC discovery will be used to automatically determine the introspection URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"issuer": {
|
||||
"default": "https://kubernetes.default.svc",
|
||||
"description": "Issuer is the OIDC issuer URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"jwksUrl": {
|
||||
"description": "JWKSURL is the URL to fetch the JWKS from.\nIf empty, OIDC discovery will be used to automatically determine the JWKS URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace is the namespace of the service account.\nIf empty, uses the MCPServer's namespace.",
|
||||
"type": "string"
|
||||
},
|
||||
"serviceAccount": {
|
||||
"description": "ServiceAccount is the name of the service account to validate tokens for.\nIf empty, uses the pod's service account.",
|
||||
"type": "string"
|
||||
},
|
||||
"useClusterAuth": {
|
||||
"description": "UseClusterAuth enables using the Kubernetes cluster's CA bundle and service account token.\nWhen true, uses /var/run/secrets/kubernetes.io/serviceaccount/ca.crt for TLS verification\nand /var/run/secrets/kubernetes.io/serviceaccount/token for bearer token authentication.\nDefaults to true if not specified.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": {
|
||||
"description": "Type is the type of OIDC configuration source",
|
||||
"enum": [
|
||||
"kubernetesServiceAccount",
|
||||
"inline"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "kubernetesServiceAccount must be set when type is 'kubernetesServiceAccount', and must not be set otherwise",
|
||||
"rule": "self.type == 'kubernetesServiceAccount' ? has(self.kubernetesServiceAccount) : !has(self.kubernetesServiceAccount)"
|
||||
},
|
||||
{
|
||||
"message": "inline must be set when type is 'inline', and must not be set otherwise",
|
||||
"rule": "self.type == 'inline' ? has(self.inline) : !has(self.inline)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPOIDCConfigStatus defines the observed state of MCPOIDCConfig",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPOIDCConfig's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"configHash": {
|
||||
"description": "ConfigHash is a hash of the current configuration for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration is the most recent generation observed for this MCPOIDCConfig.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"referenceCount": {
|
||||
"description": "ReferenceCount is the number of workloads referencing this config.",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"referencingWorkloads": {
|
||||
"description": "ReferencingWorkloads is a list of workload resources that reference this MCPOIDCConfig.\nEach entry identifies the workload by kind and name.",
|
||||
"items": {
|
||||
"description": "WorkloadReference identifies a workload that references a shared configuration resource.\nNamespace is implicit \u2014 cross-namespace references are not supported.",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"description": "Kind is the type of workload resource",
|
||||
"enum": [
|
||||
"MCPServer",
|
||||
"VirtualMCPServer",
|
||||
"MCPRemoteProxy"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the workload resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,286 @@
|
||||
{
|
||||
"description": "MCPOIDCConfig is the Schema for the mcpoidcconfigs API.\nMCPOIDCConfig resources are namespace-scoped and can only be referenced by\nMCPServer resources within the same namespace. Cross-namespace references\nare not supported for security and isolation reasons.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPOIDCConfigSpec defines the desired state of MCPOIDCConfig.\nMCPOIDCConfig resources are namespace-scoped and can only be referenced by\nMCPServer resources in the same namespace.",
|
||||
"properties": {
|
||||
"inline": {
|
||||
"description": "Inline contains direct OIDC configuration.\nOnly used when Type is \"inline\".",
|
||||
"properties": {
|
||||
"caBundleRef": {
|
||||
"description": "CABundleRef references a ConfigMap containing the CA certificate bundle.\nWhen specified, ToolHive auto-mounts the ConfigMap and auto-computes ThvCABundlePath.",
|
||||
"properties": {
|
||||
"configMapRef": {
|
||||
"description": "ConfigMapRef references a ConfigMap containing the CA certificate bundle.\nIf Key is not specified, it defaults to \"ca.crt\".",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
},
|
||||
"optional": {
|
||||
"description": "Specify whether the ConfigMap or its key must be defined",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"clientId": {
|
||||
"description": "ClientID is the OIDC client ID",
|
||||
"type": "string"
|
||||
},
|
||||
"clientSecretRef": {
|
||||
"description": "ClientSecretRef is a reference to a Kubernetes Secret containing the client secret",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"insecureAllowHTTP": {
|
||||
"default": false,
|
||||
"description": "InsecureAllowHTTP allows HTTP (non-HTTPS) OIDC issuers for development/testing.\nWARNING: This is insecure and should NEVER be used in production.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"introspectionUrl": {
|
||||
"description": "IntrospectionURL is the URL for token introspection endpoint",
|
||||
"type": "string"
|
||||
},
|
||||
"issuer": {
|
||||
"description": "Issuer is the OIDC issuer URL",
|
||||
"type": "string"
|
||||
},
|
||||
"jwksAllowPrivateIP": {
|
||||
"default": false,
|
||||
"description": "JWKSAllowPrivateIP allows JWKS/OIDC endpoints on private IP addresses.\nNote: at runtime, if either JWKSAllowPrivateIP or ProtectedResourceAllowPrivateIP\nis true, private IPs are allowed for all OIDC HTTP requests (JWKS, discovery, introspection).",
|
||||
"type": "boolean"
|
||||
},
|
||||
"jwksAuthTokenPath": {
|
||||
"description": "JWKSAuthTokenPath is the path to file containing bearer token for JWKS/OIDC requests",
|
||||
"type": "string"
|
||||
},
|
||||
"jwksUrl": {
|
||||
"description": "JWKSURL is the URL to fetch the JWKS from",
|
||||
"type": "string"
|
||||
},
|
||||
"protectedResourceAllowPrivateIP": {
|
||||
"default": false,
|
||||
"description": "ProtectedResourceAllowPrivateIP allows protected resource endpoint on private IP addresses.\nNote: at runtime, if either ProtectedResourceAllowPrivateIP or JWKSAllowPrivateIP\nis true, private IPs are allowed for all OIDC HTTP requests (JWKS, discovery, introspection).",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"issuer"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"kubernetesServiceAccount": {
|
||||
"description": "KubernetesServiceAccount configures OIDC for Kubernetes service account token validation.\nOnly used when Type is \"kubernetesServiceAccount\".",
|
||||
"properties": {
|
||||
"introspectionUrl": {
|
||||
"description": "IntrospectionURL is the URL for token introspection endpoint.\nIf empty, OIDC discovery will be used to automatically determine the introspection URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"issuer": {
|
||||
"default": "https://kubernetes.default.svc",
|
||||
"description": "Issuer is the OIDC issuer URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"jwksUrl": {
|
||||
"description": "JWKSURL is the URL to fetch the JWKS from.\nIf empty, OIDC discovery will be used to automatically determine the JWKS URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace is the namespace of the service account.\nIf empty, uses the MCPServer's namespace.",
|
||||
"type": "string"
|
||||
},
|
||||
"serviceAccount": {
|
||||
"description": "ServiceAccount is the name of the service account to validate tokens for.\nIf empty, uses the pod's service account.",
|
||||
"type": "string"
|
||||
},
|
||||
"useClusterAuth": {
|
||||
"description": "UseClusterAuth enables using the Kubernetes cluster's CA bundle and service account token.\nWhen true, uses /var/run/secrets/kubernetes.io/serviceaccount/ca.crt for TLS verification\nand /var/run/secrets/kubernetes.io/serviceaccount/token for bearer token authentication.\nDefaults to true if not specified.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": {
|
||||
"description": "Type is the type of OIDC configuration source",
|
||||
"enum": [
|
||||
"kubernetesServiceAccount",
|
||||
"inline"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "kubernetesServiceAccount must be set when type is 'kubernetesServiceAccount', and must not be set otherwise",
|
||||
"rule": "self.type == 'kubernetesServiceAccount' ? has(self.kubernetesServiceAccount) : !has(self.kubernetesServiceAccount)"
|
||||
},
|
||||
{
|
||||
"message": "inline must be set when type is 'inline', and must not be set otherwise",
|
||||
"rule": "self.type == 'inline' ? has(self.inline) : !has(self.inline)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPOIDCConfigStatus defines the observed state of MCPOIDCConfig",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPOIDCConfig's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"configHash": {
|
||||
"description": "ConfigHash is a hash of the current configuration for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration is the most recent generation observed for this MCPOIDCConfig.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"referenceCount": {
|
||||
"description": "ReferenceCount is the number of workloads referencing this config.",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"referencingWorkloads": {
|
||||
"description": "ReferencingWorkloads is a list of workload resources that reference this MCPOIDCConfig.\nEach entry identifies the workload by kind and name.",
|
||||
"items": {
|
||||
"description": "WorkloadReference identifies a workload that references a shared configuration resource.\nNamespace is implicit \u2014 cross-namespace references are not supported.",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"description": "Kind is the type of workload resource",
|
||||
"enum": [
|
||||
"MCPServer",
|
||||
"VirtualMCPServer",
|
||||
"MCPRemoteProxy"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the workload resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,196 @@
|
||||
{
|
||||
"description": "MCPRegistry is the deprecated v1alpha1 version of the MCPRegistry resource.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPRegistrySpec defines the desired state of MCPRegistry",
|
||||
"properties": {
|
||||
"configYAML": {
|
||||
"description": "ConfigYAML is the complete registry server config.yaml content.\nThe operator creates a ConfigMap from this string and mounts it\nat /config/config.yaml in the registry-api container.\nThe operator does NOT parse, validate, or transform this content \u2014\nconfiguration validation is the registry server's responsibility.\n\nSecurity note: this content is stored in a ConfigMap, not a Secret.\nDo not inline credentials (passwords, tokens, client secrets) in this\nfield. Instead, reference credentials via file paths and mount the\nactual secrets using the Volumes and VolumeMounts fields. For database\npasswords, use PGPassSecretRef.",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"displayName": {
|
||||
"description": "DisplayName is a human-readable name for the registry.",
|
||||
"type": "string"
|
||||
},
|
||||
"imagePullSecrets": {
|
||||
"description": "ImagePullSecrets allows specifying image pull secrets for the registry API workload.\nThese are applied to both the registry-api Deployment's PodSpec.ImagePullSecrets\nand to the operator-managed ServiceAccount the registry API runs as, so private\nimages are pullable through either path.\n\nUse this field for new manifests.\n\nImportant: this is the ONLY way to attach image-pull credentials to the\noperator-managed ServiceAccount. The legacy\nspec.podTemplateSpec.spec.imagePullSecrets path populates the Deployment's pod\nspec ONLY \u2014 it does NOT touch the ServiceAccount. On managed Kubernetes\nplatforms that rely on ServiceAccount-level credential injection (for example\nGKE Workload Identity, OpenShift's per-SA dockercfg secrets, EKS IRSA), using\nonly the legacy PodTemplateSpec path can fail to pull private images even when\nthe secret exists in the namespace. Always set spec.imagePullSecrets when\nSA-level credentials matter.\n\nPrecedence with PodTemplateSpec:\n - This field is applied first as the controller-generated default.\n - Values set under spec.podTemplateSpec.spec.imagePullSecrets are user overrides\n and win on overlap. If the user supplies imagePullSecrets via PodTemplateSpec,\n those replace the default list on the Deployment (the list is treated atomically).\n - The ServiceAccount is always populated from this field \u2014 PodTemplateSpec does not\n affect the ServiceAccount.\n\nAn omitted field and an explicitly empty list are equivalent: both leave the\nServiceAccount's existing ImagePullSecrets unchanged. This preserves\nplatform-managed pull secrets (for example OpenShift's per-SA dockercfg\nentries) when overlays or patches emit an empty list. Truly clearing the\nServiceAccount's pull secrets requires recreating the resource.",
|
||||
"items": {
|
||||
"description": "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"pgpassSecretRef": {
|
||||
"description": "PGPassSecretRef references a Secret containing a pre-created pgpass file.\n\nWhy this is a dedicated field instead of a regular volume/volumeMount:\nPostgreSQL's libpq rejects pgpass files that aren't mode 0600. Kubernetes\nsecret volumes mount files as root-owned, and the registry-api container\nruns as non-root (UID 65532). A root-owned 0600 file is unreadable by\nUID 65532, and using fsGroup changes permissions to 0640 which libpq also\nrejects. The only solution is an init container that copies the file to an\nemptyDir as the app user and runs chmod 0600. This cannot be expressed\nthrough volumes/volumeMounts alone -- it requires an init container, two\nextra volumes (secret + emptyDir), a subPath mount, and an environment\nvariable, all wired together correctly.\n\nWhen specified, the operator generates all of that plumbing invisibly.\nThe user creates the Secret with pgpass-formatted content; the operator\nhandles only the Kubernetes permission mechanics.\n\nExample Secret:\n\n\tapiVersion: v1\n\tkind: Secret\n\tmetadata:\n\t name: my-pgpass\n\tstringData:\n\t .pgpass: |\n\t postgres:5432:registry:db_app:mypassword\n\t postgres:5432:registry:db_migrator:otherpassword\n\nThen reference it:\n\n\tpgpassSecretRef:\n\t name: my-pgpass\n\t key: .pgpass",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key of the secret to select from. Must be a valid secret key.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
},
|
||||
"optional": {
|
||||
"description": "Specify whether the Secret or its key must be defined",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"podTemplateSpec": {
|
||||
"description": "PodTemplateSpec defines the pod template to use for the registry API server.\nThis allows for customizing the pod configuration beyond what is provided by the other fields.\nNote that to modify the specific container the registry API server runs in, you must specify\nthe `registry-api` container name in the PodTemplateSpec.\nThis field accepts a PodTemplateSpec object as JSON/YAML.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"volumeMounts": {
|
||||
"description": "VolumeMounts defines additional volume mounts for the registry-api container.\nEach entry is a standard Kubernetes VolumeMount object (JSON/YAML).\nThe operator appends them to the container's volume mounts alongside the config mount.\n\nMount paths must match the file paths referenced in configYAML.\nFor example, if configYAML references passwordFile: /secrets/git-creds/token,\na corresponding volume mount must exist with mountPath: /secrets/git-creds.",
|
||||
"items": {
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"volumes": {
|
||||
"description": "Volumes defines additional volumes to add to the registry API pod.\nEach entry is a standard Kubernetes Volume object (JSON/YAML).\nThe operator appends them to the pod spec alongside its own config volume.\n\nUse these to mount:\n - Secrets (git auth tokens, OAuth client secrets, CA certs)\n - ConfigMaps (registry data files)\n - PersistentVolumeClaims (registry data on persistent storage)\n - Any other volume type the registry server needs",
|
||||
"items": {
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"configYAML"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPRegistryStatus defines the observed state of MCPRegistry",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPRegistry's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message provides additional information about the current phase",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration reflects the generation most recently observed by the controller",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"phase": {
|
||||
"description": "Phase represents the current overall phase of the MCPRegistry",
|
||||
"enum": [
|
||||
"Pending",
|
||||
"Ready",
|
||||
"Failed",
|
||||
"Terminating"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"readyReplicas": {
|
||||
"description": "ReadyReplicas is the number of ready registry API replicas",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the URL where the registry API can be accessed",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,196 @@
|
||||
{
|
||||
"description": "MCPRegistry is the Schema for the mcpregistries API",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPRegistrySpec defines the desired state of MCPRegistry",
|
||||
"properties": {
|
||||
"configYAML": {
|
||||
"description": "ConfigYAML is the complete registry server config.yaml content.\nThe operator creates a ConfigMap from this string and mounts it\nat /config/config.yaml in the registry-api container.\nThe operator does NOT parse, validate, or transform this content \u2014\nconfiguration validation is the registry server's responsibility.\n\nSecurity note: this content is stored in a ConfigMap, not a Secret.\nDo not inline credentials (passwords, tokens, client secrets) in this\nfield. Instead, reference credentials via file paths and mount the\nactual secrets using the Volumes and VolumeMounts fields. For database\npasswords, use PGPassSecretRef.",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"displayName": {
|
||||
"description": "DisplayName is a human-readable name for the registry.",
|
||||
"type": "string"
|
||||
},
|
||||
"imagePullSecrets": {
|
||||
"description": "ImagePullSecrets allows specifying image pull secrets for the registry API workload.\nThese are applied to both the registry-api Deployment's PodSpec.ImagePullSecrets\nand to the operator-managed ServiceAccount the registry API runs as, so private\nimages are pullable through either path.\n\nUse this field for new manifests.\n\nImportant: this is the ONLY way to attach image-pull credentials to the\noperator-managed ServiceAccount. The legacy\nspec.podTemplateSpec.spec.imagePullSecrets path populates the Deployment's pod\nspec ONLY \u2014 it does NOT touch the ServiceAccount. On managed Kubernetes\nplatforms that rely on ServiceAccount-level credential injection (for example\nGKE Workload Identity, OpenShift's per-SA dockercfg secrets, EKS IRSA), using\nonly the legacy PodTemplateSpec path can fail to pull private images even when\nthe secret exists in the namespace. Always set spec.imagePullSecrets when\nSA-level credentials matter.\n\nPrecedence with PodTemplateSpec:\n - This field is applied first as the controller-generated default.\n - Values set under spec.podTemplateSpec.spec.imagePullSecrets are user overrides\n and win on overlap. If the user supplies imagePullSecrets via PodTemplateSpec,\n those replace the default list on the Deployment (the list is treated atomically).\n - The ServiceAccount is always populated from this field \u2014 PodTemplateSpec does not\n affect the ServiceAccount.\n\nAn omitted field and an explicitly empty list are equivalent: both leave the\nServiceAccount's existing ImagePullSecrets unchanged. This preserves\nplatform-managed pull secrets (for example OpenShift's per-SA dockercfg\nentries) when overlays or patches emit an empty list. Truly clearing the\nServiceAccount's pull secrets requires recreating the resource.",
|
||||
"items": {
|
||||
"description": "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"pgpassSecretRef": {
|
||||
"description": "PGPassSecretRef references a Secret containing a pre-created pgpass file.\n\nWhy this is a dedicated field instead of a regular volume/volumeMount:\nPostgreSQL's libpq rejects pgpass files that aren't mode 0600. Kubernetes\nsecret volumes mount files as root-owned, and the registry-api container\nruns as non-root (UID 65532). A root-owned 0600 file is unreadable by\nUID 65532, and using fsGroup changes permissions to 0640 which libpq also\nrejects. The only solution is an init container that copies the file to an\nemptyDir as the app user and runs chmod 0600. This cannot be expressed\nthrough volumes/volumeMounts alone -- it requires an init container, two\nextra volumes (secret + emptyDir), a subPath mount, and an environment\nvariable, all wired together correctly.\n\nWhen specified, the operator generates all of that plumbing invisibly.\nThe user creates the Secret with pgpass-formatted content; the operator\nhandles only the Kubernetes permission mechanics.\n\nExample Secret:\n\n\tapiVersion: v1\n\tkind: Secret\n\tmetadata:\n\t name: my-pgpass\n\tstringData:\n\t .pgpass: |\n\t postgres:5432:registry:db_app:mypassword\n\t postgres:5432:registry:db_migrator:otherpassword\n\nThen reference it:\n\n\tpgpassSecretRef:\n\t name: my-pgpass\n\t key: .pgpass",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key of the secret to select from. Must be a valid secret key.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
},
|
||||
"optional": {
|
||||
"description": "Specify whether the Secret or its key must be defined",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"podTemplateSpec": {
|
||||
"description": "PodTemplateSpec defines the pod template to use for the registry API server.\nThis allows for customizing the pod configuration beyond what is provided by the other fields.\nNote that to modify the specific container the registry API server runs in, you must specify\nthe `registry-api` container name in the PodTemplateSpec.\nThis field accepts a PodTemplateSpec object as JSON/YAML.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"volumeMounts": {
|
||||
"description": "VolumeMounts defines additional volume mounts for the registry-api container.\nEach entry is a standard Kubernetes VolumeMount object (JSON/YAML).\nThe operator appends them to the container's volume mounts alongside the config mount.\n\nMount paths must match the file paths referenced in configYAML.\nFor example, if configYAML references passwordFile: /secrets/git-creds/token,\na corresponding volume mount must exist with mountPath: /secrets/git-creds.",
|
||||
"items": {
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"volumes": {
|
||||
"description": "Volumes defines additional volumes to add to the registry API pod.\nEach entry is a standard Kubernetes Volume object (JSON/YAML).\nThe operator appends them to the pod spec alongside its own config volume.\n\nUse these to mount:\n - Secrets (git auth tokens, OAuth client secrets, CA certs)\n - ConfigMaps (registry data files)\n - PersistentVolumeClaims (registry data on persistent storage)\n - Any other volume type the registry server needs",
|
||||
"items": {
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"configYAML"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPRegistryStatus defines the observed state of MCPRegistry",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPRegistry's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message provides additional information about the current phase",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration reflects the generation most recently observed by the controller",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"phase": {
|
||||
"description": "Phase represents the current overall phase of the MCPRegistry",
|
||||
"enum": [
|
||||
"Pending",
|
||||
"Ready",
|
||||
"Failed",
|
||||
"Terminating"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"readyReplicas": {
|
||||
"description": "ReadyReplicas is the number of ready registry API replicas",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the URL where the registry API can be accessed",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,621 @@
|
||||
{
|
||||
"description": "MCPRemoteProxy is the deprecated v1alpha1 version of the MCPRemoteProxy resource.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPRemoteProxySpec defines the desired state of MCPRemoteProxy",
|
||||
"properties": {
|
||||
"audit": {
|
||||
"description": "Audit defines audit logging configuration for the proxy",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"description": "Enabled controls whether audit logging is enabled\nWhen true, enables audit logging with default configuration",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"authServerRef": {
|
||||
"description": "AuthServerRef optionally references a resource that configures an embedded\nOAuth 2.0/OIDC authorization server to authenticate MCP clients.\nCurrently the only supported kind is MCPExternalAuthConfig (type: embeddedAuthServer).",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"default": "MCPExternalAuthConfig",
|
||||
"description": "Kind identifies the type of the referenced resource.",
|
||||
"enum": [
|
||||
"MCPExternalAuthConfig"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referenced resource in the same namespace.",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"authzConfig": {
|
||||
"description": "AuthzConfig defines authorization policy configuration for the proxy",
|
||||
"properties": {
|
||||
"configMap": {
|
||||
"description": "ConfigMap references a ConfigMap containing authorization configuration\nOnly used when Type is \"configMap\"",
|
||||
"properties": {
|
||||
"key": {
|
||||
"default": "authz.json",
|
||||
"description": "Key is the key in the ConfigMap that contains the authorization configuration",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the ConfigMap",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"groupClaimName": {
|
||||
"description": "GroupClaimName is the JWT claim key that contains group membership for the\nprincipal. When set, takes priority over the well-known defaults\n(\"groups\", \"roles\", \"cognito:groups\"). Use this for IDPs that place\ngroups under a URI-style claim (e.g. \"https://example.com/groups\"). When\nType is \"configMap\", a group_claim_name entry in the referenced ConfigMap\nis overridden by this field if both are set.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"groupEntityType": {
|
||||
"description": "GroupEntityType is the Cedar entity type name used for principal parent\nUIDs synthesised from JWT group/role claims. Defaults to \"THVGroup\" when\nempty. Must match the entity type used in the static entity store for\ntransitive `in` checks (e.g. `ClaimGroup \u2192 PlatformRole`) to resolve.\nNamespaced names (`Foo::Bar`) are not yet supported. When Type is\n\"configMap\", a group_entity_type entry in the referenced ConfigMap is\noverridden by this field if both are set.",
|
||||
"maxLength": 63,
|
||||
"pattern": "^[A-Za-z_][A-Za-z0-9_]*$",
|
||||
"type": "string"
|
||||
},
|
||||
"inline": {
|
||||
"description": "Inline contains direct authorization configuration\nOnly used when Type is \"inline\"",
|
||||
"properties": {
|
||||
"entitiesJson": {
|
||||
"default": "[]",
|
||||
"description": "EntitiesJSON is a JSON string representing Cedar entities. Required when\ntransitive policies (e.g. `ClaimGroup \u2192 PlatformRole`) need a static\nentity store; defaults to \"[]\".",
|
||||
"type": "string"
|
||||
},
|
||||
"policies": {
|
||||
"description": "Policies is a list of Cedar policy strings",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"primaryUpstreamProvider": {
|
||||
"description": "PrimaryUpstreamProvider names the upstream IDP whose access token's\nclaims Cedar should evaluate.\n\nDeprecated: on VirtualMCPServer this field has moved to\nspec.authServerConfig.primaryUpstreamProvider. The old location is\nstill read for one release for backward compatibility; the\nVirtualMCPServer controller emits an AuthzPrimaryUpstreamProviderDeprecated\nWarning event whenever it is consumed, and removal is planned for the\nrelease after the deprecation cycle.\n\nOn MCPServer and MCPRemoteProxy this field has always been a structural\nno-op (those CRDs do not run an embedded auth server). Setting it\ncontinues to surface the AuthzPrimaryUpstreamProviderIgnored advisory\ncondition; the deprecation does not change that behaviour.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"policies"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"roleClaimName": {
|
||||
"description": "RoleClaimName is the JWT claim key that contains role membership for the\nprincipal. When set, the claim is extracted separately from GroupClaimName\nand both are mapped to the configured GroupEntityType. When Type is\n\"configMap\", a role_claim_name entry in the referenced ConfigMap is\noverridden by this field if both are set.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"default": "configMap",
|
||||
"description": "Type is the type of authorization configuration",
|
||||
"enum": [
|
||||
"configMap",
|
||||
"inline"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "configMap must be set when type is 'configMap', and must not be set otherwise",
|
||||
"rule": "self.type == 'configMap' ? has(self.configMap) : !has(self.configMap)"
|
||||
},
|
||||
{
|
||||
"message": "inline must be set when type is 'inline', and must not be set otherwise",
|
||||
"rule": "self.type == 'inline' ? has(self.inline) : !has(self.inline)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"endpointPrefix": {
|
||||
"description": "EndpointPrefix is the path prefix to prepend to SSE endpoint URLs.\nThis is used to handle path-based ingress routing scenarios where the ingress\nstrips a path prefix before forwarding to the backend.",
|
||||
"type": "string"
|
||||
},
|
||||
"externalAuthConfigRef": {
|
||||
"description": "ExternalAuthConfigRef references a MCPExternalAuthConfig resource for token exchange.\nWhen specified, the proxy will exchange validated incoming tokens for remote service tokens.\nThe referenced MCPExternalAuthConfig must exist in the same namespace as this MCPRemoteProxy.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPExternalAuthConfig resource",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"groupRef": {
|
||||
"description": "GroupRef references the MCPGroup this proxy belongs to.\nThe referenced MCPGroup must be in the same namespace.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPGroup resource in the same namespace",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"headerForward": {
|
||||
"description": "HeaderForward configures headers to inject into requests to the remote MCP server.\nUse this to add custom headers like X-Tenant-ID or correlation IDs.",
|
||||
"properties": {
|
||||
"addHeadersFromSecret": {
|
||||
"description": "AddHeadersFromSecret references Kubernetes Secrets for sensitive header values.",
|
||||
"items": {
|
||||
"description": "HeaderFromSecret defines a header whose value comes from a Kubernetes Secret.",
|
||||
"properties": {
|
||||
"headerName": {
|
||||
"description": "HeaderName is the HTTP header name (e.g., \"X-API-Key\")",
|
||||
"maxLength": 255,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"valueSecretRef": {
|
||||
"description": "ValueSecretRef references the Secret and key containing the header value",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"headerName",
|
||||
"valueSecretRef"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"headerName"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"addPlaintextHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "AddPlaintextHeaders is a map of header names to literal values to inject into requests.\nWARNING: Values are stored in plaintext and visible via kubectl commands.\nUse addHeadersFromSecret for sensitive data like API keys or tokens.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"oidcConfigRef": {
|
||||
"description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.",
|
||||
"properties": {
|
||||
"audience": {
|
||||
"description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPOIDCConfig resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"resourceUrl": {
|
||||
"description": "ResourceURL is the public URL for OAuth protected resource metadata (RFC 9728).\nWhen the server is exposed via Ingress or gateway, set this to the external\nURL that MCP clients connect to. If not specified, defaults to the internal\nKubernetes service URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"scopes": {
|
||||
"description": "Scopes is the list of OAuth scopes to advertise in the well-known endpoint (RFC 9728).\nIf empty, defaults to [\"openid\"].",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"audience",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"proxyPort": {
|
||||
"default": 8080,
|
||||
"description": "ProxyPort is the port to expose the MCP proxy on",
|
||||
"format": "int32",
|
||||
"maximum": 65535,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"remoteUrl": {
|
||||
"description": "RemoteURL is the URL of the remote MCP server to proxy",
|
||||
"pattern": "^https?://",
|
||||
"type": "string"
|
||||
},
|
||||
"resourceOverrides": {
|
||||
"description": "ResourceOverrides allows overriding annotations and labels for resources created by the operator",
|
||||
"properties": {
|
||||
"proxyDeployment": {
|
||||
"description": "ProxyDeployment defines overrides for the Proxy Deployment resource (toolhive proxy)",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"env": {
|
||||
"description": "Env are environment variables to set in the proxy container (thv run process)\nThese affect the toolhive proxy itself, not the MCP server it manages\nUse TOOLHIVE_DEBUG=true to enable debug logging in the proxy",
|
||||
"items": {
|
||||
"description": "EnvVar represents an environment variable in a container",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the environment variable",
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value of the environment variable",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"value"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"imagePullSecrets": {
|
||||
"description": "ImagePullSecrets allows specifying image pull secrets for the proxy runner\nThese are applied to both the Deployment and the ServiceAccount",
|
||||
"items": {
|
||||
"description": "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"podTemplateMetadataOverrides": {
|
||||
"description": "ResourceMetadataOverrides defines metadata overrides for a resource",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"proxyService": {
|
||||
"description": "ProxyService defines overrides for the Proxy Service resource (points to the proxy deployment)",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"resources": {
|
||||
"description": "Resources defines the resource requirements for the proxy container",
|
||||
"properties": {
|
||||
"limits": {
|
||||
"description": "Limits describes the maximum amount of compute resources allowed",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)",
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"requests": {
|
||||
"description": "Requests describes the minimum amount of compute resources required",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)",
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"serviceAccount": {
|
||||
"description": "ServiceAccount is the name of an already existing service account to use by the proxy.\nIf not specified, a ServiceAccount will be created automatically and used by the proxy.",
|
||||
"type": "string"
|
||||
},
|
||||
"sessionAffinity": {
|
||||
"default": "ClientIP",
|
||||
"description": "SessionAffinity controls whether the Service routes repeated client connections to the same pod.\nMCP protocols (SSE, streamable-http) are stateful, so ClientIP is the default.\nSet to \"None\" for stateless servers or when using an external load balancer with its own affinity.",
|
||||
"enum": [
|
||||
"ClientIP",
|
||||
"None"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"telemetryConfigRef": {
|
||||
"description": "TelemetryConfigRef references an MCPTelemetryConfig resource for shared telemetry configuration.\nThe referenced MCPTelemetryConfig must exist in the same namespace as this MCPRemoteProxy.\nCross-namespace references are not supported for security and isolation reasons.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPTelemetryConfig resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"serviceName": {
|
||||
"description": "ServiceName overrides the telemetry service name for this specific server.\nThis MUST be unique per server for proper observability (e.g., distinguishing\ntraces and metrics from different servers sharing the same collector).\nIf empty, defaults to the server name with \"thv-\" prefix at runtime.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"toolConfigRef": {
|
||||
"description": "ToolConfigRef references a MCPToolConfig resource for tool filtering and renaming.\nThe referenced MCPToolConfig must exist in the same namespace as this MCPRemoteProxy.\nCross-namespace references are not supported for security and isolation reasons.\nIf specified, this allows filtering and overriding tools from the remote MCP server.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPToolConfig resource in the same namespace",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"transport": {
|
||||
"default": "streamable-http",
|
||||
"description": "Transport is the transport method for the remote proxy (sse or streamable-http)",
|
||||
"enum": [
|
||||
"sse",
|
||||
"streamable-http"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"trustProxyHeaders": {
|
||||
"default": false,
|
||||
"description": "TrustProxyHeaders indicates whether to trust X-Forwarded-* headers from reverse proxies\nWhen enabled, the proxy will use X-Forwarded-Proto, X-Forwarded-Host, X-Forwarded-Port,\nand X-Forwarded-Prefix headers to construct endpoint URLs",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"remoteUrl"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPRemoteProxyStatus defines the observed state of MCPRemoteProxy",
|
||||
"properties": {
|
||||
"authServerConfigHash": {
|
||||
"description": "AuthServerConfigHash is the hash of the referenced authServerRef spec,\nused to detect configuration changes and trigger reconciliation.",
|
||||
"type": "string"
|
||||
},
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPRemoteProxy's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"externalAuthConfigHash": {
|
||||
"description": "ExternalAuthConfigHash is the hash of the referenced MCPExternalAuthConfig spec",
|
||||
"type": "string"
|
||||
},
|
||||
"externalUrl": {
|
||||
"description": "ExternalURL is the external URL where the proxy can be accessed (if exposed externally)",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message provides additional information about the current phase",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration reflects the generation of the most recently observed MCPRemoteProxy",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"oidcConfigHash": {
|
||||
"description": "OIDCConfigHash is the hash of the referenced MCPOIDCConfig spec for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"phase": {
|
||||
"description": "Phase is the current phase of the MCPRemoteProxy",
|
||||
"enum": [
|
||||
"Pending",
|
||||
"Ready",
|
||||
"Failed",
|
||||
"Terminating"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"telemetryConfigHash": {
|
||||
"description": "TelemetryConfigHash stores the hash of the referenced MCPTelemetryConfig for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"toolConfigHash": {
|
||||
"description": "ToolConfigHash stores the hash of the referenced ToolConfig for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the internal cluster URL where the proxy can be accessed",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,621 @@
|
||||
{
|
||||
"description": "MCPRemoteProxy is the Schema for the mcpremoteproxies API\nIt enables proxying remote MCP servers with authentication, authorization, audit logging, and tool filtering",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPRemoteProxySpec defines the desired state of MCPRemoteProxy",
|
||||
"properties": {
|
||||
"audit": {
|
||||
"description": "Audit defines audit logging configuration for the proxy",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"description": "Enabled controls whether audit logging is enabled\nWhen true, enables audit logging with default configuration",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"authServerRef": {
|
||||
"description": "AuthServerRef optionally references a resource that configures an embedded\nOAuth 2.0/OIDC authorization server to authenticate MCP clients.\nCurrently the only supported kind is MCPExternalAuthConfig (type: embeddedAuthServer).",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"default": "MCPExternalAuthConfig",
|
||||
"description": "Kind identifies the type of the referenced resource.",
|
||||
"enum": [
|
||||
"MCPExternalAuthConfig"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referenced resource in the same namespace.",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"authzConfig": {
|
||||
"description": "AuthzConfig defines authorization policy configuration for the proxy",
|
||||
"properties": {
|
||||
"configMap": {
|
||||
"description": "ConfigMap references a ConfigMap containing authorization configuration\nOnly used when Type is \"configMap\"",
|
||||
"properties": {
|
||||
"key": {
|
||||
"default": "authz.json",
|
||||
"description": "Key is the key in the ConfigMap that contains the authorization configuration",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the ConfigMap",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"groupClaimName": {
|
||||
"description": "GroupClaimName is the JWT claim key that contains group membership for the\nprincipal. When set, takes priority over the well-known defaults\n(\"groups\", \"roles\", \"cognito:groups\"). Use this for IDPs that place\ngroups under a URI-style claim (e.g. \"https://example.com/groups\"). When\nType is \"configMap\", a group_claim_name entry in the referenced ConfigMap\nis overridden by this field if both are set.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"groupEntityType": {
|
||||
"description": "GroupEntityType is the Cedar entity type name used for principal parent\nUIDs synthesised from JWT group/role claims. Defaults to \"THVGroup\" when\nempty. Must match the entity type used in the static entity store for\ntransitive `in` checks (e.g. `ClaimGroup \u2192 PlatformRole`) to resolve.\nNamespaced names (`Foo::Bar`) are not yet supported. When Type is\n\"configMap\", a group_entity_type entry in the referenced ConfigMap is\noverridden by this field if both are set.",
|
||||
"maxLength": 63,
|
||||
"pattern": "^[A-Za-z_][A-Za-z0-9_]*$",
|
||||
"type": "string"
|
||||
},
|
||||
"inline": {
|
||||
"description": "Inline contains direct authorization configuration\nOnly used when Type is \"inline\"",
|
||||
"properties": {
|
||||
"entitiesJson": {
|
||||
"default": "[]",
|
||||
"description": "EntitiesJSON is a JSON string representing Cedar entities. Required when\ntransitive policies (e.g. `ClaimGroup \u2192 PlatformRole`) need a static\nentity store; defaults to \"[]\".",
|
||||
"type": "string"
|
||||
},
|
||||
"policies": {
|
||||
"description": "Policies is a list of Cedar policy strings",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"primaryUpstreamProvider": {
|
||||
"description": "PrimaryUpstreamProvider names the upstream IDP whose access token's\nclaims Cedar should evaluate.\n\nDeprecated: on VirtualMCPServer this field has moved to\nspec.authServerConfig.primaryUpstreamProvider. The old location is\nstill read for one release for backward compatibility; the\nVirtualMCPServer controller emits an AuthzPrimaryUpstreamProviderDeprecated\nWarning event whenever it is consumed, and removal is planned for the\nrelease after the deprecation cycle.\n\nOn MCPServer and MCPRemoteProxy this field has always been a structural\nno-op (those CRDs do not run an embedded auth server). Setting it\ncontinues to surface the AuthzPrimaryUpstreamProviderIgnored advisory\ncondition; the deprecation does not change that behaviour.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"policies"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"roleClaimName": {
|
||||
"description": "RoleClaimName is the JWT claim key that contains role membership for the\nprincipal. When set, the claim is extracted separately from GroupClaimName\nand both are mapped to the configured GroupEntityType. When Type is\n\"configMap\", a role_claim_name entry in the referenced ConfigMap is\noverridden by this field if both are set.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"default": "configMap",
|
||||
"description": "Type is the type of authorization configuration",
|
||||
"enum": [
|
||||
"configMap",
|
||||
"inline"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "configMap must be set when type is 'configMap', and must not be set otherwise",
|
||||
"rule": "self.type == 'configMap' ? has(self.configMap) : !has(self.configMap)"
|
||||
},
|
||||
{
|
||||
"message": "inline must be set when type is 'inline', and must not be set otherwise",
|
||||
"rule": "self.type == 'inline' ? has(self.inline) : !has(self.inline)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"endpointPrefix": {
|
||||
"description": "EndpointPrefix is the path prefix to prepend to SSE endpoint URLs.\nThis is used to handle path-based ingress routing scenarios where the ingress\nstrips a path prefix before forwarding to the backend.",
|
||||
"type": "string"
|
||||
},
|
||||
"externalAuthConfigRef": {
|
||||
"description": "ExternalAuthConfigRef references a MCPExternalAuthConfig resource for token exchange.\nWhen specified, the proxy will exchange validated incoming tokens for remote service tokens.\nThe referenced MCPExternalAuthConfig must exist in the same namespace as this MCPRemoteProxy.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPExternalAuthConfig resource",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"groupRef": {
|
||||
"description": "GroupRef references the MCPGroup this proxy belongs to.\nThe referenced MCPGroup must be in the same namespace.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPGroup resource in the same namespace",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"headerForward": {
|
||||
"description": "HeaderForward configures headers to inject into requests to the remote MCP server.\nUse this to add custom headers like X-Tenant-ID or correlation IDs.",
|
||||
"properties": {
|
||||
"addHeadersFromSecret": {
|
||||
"description": "AddHeadersFromSecret references Kubernetes Secrets for sensitive header values.",
|
||||
"items": {
|
||||
"description": "HeaderFromSecret defines a header whose value comes from a Kubernetes Secret.",
|
||||
"properties": {
|
||||
"headerName": {
|
||||
"description": "HeaderName is the HTTP header name (e.g., \"X-API-Key\")",
|
||||
"maxLength": 255,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"valueSecretRef": {
|
||||
"description": "ValueSecretRef references the Secret and key containing the header value",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"headerName",
|
||||
"valueSecretRef"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"headerName"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"addPlaintextHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "AddPlaintextHeaders is a map of header names to literal values to inject into requests.\nWARNING: Values are stored in plaintext and visible via kubectl commands.\nUse addHeadersFromSecret for sensitive data like API keys or tokens.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"oidcConfigRef": {
|
||||
"description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.",
|
||||
"properties": {
|
||||
"audience": {
|
||||
"description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPOIDCConfig resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"resourceUrl": {
|
||||
"description": "ResourceURL is the public URL for OAuth protected resource metadata (RFC 9728).\nWhen the server is exposed via Ingress or gateway, set this to the external\nURL that MCP clients connect to. If not specified, defaults to the internal\nKubernetes service URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"scopes": {
|
||||
"description": "Scopes is the list of OAuth scopes to advertise in the well-known endpoint (RFC 9728).\nIf empty, defaults to [\"openid\"].",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"audience",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"proxyPort": {
|
||||
"default": 8080,
|
||||
"description": "ProxyPort is the port to expose the MCP proxy on",
|
||||
"format": "int32",
|
||||
"maximum": 65535,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"remoteUrl": {
|
||||
"description": "RemoteURL is the URL of the remote MCP server to proxy",
|
||||
"pattern": "^https?://",
|
||||
"type": "string"
|
||||
},
|
||||
"resourceOverrides": {
|
||||
"description": "ResourceOverrides allows overriding annotations and labels for resources created by the operator",
|
||||
"properties": {
|
||||
"proxyDeployment": {
|
||||
"description": "ProxyDeployment defines overrides for the Proxy Deployment resource (toolhive proxy)",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"env": {
|
||||
"description": "Env are environment variables to set in the proxy container (thv run process)\nThese affect the toolhive proxy itself, not the MCP server it manages\nUse TOOLHIVE_DEBUG=true to enable debug logging in the proxy",
|
||||
"items": {
|
||||
"description": "EnvVar represents an environment variable in a container",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the environment variable",
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value of the environment variable",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"value"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"imagePullSecrets": {
|
||||
"description": "ImagePullSecrets allows specifying image pull secrets for the proxy runner\nThese are applied to both the Deployment and the ServiceAccount",
|
||||
"items": {
|
||||
"description": "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"podTemplateMetadataOverrides": {
|
||||
"description": "ResourceMetadataOverrides defines metadata overrides for a resource",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"proxyService": {
|
||||
"description": "ProxyService defines overrides for the Proxy Service resource (points to the proxy deployment)",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"resources": {
|
||||
"description": "Resources defines the resource requirements for the proxy container",
|
||||
"properties": {
|
||||
"limits": {
|
||||
"description": "Limits describes the maximum amount of compute resources allowed",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)",
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"requests": {
|
||||
"description": "Requests describes the minimum amount of compute resources required",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)",
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"serviceAccount": {
|
||||
"description": "ServiceAccount is the name of an already existing service account to use by the proxy.\nIf not specified, a ServiceAccount will be created automatically and used by the proxy.",
|
||||
"type": "string"
|
||||
},
|
||||
"sessionAffinity": {
|
||||
"default": "ClientIP",
|
||||
"description": "SessionAffinity controls whether the Service routes repeated client connections to the same pod.\nMCP protocols (SSE, streamable-http) are stateful, so ClientIP is the default.\nSet to \"None\" for stateless servers or when using an external load balancer with its own affinity.",
|
||||
"enum": [
|
||||
"ClientIP",
|
||||
"None"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"telemetryConfigRef": {
|
||||
"description": "TelemetryConfigRef references an MCPTelemetryConfig resource for shared telemetry configuration.\nThe referenced MCPTelemetryConfig must exist in the same namespace as this MCPRemoteProxy.\nCross-namespace references are not supported for security and isolation reasons.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPTelemetryConfig resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"serviceName": {
|
||||
"description": "ServiceName overrides the telemetry service name for this specific server.\nThis MUST be unique per server for proper observability (e.g., distinguishing\ntraces and metrics from different servers sharing the same collector).\nIf empty, defaults to the server name with \"thv-\" prefix at runtime.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"toolConfigRef": {
|
||||
"description": "ToolConfigRef references a MCPToolConfig resource for tool filtering and renaming.\nThe referenced MCPToolConfig must exist in the same namespace as this MCPRemoteProxy.\nCross-namespace references are not supported for security and isolation reasons.\nIf specified, this allows filtering and overriding tools from the remote MCP server.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPToolConfig resource in the same namespace",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"transport": {
|
||||
"default": "streamable-http",
|
||||
"description": "Transport is the transport method for the remote proxy (sse or streamable-http)",
|
||||
"enum": [
|
||||
"sse",
|
||||
"streamable-http"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"trustProxyHeaders": {
|
||||
"default": false,
|
||||
"description": "TrustProxyHeaders indicates whether to trust X-Forwarded-* headers from reverse proxies\nWhen enabled, the proxy will use X-Forwarded-Proto, X-Forwarded-Host, X-Forwarded-Port,\nand X-Forwarded-Prefix headers to construct endpoint URLs",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"remoteUrl"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPRemoteProxyStatus defines the observed state of MCPRemoteProxy",
|
||||
"properties": {
|
||||
"authServerConfigHash": {
|
||||
"description": "AuthServerConfigHash is the hash of the referenced authServerRef spec,\nused to detect configuration changes and trigger reconciliation.",
|
||||
"type": "string"
|
||||
},
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPRemoteProxy's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"externalAuthConfigHash": {
|
||||
"description": "ExternalAuthConfigHash is the hash of the referenced MCPExternalAuthConfig spec",
|
||||
"type": "string"
|
||||
},
|
||||
"externalUrl": {
|
||||
"description": "ExternalURL is the external URL where the proxy can be accessed (if exposed externally)",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message provides additional information about the current phase",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration reflects the generation of the most recently observed MCPRemoteProxy",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"oidcConfigHash": {
|
||||
"description": "OIDCConfigHash is the hash of the referenced MCPOIDCConfig spec for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"phase": {
|
||||
"description": "Phase is the current phase of the MCPRemoteProxy",
|
||||
"enum": [
|
||||
"Pending",
|
||||
"Ready",
|
||||
"Failed",
|
||||
"Terminating"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"telemetryConfigHash": {
|
||||
"description": "TelemetryConfigHash stores the hash of the referenced MCPTelemetryConfig for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"toolConfigHash": {
|
||||
"description": "ToolConfigHash stores the hash of the referenced ToolConfig for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the internal cluster URL where the proxy can be accessed",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,946 @@
|
||||
{
|
||||
"description": "MCPServer is the deprecated v1alpha1 version of the MCPServer resource.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPServerSpec defines the desired state of MCPServer",
|
||||
"properties": {
|
||||
"args": {
|
||||
"description": "Args are additional arguments to pass to the MCP server",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"audit": {
|
||||
"description": "Audit defines audit logging configuration for the MCP server",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"description": "Enabled controls whether audit logging is enabled\nWhen true, enables audit logging with default configuration",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"authServerRef": {
|
||||
"description": "AuthServerRef optionally references a resource that configures an embedded\nOAuth 2.0/OIDC authorization server to authenticate MCP clients.\nCurrently the only supported kind is MCPExternalAuthConfig (type: embeddedAuthServer).",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"default": "MCPExternalAuthConfig",
|
||||
"description": "Kind identifies the type of the referenced resource.",
|
||||
"enum": [
|
||||
"MCPExternalAuthConfig"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referenced resource in the same namespace.",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"authzConfig": {
|
||||
"description": "AuthzConfig defines authorization policy configuration for the MCP server",
|
||||
"properties": {
|
||||
"configMap": {
|
||||
"description": "ConfigMap references a ConfigMap containing authorization configuration\nOnly used when Type is \"configMap\"",
|
||||
"properties": {
|
||||
"key": {
|
||||
"default": "authz.json",
|
||||
"description": "Key is the key in the ConfigMap that contains the authorization configuration",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the ConfigMap",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"groupClaimName": {
|
||||
"description": "GroupClaimName is the JWT claim key that contains group membership for the\nprincipal. When set, takes priority over the well-known defaults\n(\"groups\", \"roles\", \"cognito:groups\"). Use this for IDPs that place\ngroups under a URI-style claim (e.g. \"https://example.com/groups\"). When\nType is \"configMap\", a group_claim_name entry in the referenced ConfigMap\nis overridden by this field if both are set.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"groupEntityType": {
|
||||
"description": "GroupEntityType is the Cedar entity type name used for principal parent\nUIDs synthesised from JWT group/role claims. Defaults to \"THVGroup\" when\nempty. Must match the entity type used in the static entity store for\ntransitive `in` checks (e.g. `ClaimGroup \u2192 PlatformRole`) to resolve.\nNamespaced names (`Foo::Bar`) are not yet supported. When Type is\n\"configMap\", a group_entity_type entry in the referenced ConfigMap is\noverridden by this field if both are set.",
|
||||
"maxLength": 63,
|
||||
"pattern": "^[A-Za-z_][A-Za-z0-9_]*$",
|
||||
"type": "string"
|
||||
},
|
||||
"inline": {
|
||||
"description": "Inline contains direct authorization configuration\nOnly used when Type is \"inline\"",
|
||||
"properties": {
|
||||
"entitiesJson": {
|
||||
"default": "[]",
|
||||
"description": "EntitiesJSON is a JSON string representing Cedar entities. Required when\ntransitive policies (e.g. `ClaimGroup \u2192 PlatformRole`) need a static\nentity store; defaults to \"[]\".",
|
||||
"type": "string"
|
||||
},
|
||||
"policies": {
|
||||
"description": "Policies is a list of Cedar policy strings",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"primaryUpstreamProvider": {
|
||||
"description": "PrimaryUpstreamProvider names the upstream IDP whose access token's\nclaims Cedar should evaluate.\n\nDeprecated: on VirtualMCPServer this field has moved to\nspec.authServerConfig.primaryUpstreamProvider. The old location is\nstill read for one release for backward compatibility; the\nVirtualMCPServer controller emits an AuthzPrimaryUpstreamProviderDeprecated\nWarning event whenever it is consumed, and removal is planned for the\nrelease after the deprecation cycle.\n\nOn MCPServer and MCPRemoteProxy this field has always been a structural\nno-op (those CRDs do not run an embedded auth server). Setting it\ncontinues to surface the AuthzPrimaryUpstreamProviderIgnored advisory\ncondition; the deprecation does not change that behaviour.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"policies"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"roleClaimName": {
|
||||
"description": "RoleClaimName is the JWT claim key that contains role membership for the\nprincipal. When set, the claim is extracted separately from GroupClaimName\nand both are mapped to the configured GroupEntityType. When Type is\n\"configMap\", a role_claim_name entry in the referenced ConfigMap is\noverridden by this field if both are set.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"default": "configMap",
|
||||
"description": "Type is the type of authorization configuration",
|
||||
"enum": [
|
||||
"configMap",
|
||||
"inline"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "configMap must be set when type is 'configMap', and must not be set otherwise",
|
||||
"rule": "self.type == 'configMap' ? has(self.configMap) : !has(self.configMap)"
|
||||
},
|
||||
{
|
||||
"message": "inline must be set when type is 'inline', and must not be set otherwise",
|
||||
"rule": "self.type == 'inline' ? has(self.inline) : !has(self.inline)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"backendReplicas": {
|
||||
"description": "BackendReplicas is the desired number of MCP server backend pod replicas.\nThis controls the backend Deployment (the MCP server container itself),\nindependent of the proxy runner controlled by Replicas.\nWhen nil, the operator does not set Deployment.Spec.Replicas, leaving replica\nmanagement to an HPA or other external controller.",
|
||||
"format": "int32",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"endpointPrefix": {
|
||||
"description": "EndpointPrefix is the path prefix to prepend to SSE endpoint URLs.\nThis is used to handle path-based ingress routing scenarios where the ingress\nstrips a path prefix before forwarding to the backend.",
|
||||
"type": "string"
|
||||
},
|
||||
"env": {
|
||||
"description": "Env are environment variables to set in the MCP server container",
|
||||
"items": {
|
||||
"description": "EnvVar represents an environment variable in a container",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the environment variable",
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value of the environment variable",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"value"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"externalAuthConfigRef": {
|
||||
"description": "ExternalAuthConfigRef references a MCPExternalAuthConfig resource for external authentication.\nThe referenced MCPExternalAuthConfig must exist in the same namespace as this MCPServer.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPExternalAuthConfig resource",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"groupRef": {
|
||||
"description": "GroupRef references the MCPGroup this server belongs to.\nThe referenced MCPGroup must be in the same namespace.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPGroup resource in the same namespace",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"image": {
|
||||
"description": "Image is the container image for the MCP server",
|
||||
"type": "string"
|
||||
},
|
||||
"mcpPort": {
|
||||
"description": "MCPPort is the port that MCP server listens to",
|
||||
"format": "int32",
|
||||
"maximum": 65535,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"oidcConfigRef": {
|
||||
"description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPServer.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.",
|
||||
"properties": {
|
||||
"audience": {
|
||||
"description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPOIDCConfig resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"resourceUrl": {
|
||||
"description": "ResourceURL is the public URL for OAuth protected resource metadata (RFC 9728).\nWhen the server is exposed via Ingress or gateway, set this to the external\nURL that MCP clients connect to. If not specified, defaults to the internal\nKubernetes service URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"scopes": {
|
||||
"description": "Scopes is the list of OAuth scopes to advertise in the well-known endpoint (RFC 9728).\nIf empty, defaults to [\"openid\"].",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"audience",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"permissionProfile": {
|
||||
"description": "PermissionProfile defines the permission profile to use",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key in the ConfigMap that contains the permission profile\nOnly used when Type is \"configmap\"",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the permission profile\nIf Type is \"builtin\", Name must be one of: \"none\", \"network\"\nIf Type is \"configmap\", Name is the name of the ConfigMap",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"default": "builtin",
|
||||
"description": "Type is the type of permission profile reference",
|
||||
"enum": [
|
||||
"builtin",
|
||||
"configmap"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"podTemplateSpec": {
|
||||
"description": "PodTemplateSpec defines the pod template to use for the MCP server\nThis allows for customizing the pod configuration beyond what is provided by the other fields.\nNote that to modify the specific container the MCP server runs in, you must specify\nthe `mcp` container name in the PodTemplateSpec.\nThis field accepts a PodTemplateSpec object as JSON/YAML.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"proxyMode": {
|
||||
"default": "streamable-http",
|
||||
"description": "ProxyMode is the proxy mode for stdio transport (sse or streamable-http)\nThis setting is ONLY applicable when Transport is \"stdio\".\nFor direct transports (sse, streamable-http), this field is ignored.\nThe default value is applied by Kubernetes but will be ignored for non-stdio transports.",
|
||||
"enum": [
|
||||
"sse",
|
||||
"streamable-http"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"proxyPort": {
|
||||
"default": 8080,
|
||||
"description": "ProxyPort is the port to expose the proxy runner on",
|
||||
"format": "int32",
|
||||
"maximum": 65535,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"rateLimiting": {
|
||||
"description": "RateLimiting defines rate limiting configuration for the MCP server.\nRequires Redis session storage to be configured for distributed rate limiting.",
|
||||
"properties": {
|
||||
"perUser": {
|
||||
"description": "PerUser is a token bucket applied independently to each authenticated user\nat the server level. Requires authentication to be enabled.\nEach unique userID creates Redis keys that expire after 2x refillPeriod.\nMemory formula: unique_users_per_TTL_window * (1 + num_tools_with_per_user_limits) keys.",
|
||||
"properties": {
|
||||
"maxTokens": {
|
||||
"description": "MaxTokens is the maximum number of tokens (bucket capacity).\nThis is also the burst size: the maximum number of requests that can be served\ninstantaneously before the bucket is depleted.",
|
||||
"format": "int32",
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"refillPeriod": {
|
||||
"description": "RefillPeriod is the duration to fully refill the bucket from zero to maxTokens.\nThe effective refill rate is maxTokens / refillPeriod tokens per second.\nFormat: Go duration string (e.g., \"1m0s\", \"30s\", \"1h0m0s\").",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"maxTokens",
|
||||
"refillPeriod"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"shared": {
|
||||
"description": "Shared is a token bucket shared across all users for the entire server.",
|
||||
"properties": {
|
||||
"maxTokens": {
|
||||
"description": "MaxTokens is the maximum number of tokens (bucket capacity).\nThis is also the burst size: the maximum number of requests that can be served\ninstantaneously before the bucket is depleted.",
|
||||
"format": "int32",
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"refillPeriod": {
|
||||
"description": "RefillPeriod is the duration to fully refill the bucket from zero to maxTokens.\nThe effective refill rate is maxTokens / refillPeriod tokens per second.\nFormat: Go duration string (e.g., \"1m0s\", \"30s\", \"1h0m0s\").",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"maxTokens",
|
||||
"refillPeriod"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"tools": {
|
||||
"description": "Tools defines per-tool rate limit overrides.\nEach entry applies additional rate limits to calls targeting a specific tool name.\nA request must pass both the server-level limit and the per-tool limit.",
|
||||
"items": {
|
||||
"description": "ToolRateLimitConfig defines rate limits for a specific tool.\nAt least one of shared or perUser must be configured.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the MCP tool name this limit applies to.",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"perUser": {
|
||||
"description": "PerUser token bucket configuration for this tool.",
|
||||
"properties": {
|
||||
"maxTokens": {
|
||||
"description": "MaxTokens is the maximum number of tokens (bucket capacity).\nThis is also the burst size: the maximum number of requests that can be served\ninstantaneously before the bucket is depleted.",
|
||||
"format": "int32",
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"refillPeriod": {
|
||||
"description": "RefillPeriod is the duration to fully refill the bucket from zero to maxTokens.\nThe effective refill rate is maxTokens / refillPeriod tokens per second.\nFormat: Go duration string (e.g., \"1m0s\", \"30s\", \"1h0m0s\").",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"maxTokens",
|
||||
"refillPeriod"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"shared": {
|
||||
"description": "Shared token bucket for this specific tool.",
|
||||
"properties": {
|
||||
"maxTokens": {
|
||||
"description": "MaxTokens is the maximum number of tokens (bucket capacity).\nThis is also the burst size: the maximum number of requests that can be served\ninstantaneously before the bucket is depleted.",
|
||||
"format": "int32",
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"refillPeriod": {
|
||||
"description": "RefillPeriod is the duration to fully refill the bucket from zero to maxTokens.\nThe effective refill rate is maxTokens / refillPeriod tokens per second.\nFormat: Go duration string (e.g., \"1m0s\", \"30s\", \"1h0m0s\").",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"maxTokens",
|
||||
"refillPeriod"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "at least one of shared or perUser must be configured",
|
||||
"rule": "has(self.shared) || has(self.perUser)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "at least one of shared, perUser, or tools must be configured",
|
||||
"rule": "has(self.shared) || has(self.perUser) || (has(self.tools) && size(self.tools) > 0)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"replicas": {
|
||||
"description": "Replicas is the desired number of proxy runner (thv run) pod replicas.\nMCPServer creates two separate Deployments: one for the proxy runner and one\nfor the MCP server backend. This field controls the proxy runner Deployment.\nWhen nil, the operator does not set Deployment.Spec.Replicas, leaving replica\nmanagement to an HPA or other external controller.",
|
||||
"format": "int32",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"resourceOverrides": {
|
||||
"description": "ResourceOverrides allows overriding annotations and labels for resources created by the operator",
|
||||
"properties": {
|
||||
"proxyDeployment": {
|
||||
"description": "ProxyDeployment defines overrides for the Proxy Deployment resource (toolhive proxy)",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"env": {
|
||||
"description": "Env are environment variables to set in the proxy container (thv run process)\nThese affect the toolhive proxy itself, not the MCP server it manages\nUse TOOLHIVE_DEBUG=true to enable debug logging in the proxy",
|
||||
"items": {
|
||||
"description": "EnvVar represents an environment variable in a container",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the environment variable",
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value of the environment variable",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"value"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"imagePullSecrets": {
|
||||
"description": "ImagePullSecrets allows specifying image pull secrets for the proxy runner\nThese are applied to both the Deployment and the ServiceAccount",
|
||||
"items": {
|
||||
"description": "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"podTemplateMetadataOverrides": {
|
||||
"description": "ResourceMetadataOverrides defines metadata overrides for a resource",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"proxyService": {
|
||||
"description": "ProxyService defines overrides for the Proxy Service resource (points to the proxy deployment)",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"resources": {
|
||||
"description": "Resources defines the resource requirements for the MCP server container",
|
||||
"properties": {
|
||||
"limits": {
|
||||
"description": "Limits describes the maximum amount of compute resources allowed",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)",
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"requests": {
|
||||
"description": "Requests describes the minimum amount of compute resources required",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)",
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"secrets": {
|
||||
"description": "Secrets are references to secrets to mount in the MCP server container",
|
||||
"items": {
|
||||
"description": "SecretRef is a reference to a secret",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key in the secret itself",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"targetEnvName": {
|
||||
"description": "TargetEnvName is the environment variable to be used when setting up the secret in the MCP server\nIf left unspecified, it defaults to the key",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"serviceAccount": {
|
||||
"description": "ServiceAccount is the name of an already existing service account to use by the MCP server.\nIf not specified, a ServiceAccount will be created automatically and used by the MCP server.",
|
||||
"type": "string"
|
||||
},
|
||||
"sessionAffinity": {
|
||||
"default": "ClientIP",
|
||||
"description": "SessionAffinity controls whether the Service routes repeated client connections to the same pod.\nMCP protocols (SSE, streamable-http) are stateful, so ClientIP is the default.\nSet to \"None\" for stateless servers or when using an external load balancer with its own affinity.",
|
||||
"enum": [
|
||||
"ClientIP",
|
||||
"None"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"sessionStorage": {
|
||||
"description": "SessionStorage configures session storage for stateful horizontal scaling.\nWhen nil, no session storage is configured.",
|
||||
"properties": {
|
||||
"address": {
|
||||
"description": "Address is the Redis server address (required when provider is redis)",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"db": {
|
||||
"default": 0,
|
||||
"description": "DB is the Redis database number",
|
||||
"format": "int32",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"keyPrefix": {
|
||||
"description": "KeyPrefix is an optional prefix for all Redis keys used by ToolHive",
|
||||
"type": "string"
|
||||
},
|
||||
"passwordRef": {
|
||||
"description": "PasswordRef is a reference to a Secret key containing the Redis password",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"provider": {
|
||||
"description": "Provider is the session storage backend type",
|
||||
"enum": [
|
||||
"memory",
|
||||
"redis"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"provider"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "address is required",
|
||||
"rule": "self.provider == 'redis' ? has(self.address) : true"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"telemetryConfigRef": {
|
||||
"description": "TelemetryConfigRef references an MCPTelemetryConfig resource for shared telemetry configuration.\nThe referenced MCPTelemetryConfig must exist in the same namespace as this MCPServer.\nCross-namespace references are not supported for security and isolation reasons.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPTelemetryConfig resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"serviceName": {
|
||||
"description": "ServiceName overrides the telemetry service name for this specific server.\nThis MUST be unique per server for proper observability (e.g., distinguishing\ntraces and metrics from different servers sharing the same collector).\nIf empty, defaults to the server name with \"thv-\" prefix at runtime.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"toolConfigRef": {
|
||||
"description": "ToolConfigRef references a MCPToolConfig resource for tool filtering and renaming.\nThe referenced MCPToolConfig must exist in the same namespace as this MCPServer.\nCross-namespace references are not supported for security and isolation reasons.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPToolConfig resource in the same namespace",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"transport": {
|
||||
"default": "stdio",
|
||||
"description": "Transport is the transport method for the MCP server (stdio, streamable-http or sse)",
|
||||
"enum": [
|
||||
"stdio",
|
||||
"streamable-http",
|
||||
"sse"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"trustProxyHeaders": {
|
||||
"default": false,
|
||||
"description": "TrustProxyHeaders indicates whether to trust X-Forwarded-* headers from reverse proxies\nWhen enabled, the proxy will use X-Forwarded-Proto, X-Forwarded-Host, X-Forwarded-Port,\nand X-Forwarded-Prefix headers to construct endpoint URLs",
|
||||
"type": "boolean"
|
||||
},
|
||||
"volumes": {
|
||||
"description": "Volumes are volumes to mount in the MCP server container",
|
||||
"items": {
|
||||
"description": "Volume represents a volume to mount in a container",
|
||||
"properties": {
|
||||
"hostPath": {
|
||||
"description": "HostPath is the path on the host to mount",
|
||||
"type": "string"
|
||||
},
|
||||
"mountPath": {
|
||||
"description": "MountPath is the path in the container to mount to",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the volume",
|
||||
"type": "string"
|
||||
},
|
||||
"readOnly": {
|
||||
"default": false,
|
||||
"description": "ReadOnly specifies whether the volume should be mounted read-only",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"hostPath",
|
||||
"mountPath",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"webhookConfigRef": {
|
||||
"description": "WebhookConfigRef references a MCPWebhookConfig resource for webhook middleware configuration.\nThe referenced MCPWebhookConfig must exist in the same namespace as this MCPServer.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPWebhookConfig resource",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"image"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "rateLimiting requires sessionStorage with provider 'redis'",
|
||||
"rule": "!has(self.rateLimiting) || (has(self.sessionStorage) && self.sessionStorage.provider == 'redis')"
|
||||
},
|
||||
{
|
||||
"message": "rateLimiting.perUser requires authentication (oidcConfigRef or externalAuthConfigRef)",
|
||||
"rule": "!(has(self.rateLimiting) && has(self.rateLimiting.perUser)) || has(self.oidcConfigRef) || has(self.externalAuthConfigRef)"
|
||||
},
|
||||
{
|
||||
"message": "per-tool perUser rate limiting requires authentication (oidcConfigRef or externalAuthConfigRef)",
|
||||
"rule": "!has(self.rateLimiting) || !has(self.rateLimiting.tools) || self.rateLimiting.tools.all(t, !has(t.perUser)) || has(self.oidcConfigRef) || has(self.externalAuthConfigRef)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPServerStatus defines the observed state of MCPServer",
|
||||
"properties": {
|
||||
"authServerConfigHash": {
|
||||
"description": "AuthServerConfigHash is the hash of the referenced authServerRef spec,\nused to detect configuration changes and trigger reconciliation.",
|
||||
"type": "string"
|
||||
},
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPServer's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"externalAuthConfigHash": {
|
||||
"description": "ExternalAuthConfigHash is the hash of the referenced MCPExternalAuthConfig spec",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message provides additional information about the current phase",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration reflects the generation most recently observed by the controller",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"oidcConfigHash": {
|
||||
"description": "OIDCConfigHash is the hash of the referenced MCPOIDCConfig spec for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"phase": {
|
||||
"description": "Phase is the current phase of the MCPServer",
|
||||
"enum": [
|
||||
"Pending",
|
||||
"Ready",
|
||||
"Failed",
|
||||
"Terminating",
|
||||
"Stopped"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"readyReplicas": {
|
||||
"description": "ReadyReplicas is the number of ready proxy replicas",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"telemetryConfigHash": {
|
||||
"description": "TelemetryConfigHash is the hash of the referenced MCPTelemetryConfig spec for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"toolConfigHash": {
|
||||
"description": "ToolConfigHash stores the hash of the referenced ToolConfig for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the URL where the MCP server can be accessed",
|
||||
"type": "string"
|
||||
},
|
||||
"webhookConfigHash": {
|
||||
"description": "WebhookConfigHash is the hash of the referenced MCPWebhookConfig spec",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,946 @@
|
||||
{
|
||||
"description": "MCPServer is the Schema for the mcpservers API",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPServerSpec defines the desired state of MCPServer",
|
||||
"properties": {
|
||||
"args": {
|
||||
"description": "Args are additional arguments to pass to the MCP server",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"audit": {
|
||||
"description": "Audit defines audit logging configuration for the MCP server",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"description": "Enabled controls whether audit logging is enabled\nWhen true, enables audit logging with default configuration",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"authServerRef": {
|
||||
"description": "AuthServerRef optionally references a resource that configures an embedded\nOAuth 2.0/OIDC authorization server to authenticate MCP clients.\nCurrently the only supported kind is MCPExternalAuthConfig (type: embeddedAuthServer).",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"default": "MCPExternalAuthConfig",
|
||||
"description": "Kind identifies the type of the referenced resource.",
|
||||
"enum": [
|
||||
"MCPExternalAuthConfig"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the referenced resource in the same namespace.",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"authzConfig": {
|
||||
"description": "AuthzConfig defines authorization policy configuration for the MCP server",
|
||||
"properties": {
|
||||
"configMap": {
|
||||
"description": "ConfigMap references a ConfigMap containing authorization configuration\nOnly used when Type is \"configMap\"",
|
||||
"properties": {
|
||||
"key": {
|
||||
"default": "authz.json",
|
||||
"description": "Key is the key in the ConfigMap that contains the authorization configuration",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the ConfigMap",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"groupClaimName": {
|
||||
"description": "GroupClaimName is the JWT claim key that contains group membership for the\nprincipal. When set, takes priority over the well-known defaults\n(\"groups\", \"roles\", \"cognito:groups\"). Use this for IDPs that place\ngroups under a URI-style claim (e.g. \"https://example.com/groups\"). When\nType is \"configMap\", a group_claim_name entry in the referenced ConfigMap\nis overridden by this field if both are set.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"groupEntityType": {
|
||||
"description": "GroupEntityType is the Cedar entity type name used for principal parent\nUIDs synthesised from JWT group/role claims. Defaults to \"THVGroup\" when\nempty. Must match the entity type used in the static entity store for\ntransitive `in` checks (e.g. `ClaimGroup \u2192 PlatformRole`) to resolve.\nNamespaced names (`Foo::Bar`) are not yet supported. When Type is\n\"configMap\", a group_entity_type entry in the referenced ConfigMap is\noverridden by this field if both are set.",
|
||||
"maxLength": 63,
|
||||
"pattern": "^[A-Za-z_][A-Za-z0-9_]*$",
|
||||
"type": "string"
|
||||
},
|
||||
"inline": {
|
||||
"description": "Inline contains direct authorization configuration\nOnly used when Type is \"inline\"",
|
||||
"properties": {
|
||||
"entitiesJson": {
|
||||
"default": "[]",
|
||||
"description": "EntitiesJSON is a JSON string representing Cedar entities. Required when\ntransitive policies (e.g. `ClaimGroup \u2192 PlatformRole`) need a static\nentity store; defaults to \"[]\".",
|
||||
"type": "string"
|
||||
},
|
||||
"policies": {
|
||||
"description": "Policies is a list of Cedar policy strings",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"minItems": 1,
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"primaryUpstreamProvider": {
|
||||
"description": "PrimaryUpstreamProvider names the upstream IDP whose access token's\nclaims Cedar should evaluate.\n\nDeprecated: on VirtualMCPServer this field has moved to\nspec.authServerConfig.primaryUpstreamProvider. The old location is\nstill read for one release for backward compatibility; the\nVirtualMCPServer controller emits an AuthzPrimaryUpstreamProviderDeprecated\nWarning event whenever it is consumed, and removal is planned for the\nrelease after the deprecation cycle.\n\nOn MCPServer and MCPRemoteProxy this field has always been a structural\nno-op (those CRDs do not run an embedded auth server). Setting it\ncontinues to surface the AuthzPrimaryUpstreamProviderIgnored advisory\ncondition; the deprecation does not change that behaviour.",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"policies"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"roleClaimName": {
|
||||
"description": "RoleClaimName is the JWT claim key that contains role membership for the\nprincipal. When set, the claim is extracted separately from GroupClaimName\nand both are mapped to the configured GroupEntityType. When Type is\n\"configMap\", a role_claim_name entry in the referenced ConfigMap is\noverridden by this field if both are set.",
|
||||
"maxLength": 253,
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"default": "configMap",
|
||||
"description": "Type is the type of authorization configuration",
|
||||
"enum": [
|
||||
"configMap",
|
||||
"inline"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "configMap must be set when type is 'configMap', and must not be set otherwise",
|
||||
"rule": "self.type == 'configMap' ? has(self.configMap) : !has(self.configMap)"
|
||||
},
|
||||
{
|
||||
"message": "inline must be set when type is 'inline', and must not be set otherwise",
|
||||
"rule": "self.type == 'inline' ? has(self.inline) : !has(self.inline)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"backendReplicas": {
|
||||
"description": "BackendReplicas is the desired number of MCP server backend pod replicas.\nThis controls the backend Deployment (the MCP server container itself),\nindependent of the proxy runner controlled by Replicas.\nWhen nil, the operator does not set Deployment.Spec.Replicas, leaving replica\nmanagement to an HPA or other external controller.",
|
||||
"format": "int32",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"endpointPrefix": {
|
||||
"description": "EndpointPrefix is the path prefix to prepend to SSE endpoint URLs.\nThis is used to handle path-based ingress routing scenarios where the ingress\nstrips a path prefix before forwarding to the backend.",
|
||||
"type": "string"
|
||||
},
|
||||
"env": {
|
||||
"description": "Env are environment variables to set in the MCP server container",
|
||||
"items": {
|
||||
"description": "EnvVar represents an environment variable in a container",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the environment variable",
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value of the environment variable",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"value"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"externalAuthConfigRef": {
|
||||
"description": "ExternalAuthConfigRef references a MCPExternalAuthConfig resource for external authentication.\nThe referenced MCPExternalAuthConfig must exist in the same namespace as this MCPServer.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPExternalAuthConfig resource",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"groupRef": {
|
||||
"description": "GroupRef references the MCPGroup this server belongs to.\nThe referenced MCPGroup must be in the same namespace.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPGroup resource in the same namespace",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"image": {
|
||||
"description": "Image is the container image for the MCP server",
|
||||
"type": "string"
|
||||
},
|
||||
"mcpPort": {
|
||||
"description": "MCPPort is the port that MCP server listens to",
|
||||
"format": "int32",
|
||||
"maximum": 65535,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"oidcConfigRef": {
|
||||
"description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPServer.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.",
|
||||
"properties": {
|
||||
"audience": {
|
||||
"description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPOIDCConfig resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"resourceUrl": {
|
||||
"description": "ResourceURL is the public URL for OAuth protected resource metadata (RFC 9728).\nWhen the server is exposed via Ingress or gateway, set this to the external\nURL that MCP clients connect to. If not specified, defaults to the internal\nKubernetes service URL.",
|
||||
"type": "string"
|
||||
},
|
||||
"scopes": {
|
||||
"description": "Scopes is the list of OAuth scopes to advertise in the well-known endpoint (RFC 9728).\nIf empty, defaults to [\"openid\"].",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"audience",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"permissionProfile": {
|
||||
"description": "PermissionProfile defines the permission profile to use",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key in the ConfigMap that contains the permission profile\nOnly used when Type is \"configmap\"",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the permission profile\nIf Type is \"builtin\", Name must be one of: \"none\", \"network\"\nIf Type is \"configmap\", Name is the name of the ConfigMap",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"default": "builtin",
|
||||
"description": "Type is the type of permission profile reference",
|
||||
"enum": [
|
||||
"builtin",
|
||||
"configmap"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"podTemplateSpec": {
|
||||
"description": "PodTemplateSpec defines the pod template to use for the MCP server\nThis allows for customizing the pod configuration beyond what is provided by the other fields.\nNote that to modify the specific container the MCP server runs in, you must specify\nthe `mcp` container name in the PodTemplateSpec.\nThis field accepts a PodTemplateSpec object as JSON/YAML.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"proxyMode": {
|
||||
"default": "streamable-http",
|
||||
"description": "ProxyMode is the proxy mode for stdio transport (sse or streamable-http)\nThis setting is ONLY applicable when Transport is \"stdio\".\nFor direct transports (sse, streamable-http), this field is ignored.\nThe default value is applied by Kubernetes but will be ignored for non-stdio transports.",
|
||||
"enum": [
|
||||
"sse",
|
||||
"streamable-http"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"proxyPort": {
|
||||
"default": 8080,
|
||||
"description": "ProxyPort is the port to expose the proxy runner on",
|
||||
"format": "int32",
|
||||
"maximum": 65535,
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"rateLimiting": {
|
||||
"description": "RateLimiting defines rate limiting configuration for the MCP server.\nRequires Redis session storage to be configured for distributed rate limiting.",
|
||||
"properties": {
|
||||
"perUser": {
|
||||
"description": "PerUser is a token bucket applied independently to each authenticated user\nat the server level. Requires authentication to be enabled.\nEach unique userID creates Redis keys that expire after 2x refillPeriod.\nMemory formula: unique_users_per_TTL_window * (1 + num_tools_with_per_user_limits) keys.",
|
||||
"properties": {
|
||||
"maxTokens": {
|
||||
"description": "MaxTokens is the maximum number of tokens (bucket capacity).\nThis is also the burst size: the maximum number of requests that can be served\ninstantaneously before the bucket is depleted.",
|
||||
"format": "int32",
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"refillPeriod": {
|
||||
"description": "RefillPeriod is the duration to fully refill the bucket from zero to maxTokens.\nThe effective refill rate is maxTokens / refillPeriod tokens per second.\nFormat: Go duration string (e.g., \"1m0s\", \"30s\", \"1h0m0s\").",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"maxTokens",
|
||||
"refillPeriod"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"shared": {
|
||||
"description": "Shared is a token bucket shared across all users for the entire server.",
|
||||
"properties": {
|
||||
"maxTokens": {
|
||||
"description": "MaxTokens is the maximum number of tokens (bucket capacity).\nThis is also the burst size: the maximum number of requests that can be served\ninstantaneously before the bucket is depleted.",
|
||||
"format": "int32",
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"refillPeriod": {
|
||||
"description": "RefillPeriod is the duration to fully refill the bucket from zero to maxTokens.\nThe effective refill rate is maxTokens / refillPeriod tokens per second.\nFormat: Go duration string (e.g., \"1m0s\", \"30s\", \"1h0m0s\").",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"maxTokens",
|
||||
"refillPeriod"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"tools": {
|
||||
"description": "Tools defines per-tool rate limit overrides.\nEach entry applies additional rate limits to calls targeting a specific tool name.\nA request must pass both the server-level limit and the per-tool limit.",
|
||||
"items": {
|
||||
"description": "ToolRateLimitConfig defines rate limits for a specific tool.\nAt least one of shared or perUser must be configured.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the MCP tool name this limit applies to.",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"perUser": {
|
||||
"description": "PerUser token bucket configuration for this tool.",
|
||||
"properties": {
|
||||
"maxTokens": {
|
||||
"description": "MaxTokens is the maximum number of tokens (bucket capacity).\nThis is also the burst size: the maximum number of requests that can be served\ninstantaneously before the bucket is depleted.",
|
||||
"format": "int32",
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"refillPeriod": {
|
||||
"description": "RefillPeriod is the duration to fully refill the bucket from zero to maxTokens.\nThe effective refill rate is maxTokens / refillPeriod tokens per second.\nFormat: Go duration string (e.g., \"1m0s\", \"30s\", \"1h0m0s\").",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"maxTokens",
|
||||
"refillPeriod"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"shared": {
|
||||
"description": "Shared token bucket for this specific tool.",
|
||||
"properties": {
|
||||
"maxTokens": {
|
||||
"description": "MaxTokens is the maximum number of tokens (bucket capacity).\nThis is also the burst size: the maximum number of requests that can be served\ninstantaneously before the bucket is depleted.",
|
||||
"format": "int32",
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"refillPeriod": {
|
||||
"description": "RefillPeriod is the duration to fully refill the bucket from zero to maxTokens.\nThe effective refill rate is maxTokens / refillPeriod tokens per second.\nFormat: Go duration string (e.g., \"1m0s\", \"30s\", \"1h0m0s\").",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"maxTokens",
|
||||
"refillPeriod"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "at least one of shared or perUser must be configured",
|
||||
"rule": "has(self.shared) || has(self.perUser)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "at least one of shared, perUser, or tools must be configured",
|
||||
"rule": "has(self.shared) || has(self.perUser) || (has(self.tools) && size(self.tools) > 0)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"replicas": {
|
||||
"description": "Replicas is the desired number of proxy runner (thv run) pod replicas.\nMCPServer creates two separate Deployments: one for the proxy runner and one\nfor the MCP server backend. This field controls the proxy runner Deployment.\nWhen nil, the operator does not set Deployment.Spec.Replicas, leaving replica\nmanagement to an HPA or other external controller.",
|
||||
"format": "int32",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"resourceOverrides": {
|
||||
"description": "ResourceOverrides allows overriding annotations and labels for resources created by the operator",
|
||||
"properties": {
|
||||
"proxyDeployment": {
|
||||
"description": "ProxyDeployment defines overrides for the Proxy Deployment resource (toolhive proxy)",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"env": {
|
||||
"description": "Env are environment variables to set in the proxy container (thv run process)\nThese affect the toolhive proxy itself, not the MCP server it manages\nUse TOOLHIVE_DEBUG=true to enable debug logging in the proxy",
|
||||
"items": {
|
||||
"description": "EnvVar represents an environment variable in a container",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the environment variable",
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value of the environment variable",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"value"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"imagePullSecrets": {
|
||||
"description": "ImagePullSecrets allows specifying image pull secrets for the proxy runner\nThese are applied to both the Deployment and the ServiceAccount",
|
||||
"items": {
|
||||
"description": "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"podTemplateMetadataOverrides": {
|
||||
"description": "ResourceMetadataOverrides defines metadata overrides for a resource",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"proxyService": {
|
||||
"description": "ProxyService defines overrides for the Proxy Service resource (points to the proxy deployment)",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Annotations to add or override on the resource",
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Labels to add or override on the resource",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"resources": {
|
||||
"description": "Resources defines the resource requirements for the MCP server container",
|
||||
"properties": {
|
||||
"limits": {
|
||||
"description": "Limits describes the maximum amount of compute resources allowed",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)",
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"requests": {
|
||||
"description": "Requests describes the minimum amount of compute resources required",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)",
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"secrets": {
|
||||
"description": "Secrets are references to secrets to mount in the MCP server container",
|
||||
"items": {
|
||||
"description": "SecretRef is a reference to a secret",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key in the secret itself",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"targetEnvName": {
|
||||
"description": "TargetEnvName is the environment variable to be used when setting up the secret in the MCP server\nIf left unspecified, it defaults to the key",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"serviceAccount": {
|
||||
"description": "ServiceAccount is the name of an already existing service account to use by the MCP server.\nIf not specified, a ServiceAccount will be created automatically and used by the MCP server.",
|
||||
"type": "string"
|
||||
},
|
||||
"sessionAffinity": {
|
||||
"default": "ClientIP",
|
||||
"description": "SessionAffinity controls whether the Service routes repeated client connections to the same pod.\nMCP protocols (SSE, streamable-http) are stateful, so ClientIP is the default.\nSet to \"None\" for stateless servers or when using an external load balancer with its own affinity.",
|
||||
"enum": [
|
||||
"ClientIP",
|
||||
"None"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"sessionStorage": {
|
||||
"description": "SessionStorage configures session storage for stateful horizontal scaling.\nWhen nil, no session storage is configured.",
|
||||
"properties": {
|
||||
"address": {
|
||||
"description": "Address is the Redis server address (required when provider is redis)",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"db": {
|
||||
"default": 0,
|
||||
"description": "DB is the Redis database number",
|
||||
"format": "int32",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"keyPrefix": {
|
||||
"description": "KeyPrefix is an optional prefix for all Redis keys used by ToolHive",
|
||||
"type": "string"
|
||||
},
|
||||
"passwordRef": {
|
||||
"description": "PasswordRef is a reference to a Secret key containing the Redis password",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"provider": {
|
||||
"description": "Provider is the session storage backend type",
|
||||
"enum": [
|
||||
"memory",
|
||||
"redis"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"provider"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "address is required",
|
||||
"rule": "self.provider == 'redis' ? has(self.address) : true"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"telemetryConfigRef": {
|
||||
"description": "TelemetryConfigRef references an MCPTelemetryConfig resource for shared telemetry configuration.\nThe referenced MCPTelemetryConfig must exist in the same namespace as this MCPServer.\nCross-namespace references are not supported for security and isolation reasons.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPTelemetryConfig resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"serviceName": {
|
||||
"description": "ServiceName overrides the telemetry service name for this specific server.\nThis MUST be unique per server for proper observability (e.g., distinguishing\ntraces and metrics from different servers sharing the same collector).\nIf empty, defaults to the server name with \"thv-\" prefix at runtime.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"toolConfigRef": {
|
||||
"description": "ToolConfigRef references a MCPToolConfig resource for tool filtering and renaming.\nThe referenced MCPToolConfig must exist in the same namespace as this MCPServer.\nCross-namespace references are not supported for security and isolation reasons.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPToolConfig resource in the same namespace",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"transport": {
|
||||
"default": "stdio",
|
||||
"description": "Transport is the transport method for the MCP server (stdio, streamable-http or sse)",
|
||||
"enum": [
|
||||
"stdio",
|
||||
"streamable-http",
|
||||
"sse"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"trustProxyHeaders": {
|
||||
"default": false,
|
||||
"description": "TrustProxyHeaders indicates whether to trust X-Forwarded-* headers from reverse proxies\nWhen enabled, the proxy will use X-Forwarded-Proto, X-Forwarded-Host, X-Forwarded-Port,\nand X-Forwarded-Prefix headers to construct endpoint URLs",
|
||||
"type": "boolean"
|
||||
},
|
||||
"volumes": {
|
||||
"description": "Volumes are volumes to mount in the MCP server container",
|
||||
"items": {
|
||||
"description": "Volume represents a volume to mount in a container",
|
||||
"properties": {
|
||||
"hostPath": {
|
||||
"description": "HostPath is the path on the host to mount",
|
||||
"type": "string"
|
||||
},
|
||||
"mountPath": {
|
||||
"description": "MountPath is the path in the container to mount to",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the volume",
|
||||
"type": "string"
|
||||
},
|
||||
"readOnly": {
|
||||
"default": false,
|
||||
"description": "ReadOnly specifies whether the volume should be mounted read-only",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"hostPath",
|
||||
"mountPath",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"webhookConfigRef": {
|
||||
"description": "WebhookConfigRef references a MCPWebhookConfig resource for webhook middleware configuration.\nThe referenced MCPWebhookConfig must exist in the same namespace as this MCPServer.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPWebhookConfig resource",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"image"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "rateLimiting requires sessionStorage with provider 'redis'",
|
||||
"rule": "!has(self.rateLimiting) || (has(self.sessionStorage) && self.sessionStorage.provider == 'redis')"
|
||||
},
|
||||
{
|
||||
"message": "rateLimiting.perUser requires authentication (oidcConfigRef or externalAuthConfigRef)",
|
||||
"rule": "!(has(self.rateLimiting) && has(self.rateLimiting.perUser)) || has(self.oidcConfigRef) || has(self.externalAuthConfigRef)"
|
||||
},
|
||||
{
|
||||
"message": "per-tool perUser rate limiting requires authentication (oidcConfigRef or externalAuthConfigRef)",
|
||||
"rule": "!has(self.rateLimiting) || !has(self.rateLimiting.tools) || self.rateLimiting.tools.all(t, !has(t.perUser)) || has(self.oidcConfigRef) || has(self.externalAuthConfigRef)"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPServerStatus defines the observed state of MCPServer",
|
||||
"properties": {
|
||||
"authServerConfigHash": {
|
||||
"description": "AuthServerConfigHash is the hash of the referenced authServerRef spec,\nused to detect configuration changes and trigger reconciliation.",
|
||||
"type": "string"
|
||||
},
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPServer's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"externalAuthConfigHash": {
|
||||
"description": "ExternalAuthConfigHash is the hash of the referenced MCPExternalAuthConfig spec",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message provides additional information about the current phase",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration reflects the generation most recently observed by the controller",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"oidcConfigHash": {
|
||||
"description": "OIDCConfigHash is the hash of the referenced MCPOIDCConfig spec for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"phase": {
|
||||
"description": "Phase is the current phase of the MCPServer",
|
||||
"enum": [
|
||||
"Pending",
|
||||
"Ready",
|
||||
"Failed",
|
||||
"Terminating",
|
||||
"Stopped"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"readyReplicas": {
|
||||
"description": "ReadyReplicas is the number of ready proxy replicas",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"telemetryConfigHash": {
|
||||
"description": "TelemetryConfigHash is the hash of the referenced MCPTelemetryConfig spec for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"toolConfigHash": {
|
||||
"description": "ToolConfigHash stores the hash of the referenced ToolConfig for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the URL where the MCP server can be accessed",
|
||||
"type": "string"
|
||||
},
|
||||
"webhookConfigHash": {
|
||||
"description": "WebhookConfigHash is the hash of the referenced MCPWebhookConfig spec",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,242 @@
|
||||
{
|
||||
"description": "MCPServerEntry is the deprecated v1alpha1 version of the MCPServerEntry resource.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPServerEntrySpec defines the desired state of MCPServerEntry.\nMCPServerEntry is a zero-infrastructure catalog entry that declares a remote MCP\nserver endpoint. Unlike MCPRemoteProxy, it creates no pods, services, or deployments.",
|
||||
"properties": {
|
||||
"caBundleRef": {
|
||||
"description": "CABundleRef references a ConfigMap containing CA certificates for TLS verification\nwhen connecting to the remote MCP server.",
|
||||
"properties": {
|
||||
"configMapRef": {
|
||||
"description": "ConfigMapRef references a ConfigMap containing the CA certificate bundle.\nIf Key is not specified, it defaults to \"ca.crt\".",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
},
|
||||
"optional": {
|
||||
"description": "Specify whether the ConfigMap or its key must be defined",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"externalAuthConfigRef": {
|
||||
"description": "ExternalAuthConfigRef references a MCPExternalAuthConfig resource for token exchange\nwhen connecting to the remote MCP server. The referenced MCPExternalAuthConfig must\nexist in the same namespace as this MCPServerEntry.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPExternalAuthConfig resource",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"groupRef": {
|
||||
"description": "GroupRef references the MCPGroup this entry belongs to.\nRequired \u2014 every MCPServerEntry must be part of a group for vMCP discovery.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPGroup resource in the same namespace",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"headerForward": {
|
||||
"description": "HeaderForward configures headers to inject into requests to the remote MCP server.\nUse this to add custom headers like API keys or correlation IDs.",
|
||||
"properties": {
|
||||
"addHeadersFromSecret": {
|
||||
"description": "AddHeadersFromSecret references Kubernetes Secrets for sensitive header values.",
|
||||
"items": {
|
||||
"description": "HeaderFromSecret defines a header whose value comes from a Kubernetes Secret.",
|
||||
"properties": {
|
||||
"headerName": {
|
||||
"description": "HeaderName is the HTTP header name (e.g., \"X-API-Key\")",
|
||||
"maxLength": 255,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"valueSecretRef": {
|
||||
"description": "ValueSecretRef references the Secret and key containing the header value",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"headerName",
|
||||
"valueSecretRef"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"headerName"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"addPlaintextHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "AddPlaintextHeaders is a map of header names to literal values to inject into requests.\nWARNING: Values are stored in plaintext and visible via kubectl commands.\nUse addHeadersFromSecret for sensitive data like API keys or tokens.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"remoteUrl": {
|
||||
"description": "RemoteURL is the URL of the remote MCP server.\nBoth HTTP and HTTPS schemes are accepted at admission time.",
|
||||
"pattern": "^https?://",
|
||||
"type": "string"
|
||||
},
|
||||
"transport": {
|
||||
"description": "Transport is the transport method for the remote server (sse or streamable-http).\nNo default is set (unlike MCPRemoteProxy) because MCPServerEntry points at external\nservers the user doesn't control \u2014 requiring explicit transport avoids silent mismatches.",
|
||||
"enum": [
|
||||
"sse",
|
||||
"streamable-http"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"groupRef",
|
||||
"remoteUrl",
|
||||
"transport"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPServerEntryStatus defines the observed state of MCPServerEntry.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPServerEntry's state.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration reflects the generation most recently observed by the controller.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"phase": {
|
||||
"default": "Pending",
|
||||
"description": "Phase indicates the current lifecycle phase of the MCPServerEntry.",
|
||||
"enum": [
|
||||
"Valid",
|
||||
"Pending",
|
||||
"Failed"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,242 @@
|
||||
{
|
||||
"description": "MCPServerEntry is the Schema for the mcpserverentries API.\nIt declares a remote MCP server endpoint for vMCP discovery and routing\nwithout deploying any infrastructure.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPServerEntrySpec defines the desired state of MCPServerEntry.\nMCPServerEntry is a zero-infrastructure catalog entry that declares a remote MCP\nserver endpoint. Unlike MCPRemoteProxy, it creates no pods, services, or deployments.",
|
||||
"properties": {
|
||||
"caBundleRef": {
|
||||
"description": "CABundleRef references a ConfigMap containing CA certificates for TLS verification\nwhen connecting to the remote MCP server.",
|
||||
"properties": {
|
||||
"configMapRef": {
|
||||
"description": "ConfigMapRef references a ConfigMap containing the CA certificate bundle.\nIf Key is not specified, it defaults to \"ca.crt\".",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
},
|
||||
"optional": {
|
||||
"description": "Specify whether the ConfigMap or its key must be defined",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"externalAuthConfigRef": {
|
||||
"description": "ExternalAuthConfigRef references a MCPExternalAuthConfig resource for token exchange\nwhen connecting to the remote MCP server. The referenced MCPExternalAuthConfig must\nexist in the same namespace as this MCPServerEntry.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPExternalAuthConfig resource",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"groupRef": {
|
||||
"description": "GroupRef references the MCPGroup this entry belongs to.\nRequired \u2014 every MCPServerEntry must be part of a group for vMCP discovery.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the name of the MCPGroup resource in the same namespace",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"headerForward": {
|
||||
"description": "HeaderForward configures headers to inject into requests to the remote MCP server.\nUse this to add custom headers like API keys or correlation IDs.",
|
||||
"properties": {
|
||||
"addHeadersFromSecret": {
|
||||
"description": "AddHeadersFromSecret references Kubernetes Secrets for sensitive header values.",
|
||||
"items": {
|
||||
"description": "HeaderFromSecret defines a header whose value comes from a Kubernetes Secret.",
|
||||
"properties": {
|
||||
"headerName": {
|
||||
"description": "HeaderName is the HTTP header name (e.g., \"X-API-Key\")",
|
||||
"maxLength": 255,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"valueSecretRef": {
|
||||
"description": "ValueSecretRef references the Secret and key containing the header value",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"headerName",
|
||||
"valueSecretRef"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"headerName"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"addPlaintextHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "AddPlaintextHeaders is a map of header names to literal values to inject into requests.\nWARNING: Values are stored in plaintext and visible via kubectl commands.\nUse addHeadersFromSecret for sensitive data like API keys or tokens.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"remoteUrl": {
|
||||
"description": "RemoteURL is the URL of the remote MCP server.\nBoth HTTP and HTTPS schemes are accepted at admission time.",
|
||||
"pattern": "^https?://",
|
||||
"type": "string"
|
||||
},
|
||||
"transport": {
|
||||
"description": "Transport is the transport method for the remote server (sse or streamable-http).\nNo default is set (unlike MCPRemoteProxy) because MCPServerEntry points at external\nservers the user doesn't control \u2014 requiring explicit transport avoids silent mismatches.",
|
||||
"enum": [
|
||||
"sse",
|
||||
"streamable-http"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"groupRef",
|
||||
"remoteUrl",
|
||||
"transport"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPServerEntryStatus defines the observed state of MCPServerEntry.",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPServerEntry's state.",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration reflects the generation most recently observed by the controller.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"phase": {
|
||||
"default": "Pending",
|
||||
"description": "Phase indicates the current lifecycle phase of the MCPServerEntry.",
|
||||
"enum": [
|
||||
"Valid",
|
||||
"Pending",
|
||||
"Failed"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,295 @@
|
||||
{
|
||||
"description": "MCPTelemetryConfig is the deprecated v1alpha1 version of the MCPTelemetryConfig resource.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPTelemetryConfigSpec defines the desired state of MCPTelemetryConfig.\nThe spec uses a nested structure with openTelemetry and prometheus sub-objects\nfor clear separation of concerns.",
|
||||
"properties": {
|
||||
"openTelemetry": {
|
||||
"description": "OpenTelemetry defines OpenTelemetry configuration (OTLP endpoint, tracing, metrics)",
|
||||
"properties": {
|
||||
"caBundleRef": {
|
||||
"description": "CABundleRef references a ConfigMap containing a CA certificate bundle for the OTLP endpoint.\nWhen specified, the operator mounts the ConfigMap into the proxyrunner pod and configures\nthe OTLP exporters to trust the custom CA. This is useful when the OTLP collector uses\nTLS with certificates signed by an internal or private CA.",
|
||||
"properties": {
|
||||
"configMapRef": {
|
||||
"description": "ConfigMapRef references a ConfigMap containing the CA certificate bundle.\nIf Key is not specified, it defaults to \"ca.crt\".",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
},
|
||||
"optional": {
|
||||
"description": "Specify whether the ConfigMap or its key must be defined",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"description": "Enabled controls whether OpenTelemetry is enabled",
|
||||
"type": "boolean"
|
||||
},
|
||||
"endpoint": {
|
||||
"description": "Endpoint is the OTLP endpoint URL for tracing and metrics",
|
||||
"type": "string"
|
||||
},
|
||||
"headers": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Headers contains authentication headers for the OTLP endpoint.\nFor secret-backed credentials, use sensitiveHeaders instead.",
|
||||
"type": "object"
|
||||
},
|
||||
"insecure": {
|
||||
"default": false,
|
||||
"description": "Insecure indicates whether to use HTTP instead of HTTPS for the OTLP endpoint",
|
||||
"type": "boolean"
|
||||
},
|
||||
"metrics": {
|
||||
"description": "Metrics defines OpenTelemetry metrics-specific configuration",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"description": "Enabled controls whether OTLP metrics are sent",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"resourceAttributes": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "ResourceAttributes contains custom resource attributes to be added to all telemetry signals.\nThese become OTel resource attributes (e.g., deployment.environment, service.namespace).\nNote: service.name is intentionally excluded \u2014 it is set per-server via\nMCPTelemetryConfigReference.ServiceName.",
|
||||
"type": "object"
|
||||
},
|
||||
"sensitiveHeaders": {
|
||||
"description": "SensitiveHeaders contains headers whose values are stored in Kubernetes Secrets.\nUse this for credential headers (e.g., API keys, bearer tokens) instead of\nembedding secrets in the headers field.",
|
||||
"items": {
|
||||
"description": "SensitiveHeader represents a header whose value is stored in a Kubernetes Secret.\nThis allows credential headers (e.g., API keys, bearer tokens) to be securely\nreferenced without embedding secrets inline in the MCPTelemetryConfig resource.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the header name (e.g., \"Authorization\", \"X-API-Key\")",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"secretKeyRef": {
|
||||
"description": "SecretKeyRef is a reference to a Kubernetes Secret key containing the header value",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"secretKeyRef"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"tracing": {
|
||||
"description": "Tracing defines OpenTelemetry tracing configuration",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"description": "Enabled controls whether OTLP tracing is sent",
|
||||
"type": "boolean"
|
||||
},
|
||||
"samplingRate": {
|
||||
"default": "0.05",
|
||||
"description": "SamplingRate is the trace sampling rate (0.0-1.0)",
|
||||
"pattern": "^(0(\\.\\d+)?|1(\\.0+)?)$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"useLegacyAttributes": {
|
||||
"default": true,
|
||||
"description": "UseLegacyAttributes controls whether legacy attribute names are emitted alongside\nthe new MCP OTEL semantic convention names. Defaults to true for backward compatibility.\nThis will change to false in a future release and eventually be removed.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "a header name cannot appear in both headers and sensitiveHeaders",
|
||||
"rule": "!has(self.headers) || !has(self.sensitiveHeaders) || self.sensitiveHeaders.all(sh, !(sh.name in self.headers))"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"prometheus": {
|
||||
"description": "Prometheus defines Prometheus-specific configuration",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"description": "Enabled controls whether Prometheus metrics endpoint is exposed",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPTelemetryConfigStatus defines the observed state of MCPTelemetryConfig",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPTelemetryConfig's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"configHash": {
|
||||
"description": "ConfigHash is a hash of the current configuration for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration is the most recent generation observed for this MCPTelemetryConfig.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"referencingWorkloads": {
|
||||
"description": "ReferencingWorkloads lists workloads that reference this MCPTelemetryConfig",
|
||||
"items": {
|
||||
"description": "WorkloadReference identifies a workload that references a shared configuration resource.\nNamespace is implicit \u2014 cross-namespace references are not supported.",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"description": "Kind is the type of workload resource",
|
||||
"enum": [
|
||||
"MCPServer",
|
||||
"VirtualMCPServer",
|
||||
"MCPRemoteProxy"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the workload resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,295 @@
|
||||
{
|
||||
"description": "MCPTelemetryConfig is the Schema for the mcptelemetryconfigs API.\nMCPTelemetryConfig resources are namespace-scoped and can only be referenced by\nMCPServer resources within the same namespace. Cross-namespace references\nare not supported for security and isolation reasons.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPTelemetryConfigSpec defines the desired state of MCPTelemetryConfig.\nThe spec uses a nested structure with openTelemetry and prometheus sub-objects\nfor clear separation of concerns.",
|
||||
"properties": {
|
||||
"openTelemetry": {
|
||||
"description": "OpenTelemetry defines OpenTelemetry configuration (OTLP endpoint, tracing, metrics)",
|
||||
"properties": {
|
||||
"caBundleRef": {
|
||||
"description": "CABundleRef references a ConfigMap containing a CA certificate bundle for the OTLP endpoint.\nWhen specified, the operator mounts the ConfigMap into the proxyrunner pod and configures\nthe OTLP exporters to trust the custom CA. This is useful when the OTLP collector uses\nTLS with certificates signed by an internal or private CA.",
|
||||
"properties": {
|
||||
"configMapRef": {
|
||||
"description": "ConfigMapRef references a ConfigMap containing the CA certificate bundle.\nIf Key is not specified, it defaults to \"ca.crt\".",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "The key to select.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"default": "",
|
||||
"description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"type": "string"
|
||||
},
|
||||
"optional": {
|
||||
"description": "Specify whether the ConfigMap or its key must be defined",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key"
|
||||
],
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"description": "Enabled controls whether OpenTelemetry is enabled",
|
||||
"type": "boolean"
|
||||
},
|
||||
"endpoint": {
|
||||
"description": "Endpoint is the OTLP endpoint URL for tracing and metrics",
|
||||
"type": "string"
|
||||
},
|
||||
"headers": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Headers contains authentication headers for the OTLP endpoint.\nFor secret-backed credentials, use sensitiveHeaders instead.",
|
||||
"type": "object"
|
||||
},
|
||||
"insecure": {
|
||||
"default": false,
|
||||
"description": "Insecure indicates whether to use HTTP instead of HTTPS for the OTLP endpoint",
|
||||
"type": "boolean"
|
||||
},
|
||||
"metrics": {
|
||||
"description": "Metrics defines OpenTelemetry metrics-specific configuration",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"description": "Enabled controls whether OTLP metrics are sent",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"resourceAttributes": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "ResourceAttributes contains custom resource attributes to be added to all telemetry signals.\nThese become OTel resource attributes (e.g., deployment.environment, service.namespace).\nNote: service.name is intentionally excluded \u2014 it is set per-server via\nMCPTelemetryConfigReference.ServiceName.",
|
||||
"type": "object"
|
||||
},
|
||||
"sensitiveHeaders": {
|
||||
"description": "SensitiveHeaders contains headers whose values are stored in Kubernetes Secrets.\nUse this for credential headers (e.g., API keys, bearer tokens) instead of\nembedding secrets in the headers field.",
|
||||
"items": {
|
||||
"description": "SensitiveHeader represents a header whose value is stored in a Kubernetes Secret.\nThis allows credential headers (e.g., API keys, bearer tokens) to be securely\nreferenced without embedding secrets inline in the MCPTelemetryConfig resource.",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name is the header name (e.g., \"Authorization\", \"X-API-Key\")",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"secretKeyRef": {
|
||||
"description": "SecretKeyRef is a reference to a Kubernetes Secret key containing the header value",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"secretKeyRef"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"tracing": {
|
||||
"description": "Tracing defines OpenTelemetry tracing configuration",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"description": "Enabled controls whether OTLP tracing is sent",
|
||||
"type": "boolean"
|
||||
},
|
||||
"samplingRate": {
|
||||
"default": "0.05",
|
||||
"description": "SamplingRate is the trace sampling rate (0.0-1.0)",
|
||||
"pattern": "^(0(\\.\\d+)?|1(\\.0+)?)$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"useLegacyAttributes": {
|
||||
"default": true,
|
||||
"description": "UseLegacyAttributes controls whether legacy attribute names are emitted alongside\nthe new MCP OTEL semantic convention names. Defaults to true for backward compatibility.\nThis will change to false in a future release and eventually be removed.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "a header name cannot appear in both headers and sensitiveHeaders",
|
||||
"rule": "!has(self.headers) || !has(self.sensitiveHeaders) || self.sensitiveHeaders.all(sh, !(sh.name in self.headers))"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"prometheus": {
|
||||
"description": "Prometheus defines Prometheus-specific configuration",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"description": "Enabled controls whether Prometheus metrics endpoint is exposed",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPTelemetryConfigStatus defines the observed state of MCPTelemetryConfig",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPTelemetryConfig's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"configHash": {
|
||||
"description": "ConfigHash is a hash of the current configuration for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration is the most recent generation observed for this MCPTelemetryConfig.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"referencingWorkloads": {
|
||||
"description": "ReferencingWorkloads lists workloads that reference this MCPTelemetryConfig",
|
||||
"items": {
|
||||
"description": "WorkloadReference identifies a workload that references a shared configuration resource.\nNamespace is implicit \u2014 cross-namespace references are not supported.",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"description": "Kind is the type of workload resource",
|
||||
"enum": [
|
||||
"MCPServer",
|
||||
"VirtualMCPServer",
|
||||
"MCPRemoteProxy"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the workload resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,192 @@
|
||||
{
|
||||
"description": "MCPToolConfig is the deprecated v1alpha1 version of the MCPToolConfig resource.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPToolConfigSpec defines the desired state of MCPToolConfig.\nMCPToolConfig resources are namespace-scoped and can only be referenced by\nMCPServer resources in the same namespace.",
|
||||
"properties": {
|
||||
"toolsFilter": {
|
||||
"description": "ToolsFilter is a list of tool names to filter (allow list).\nOnly tools in this list will be exposed by the MCP server.\nIf empty, all tools are exposed.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "set"
|
||||
},
|
||||
"toolsOverride": {
|
||||
"additionalProperties": {
|
||||
"description": "ToolOverride represents a tool override configuration.\nBoth Name and Description can be overridden independently, but\nthey can't be both empty.",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"description": "Annotations overrides specific tool annotation fields.\nOnly specified fields are overridden; others pass through from the backend.",
|
||||
"properties": {
|
||||
"destructiveHint": {
|
||||
"description": "DestructiveHint overrides the destructive hint annotation.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"idempotentHint": {
|
||||
"description": "IdempotentHint overrides the idempotent hint annotation.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"openWorldHint": {
|
||||
"description": "OpenWorldHint overrides the open-world hint annotation.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"readOnlyHint": {
|
||||
"description": "ReadOnlyHint overrides the read-only hint annotation.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"title": {
|
||||
"description": "Title overrides the human-readable title annotation.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": {
|
||||
"description": "Description is the redefined description of the tool",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the redefined name of the tool",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": "ToolsOverride is a map from actual tool names to their overridden configuration.\nThis allows renaming tools and/or changing their descriptions.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPToolConfigStatus defines the observed state of MCPToolConfig",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPToolConfig's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"configHash": {
|
||||
"description": "ConfigHash is a hash of the current configuration for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration is the most recent generation observed for this MCPToolConfig.\nIt corresponds to the MCPToolConfig's generation, which is updated on mutation by the API Server.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"referenceCount": {
|
||||
"description": "ReferenceCount is the number of workloads referencing this config.",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"referencingWorkloads": {
|
||||
"description": "ReferencingWorkloads is a list of workload resources that reference this MCPToolConfig.\nEach entry identifies the workload by kind and name.",
|
||||
"items": {
|
||||
"description": "WorkloadReference identifies a workload that references a shared configuration resource.\nNamespace is implicit \u2014 cross-namespace references are not supported.",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"description": "Kind is the type of workload resource",
|
||||
"enum": [
|
||||
"MCPServer",
|
||||
"VirtualMCPServer",
|
||||
"MCPRemoteProxy"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the workload resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,192 @@
|
||||
{
|
||||
"description": "MCPToolConfig is the Schema for the mcptoolconfigs API.\nMCPToolConfig resources are namespace-scoped and can only be referenced by\nMCPServer resources within the same namespace. Cross-namespace references\nare not supported for security and isolation reasons.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPToolConfigSpec defines the desired state of MCPToolConfig.\nMCPToolConfig resources are namespace-scoped and can only be referenced by\nMCPServer resources in the same namespace.",
|
||||
"properties": {
|
||||
"toolsFilter": {
|
||||
"description": "ToolsFilter is a list of tool names to filter (allow list).\nOnly tools in this list will be exposed by the MCP server.\nIf empty, all tools are exposed.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "set"
|
||||
},
|
||||
"toolsOverride": {
|
||||
"additionalProperties": {
|
||||
"description": "ToolOverride represents a tool override configuration.\nBoth Name and Description can be overridden independently, but\nthey can't be both empty.",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"description": "Annotations overrides specific tool annotation fields.\nOnly specified fields are overridden; others pass through from the backend.",
|
||||
"properties": {
|
||||
"destructiveHint": {
|
||||
"description": "DestructiveHint overrides the destructive hint annotation.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"idempotentHint": {
|
||||
"description": "IdempotentHint overrides the idempotent hint annotation.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"openWorldHint": {
|
||||
"description": "OpenWorldHint overrides the open-world hint annotation.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"readOnlyHint": {
|
||||
"description": "ReadOnlyHint overrides the read-only hint annotation.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"title": {
|
||||
"description": "Title overrides the human-readable title annotation.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": {
|
||||
"description": "Description is the redefined description of the tool",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the redefined name of the tool",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": "ToolsOverride is a map from actual tool names to their overridden configuration.\nThis allows renaming tools and/or changing their descriptions.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPToolConfigStatus defines the observed state of MCPToolConfig",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the MCPToolConfig's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"configHash": {
|
||||
"description": "ConfigHash is a hash of the current configuration for change detection",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration is the most recent generation observed for this MCPToolConfig.\nIt corresponds to the MCPToolConfig's generation, which is updated on mutation by the API Server.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"referenceCount": {
|
||||
"description": "ReferenceCount is the number of workloads referencing this config.",
|
||||
"format": "int32",
|
||||
"type": "integer"
|
||||
},
|
||||
"referencingWorkloads": {
|
||||
"description": "ReferencingWorkloads is a list of workload resources that reference this MCPToolConfig.\nEach entry identifies the workload by kind and name.",
|
||||
"items": {
|
||||
"description": "WorkloadReference identifies a workload that references a shared configuration resource.\nNamespace is implicit \u2014 cross-namespace references are not supported.",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"description": "Kind is the type of workload resource",
|
||||
"enum": [
|
||||
"MCPServer",
|
||||
"VirtualMCPServer",
|
||||
"MCPRemoteProxy"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the workload resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,393 @@
|
||||
{
|
||||
"description": "MCPWebhookConfig is the Schema for the mcpwebhookconfigs API.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "MCPWebhookConfigSpec defines the desired state of MCPWebhookConfig",
|
||||
"properties": {
|
||||
"mutating": {
|
||||
"description": "Mutating webhooks are called to transform MCP requests before processing.",
|
||||
"items": {
|
||||
"description": "WebhookSpec defines the configuration for a single webhook middleware",
|
||||
"properties": {
|
||||
"failurePolicy": {
|
||||
"default": "fail",
|
||||
"description": "FailurePolicy defines how to handle errors when communicating with the webhook.\nSupported values: \"fail\", \"ignore\". Defaults to \"fail\".",
|
||||
"enum": [
|
||||
"fail",
|
||||
"ignore"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"hmacSecretRef": {
|
||||
"description": "HMACSecretRef references a Kubernetes Secret containing the HMAC signing key\nused to sign the webhook payload. If set, the X-Toolhive-Signature header will be injected.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is a unique identifier for this webhook",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"timeout": {
|
||||
"description": "Timeout configures the maximum time to wait for the webhook to respond.\nDefaults to 10s if not specified. Maximum is 30s.",
|
||||
"format": "duration",
|
||||
"type": "string"
|
||||
},
|
||||
"tlsConfig": {
|
||||
"description": "TLSConfig contains optional TLS configuration for the webhook connection.",
|
||||
"properties": {
|
||||
"caSecretRef": {
|
||||
"description": "CASecretRef references a Secret containing the CA certificate bundle used to verify the webhook server's certificate.\nContains a bundle of PEM-encoded X.509 certificates.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"clientCertSecretRef": {
|
||||
"description": "ClientCertSecretRef references a Secret containing the client certificate for mTLS authentication.\nThe referenced key must contain a PEM-encoded client certificate.\nUse ClientKeySecretRef to provide the corresponding private key.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"clientKeySecretRef": {
|
||||
"description": "ClientKeySecretRef references a Secret containing the private key for the client certificate.\nRequired when ClientCertSecretRef is set to enable mTLS.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"insecureSkipVerify": {
|
||||
"description": "InsecureSkipVerify disables server certificate verification.\nWARNING: This should only be used for development/testing and not in production environments.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the endpoint to call for this webhook. Must be an HTTP/HTTPS URL.",
|
||||
"format": "uri",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"url"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"validating": {
|
||||
"description": "Validating webhooks are called to approve or deny MCP requests.",
|
||||
"items": {
|
||||
"description": "WebhookSpec defines the configuration for a single webhook middleware",
|
||||
"properties": {
|
||||
"failurePolicy": {
|
||||
"default": "fail",
|
||||
"description": "FailurePolicy defines how to handle errors when communicating with the webhook.\nSupported values: \"fail\", \"ignore\". Defaults to \"fail\".",
|
||||
"enum": [
|
||||
"fail",
|
||||
"ignore"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"hmacSecretRef": {
|
||||
"description": "HMACSecretRef references a Kubernetes Secret containing the HMAC signing key\nused to sign the webhook payload. If set, the X-Toolhive-Signature header will be injected.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is a unique identifier for this webhook",
|
||||
"maxLength": 63,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"timeout": {
|
||||
"description": "Timeout configures the maximum time to wait for the webhook to respond.\nDefaults to 10s if not specified. Maximum is 30s.",
|
||||
"format": "duration",
|
||||
"type": "string"
|
||||
},
|
||||
"tlsConfig": {
|
||||
"description": "TLSConfig contains optional TLS configuration for the webhook connection.",
|
||||
"properties": {
|
||||
"caSecretRef": {
|
||||
"description": "CASecretRef references a Secret containing the CA certificate bundle used to verify the webhook server's certificate.\nContains a bundle of PEM-encoded X.509 certificates.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"clientCertSecretRef": {
|
||||
"description": "ClientCertSecretRef references a Secret containing the client certificate for mTLS authentication.\nThe referenced key must contain a PEM-encoded client certificate.\nUse ClientKeySecretRef to provide the corresponding private key.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"clientKeySecretRef": {
|
||||
"description": "ClientKeySecretRef references a Secret containing the private key for the client certificate.\nRequired when ClientCertSecretRef is set to enable mTLS.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "Key is the key within the secret",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the secret",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"insecureSkipVerify": {
|
||||
"description": "InsecureSkipVerify disables server certificate verification.\nWARNING: This should only be used for development/testing and not in production environments.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"url": {
|
||||
"description": "URL is the endpoint to call for this webhook. Must be an HTTP/HTTPS URL.",
|
||||
"format": "uri",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"url"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-validations": [
|
||||
{
|
||||
"message": "at least one validating or mutating webhook must be defined",
|
||||
"rule": "(has(self.validating) ? size(self.validating) : 0) + (has(self.mutating) ? size(self.mutating) : 0) > 0"
|
||||
}
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "MCPWebhookConfigStatus defines the observed state of MCPWebhookConfig",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"configHash": {
|
||||
"description": "ConfigHash is a hash of the spec, used for detecting changes",
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration is the last observed generation corresponding to the current status",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"referencingWorkloads": {
|
||||
"description": "ReferencingWorkloads is a list of workload resources that reference this MCPWebhookConfig.\nEach entry identifies the workload by kind and name.",
|
||||
"items": {
|
||||
"description": "WorkloadReference identifies a workload that references a shared configuration resource.\nNamespace is implicit \u2014 cross-namespace references are not supported.",
|
||||
"properties": {
|
||||
"kind": {
|
||||
"description": "Kind is the type of workload resource",
|
||||
"enum": [
|
||||
"MCPServer",
|
||||
"VirtualMCPServer",
|
||||
"MCPRemoteProxy"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the name of the workload resource",
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"kind",
|
||||
"name"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"name"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,183 @@
|
||||
{
|
||||
"description": "PodLogs defines how to collect logs for a Pod.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "PodLogsSpec defines how to collect logs for a Pod.",
|
||||
"properties": {
|
||||
"namespaceSelector": {
|
||||
"description": "Selector to select which namespaces the Pod objects are discovered from.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"relabelings": {
|
||||
"description": "RelabelConfigs to apply to logs before delivering.",
|
||||
"items": {
|
||||
"description": "RelabelConfig allows dynamic rewriting of the label set, being applied to samples before ingestion. It defines `<metric_relabel_configs>`-section of Prometheus configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs",
|
||||
"properties": {
|
||||
"action": {
|
||||
"default": "replace",
|
||||
"description": "Action to perform based on regex matching. Default is 'replace'. uppercase and lowercase actions require Prometheus >= 2.36.",
|
||||
"enum": [
|
||||
"replace",
|
||||
"Replace",
|
||||
"keep",
|
||||
"Keep",
|
||||
"drop",
|
||||
"Drop",
|
||||
"hashmod",
|
||||
"HashMod",
|
||||
"labelmap",
|
||||
"LabelMap",
|
||||
"labeldrop",
|
||||
"LabelDrop",
|
||||
"labelkeep",
|
||||
"LabelKeep",
|
||||
"lowercase",
|
||||
"Lowercase",
|
||||
"uppercase",
|
||||
"Uppercase"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"modulus": {
|
||||
"description": "Modulus to take of the hash of the source label values.",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"regex": {
|
||||
"description": "Regular expression against which the extracted value is matched. Default is '(.*)'",
|
||||
"type": "string"
|
||||
},
|
||||
"replacement": {
|
||||
"description": "Replacement value against which a regex replace is performed if the regular expression matches. Regex capture groups are available. Default is '$1'",
|
||||
"type": "string"
|
||||
},
|
||||
"separator": {
|
||||
"description": "Separator placed between concatenated source label values. default is ';'.",
|
||||
"type": "string"
|
||||
},
|
||||
"sourceLabels": {
|
||||
"description": "The source labels select values from existing labels. Their content is concatenated using the configured separator and matched against the configured regular expression for the replace, keep, and drop actions.",
|
||||
"items": {
|
||||
"description": "LabelName is a valid Prometheus label name which may only contain ASCII letters, numbers, as well as underscores.",
|
||||
"pattern": "^[a-zA-Z_][a-zA-Z0-9_]*$",
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"targetLabel": {
|
||||
"description": "Label to which the resulting value is written in a replace action. It is mandatory for replace actions. Regex capture groups are available.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"selector": {
|
||||
"description": "Selector to select Pod objects. Required.",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
|
||||
"items": {
|
||||
"description": "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
|
||||
"properties": {
|
||||
"key": {
|
||||
"description": "key is the label key that the selector applies to.",
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"description": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"key",
|
||||
"operator"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"matchLabels": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"selector"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,352 @@
|
||||
{
|
||||
"description": "VirtualMCPCompositeToolDefinition is the deprecated v1alpha1 version of the VirtualMCPCompositeToolDefinition resource.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "VirtualMCPCompositeToolDefinitionSpec defines the desired state of VirtualMCPCompositeToolDefinition.\nThis embeds the CompositeToolConfig from pkg/vmcp/config to share the configuration model\nbetween CLI and operator usage.",
|
||||
"properties": {
|
||||
"description": {
|
||||
"description": "Description describes what the workflow does.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the workflow name (unique identifier).",
|
||||
"type": "string"
|
||||
},
|
||||
"output": {
|
||||
"description": "Output defines the structured output schema for this workflow.\nIf not specified, the workflow returns the last step's output (backward compatible).",
|
||||
"properties": {
|
||||
"properties": {
|
||||
"additionalProperties": {
|
||||
"description": "OutputProperty defines a single output property.\nFor non-object types, Value is required.\nFor object types, either Value or Properties must be specified (but not both).",
|
||||
"properties": {
|
||||
"default": {
|
||||
"description": "Default is the fallback value if template expansion fails.\nType coercion is applied to match the declared Type.",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"description": {
|
||||
"description": "Description is a human-readable description exposed to clients and models",
|
||||
"type": "string"
|
||||
},
|
||||
"properties": {
|
||||
"description": "Properties defines nested properties for object types.\nEach nested property has full metadata (type, description, value/properties).",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"type": {
|
||||
"description": "Type is the JSON Schema type: \"string\", \"integer\", \"number\", \"boolean\", \"object\", \"array\"",
|
||||
"enum": [
|
||||
"string",
|
||||
"integer",
|
||||
"number",
|
||||
"boolean",
|
||||
"object",
|
||||
"array"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value is a template string for constructing the runtime value.\nFor object types, this can be a JSON string that will be deserialized.\nSupports template syntax: {{.steps.step_id.output.field}}, {{.params.param_name}}",
|
||||
"type": "string"
|
||||
},
|
||||
"additionalProperties": false
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": "Properties defines the output properties.\nMap key is the property name, value is the property definition.",
|
||||
"type": "object"
|
||||
},
|
||||
"required": {
|
||||
"description": "Required lists property names that must be present in the output.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"additionalProperties": false
|
||||
},
|
||||
"required": [
|
||||
"properties"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"parameters": {
|
||||
"description": "Parameters defines input parameter schema in JSON Schema format.\nShould be a JSON Schema object with \"type\": \"object\" and \"properties\".\nExample:\n {\n \"type\": \"object\",\n \"properties\": {\n \"param1\": {\"type\": \"string\", \"default\": \"value\"},\n \"param2\": {\"type\": \"integer\"}\n },\n \"required\": [\"param2\"]\n }\n\nWe use json.Map rather than a typed struct because JSON Schema is highly\nflexible with many optional fields (default, enum, minimum, maximum, pattern,\nitems, additionalProperties, oneOf, anyOf, allOf, etc.). Using json.Map\nallows full JSON Schema compatibility without needing to define every possible\nfield, and matches how the MCP SDK handles inputSchema.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"steps": {
|
||||
"description": "Steps are the workflow steps to execute.",
|
||||
"items": {
|
||||
"description": "WorkflowStepConfig defines a single workflow step.\nThis matches the proposal's step configuration (lines 180-255).",
|
||||
"properties": {
|
||||
"arguments": {
|
||||
"description": "Arguments is a map of argument values with template expansion support.\nSupports Go template syntax with .params and .steps for string values.\nNon-string values (integers, booleans, arrays, objects) are passed as-is.\nNote: the templating is only supported on the first level of the key-value pairs.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"collection": {
|
||||
"description": "Collection is a Go template expression that resolves to a JSON array or a slice.\nOnly used when Type is \"forEach\".",
|
||||
"type": "string"
|
||||
},
|
||||
"condition": {
|
||||
"description": "Condition is a template expression that determines if the step should execute",
|
||||
"type": "string"
|
||||
},
|
||||
"defaultResults": {
|
||||
"description": "DefaultResults provides fallback output values when this step is skipped\n(due to condition evaluating to false) or fails (when onError.action is \"continue\").\nEach key corresponds to an output field name referenced by downstream steps.\nRequired if the step may be skipped AND downstream steps reference this step's output.",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"dependsOn": {
|
||||
"description": "DependsOn lists step IDs that must complete before this step",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"id": {
|
||||
"description": "ID is the unique identifier for this step.",
|
||||
"type": "string"
|
||||
},
|
||||
"itemVar": {
|
||||
"description": "ItemVar is the variable name used to reference the current item in forEach templates.\nDefaults to \"item\" if not specified.\nOnly used when Type is \"forEach\".",
|
||||
"type": "string"
|
||||
},
|
||||
"maxIterations": {
|
||||
"description": "MaxIterations limits the number of items that can be iterated over.\nDefaults to 100, hard cap at 1000.\nOnly used when Type is \"forEach\".",
|
||||
"type": "integer"
|
||||
},
|
||||
"maxParallel": {
|
||||
"description": "MaxParallel limits the number of concurrent iterations in a forEach step.\nDefaults to the DAG executor's maxParallel (10).\nOnly used when Type is \"forEach\".",
|
||||
"type": "integer"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message is the elicitation message\nOnly used when Type is \"elicitation\"",
|
||||
"type": "string"
|
||||
},
|
||||
"onCancel": {
|
||||
"description": "OnCancel defines the action to take when the user cancels/dismisses the elicitation\nOnly used when Type is \"elicitation\"",
|
||||
"properties": {
|
||||
"action": {
|
||||
"default": "abort",
|
||||
"description": "Action defines the action to take when the user declines or cancels\n- skip_remaining: Skip remaining steps in the workflow\n- abort: Abort the entire workflow execution\n- continue: Continue to the next step",
|
||||
"enum": [
|
||||
"skip_remaining",
|
||||
"abort",
|
||||
"continue"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"onDecline": {
|
||||
"description": "OnDecline defines the action to take when the user explicitly declines the elicitation\nOnly used when Type is \"elicitation\"",
|
||||
"properties": {
|
||||
"action": {
|
||||
"default": "abort",
|
||||
"description": "Action defines the action to take when the user declines or cancels\n- skip_remaining: Skip remaining steps in the workflow\n- abort: Abort the entire workflow execution\n- continue: Continue to the next step",
|
||||
"enum": [
|
||||
"skip_remaining",
|
||||
"abort",
|
||||
"continue"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"onError": {
|
||||
"description": "OnError defines error handling behavior",
|
||||
"properties": {
|
||||
"action": {
|
||||
"default": "abort",
|
||||
"description": "Action defines the action to take on error",
|
||||
"enum": [
|
||||
"abort",
|
||||
"continue",
|
||||
"retry"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"retryCount": {
|
||||
"description": "RetryCount is the maximum number of retries\nOnly used when Action is \"retry\"",
|
||||
"type": "integer"
|
||||
},
|
||||
"retryDelay": {
|
||||
"description": "RetryDelay is the delay between retry attempts\nOnly used when Action is \"retry\"",
|
||||
"pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"schema": {
|
||||
"description": "Schema defines the expected response schema for elicitation",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"step": {
|
||||
"description": "InnerStep defines the step to execute for each item in the collection.\nOnly used when Type is \"forEach\". Only tool-type inner steps are supported.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"timeout": {
|
||||
"description": "Timeout is the maximum execution time for this step",
|
||||
"pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
|
||||
"type": "string"
|
||||
},
|
||||
"tool": {
|
||||
"description": "Tool is the tool to call (format: \"workload.tool_name\")\nOnly used when Type is \"tool\"",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"default": "tool",
|
||||
"description": "Type is the step type (tool, elicitation, etc.)",
|
||||
"enum": [
|
||||
"tool",
|
||||
"elicitation",
|
||||
"forEach"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"id"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"timeout": {
|
||||
"description": "Timeout is the maximum workflow execution time.",
|
||||
"pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"steps"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "VirtualMCPCompositeToolDefinitionStatus defines the observed state of VirtualMCPCompositeToolDefinition",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the workflow's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration is the most recent generation observed for this VirtualMCPCompositeToolDefinition\nIt corresponds to the resource's generation, which is updated on mutation by the API Server",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"referencingVirtualServers": {
|
||||
"description": "ReferencingVirtualServers lists VirtualMCPServer resources that reference this workflow\nThis helps track which servers need to be reconciled when this workflow changes",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "set"
|
||||
},
|
||||
"validationErrors": {
|
||||
"description": "ValidationErrors contains validation error messages if ValidationStatus is Invalid",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"validationStatus": {
|
||||
"description": "ValidationStatus indicates the validation state of the workflow\n- Valid: Workflow structure is valid\n- Invalid: Workflow has validation errors",
|
||||
"enum": [
|
||||
"Valid",
|
||||
"Invalid",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,352 @@
|
||||
{
|
||||
"description": "VirtualMCPCompositeToolDefinition is the Schema for the virtualmcpcompositetooldefinitions API\nVirtualMCPCompositeToolDefinition defines reusable composite workflows that can be referenced\nby multiple VirtualMCPServer instances",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "VirtualMCPCompositeToolDefinitionSpec defines the desired state of VirtualMCPCompositeToolDefinition.\nThis embeds the CompositeToolConfig from pkg/vmcp/config to share the configuration model\nbetween CLI and operator usage.",
|
||||
"properties": {
|
||||
"description": {
|
||||
"description": "Description describes what the workflow does.",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name is the workflow name (unique identifier).",
|
||||
"type": "string"
|
||||
},
|
||||
"output": {
|
||||
"description": "Output defines the structured output schema for this workflow.\nIf not specified, the workflow returns the last step's output (backward compatible).",
|
||||
"properties": {
|
||||
"properties": {
|
||||
"additionalProperties": {
|
||||
"description": "OutputProperty defines a single output property.\nFor non-object types, Value is required.\nFor object types, either Value or Properties must be specified (but not both).",
|
||||
"properties": {
|
||||
"default": {
|
||||
"description": "Default is the fallback value if template expansion fails.\nType coercion is applied to match the declared Type.",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"description": {
|
||||
"description": "Description is a human-readable description exposed to clients and models",
|
||||
"type": "string"
|
||||
},
|
||||
"properties": {
|
||||
"description": "Properties defines nested properties for object types.\nEach nested property has full metadata (type, description, value/properties).",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"type": {
|
||||
"description": "Type is the JSON Schema type: \"string\", \"integer\", \"number\", \"boolean\", \"object\", \"array\"",
|
||||
"enum": [
|
||||
"string",
|
||||
"integer",
|
||||
"number",
|
||||
"boolean",
|
||||
"object",
|
||||
"array"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value is a template string for constructing the runtime value.\nFor object types, this can be a JSON string that will be deserialized.\nSupports template syntax: {{.steps.step_id.output.field}}, {{.params.param_name}}",
|
||||
"type": "string"
|
||||
},
|
||||
"additionalProperties": false
|
||||
},
|
||||
"required": [
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"description": "Properties defines the output properties.\nMap key is the property name, value is the property definition.",
|
||||
"type": "object"
|
||||
},
|
||||
"required": {
|
||||
"description": "Required lists property names that must be present in the output.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"additionalProperties": false
|
||||
},
|
||||
"required": [
|
||||
"properties"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"parameters": {
|
||||
"description": "Parameters defines input parameter schema in JSON Schema format.\nShould be a JSON Schema object with \"type\": \"object\" and \"properties\".\nExample:\n {\n \"type\": \"object\",\n \"properties\": {\n \"param1\": {\"type\": \"string\", \"default\": \"value\"},\n \"param2\": {\"type\": \"integer\"}\n },\n \"required\": [\"param2\"]\n }\n\nWe use json.Map rather than a typed struct because JSON Schema is highly\nflexible with many optional fields (default, enum, minimum, maximum, pattern,\nitems, additionalProperties, oneOf, anyOf, allOf, etc.). Using json.Map\nallows full JSON Schema compatibility without needing to define every possible\nfield, and matches how the MCP SDK handles inputSchema.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"steps": {
|
||||
"description": "Steps are the workflow steps to execute.",
|
||||
"items": {
|
||||
"description": "WorkflowStepConfig defines a single workflow step.\nThis matches the proposal's step configuration (lines 180-255).",
|
||||
"properties": {
|
||||
"arguments": {
|
||||
"description": "Arguments is a map of argument values with template expansion support.\nSupports Go template syntax with .params and .steps for string values.\nNon-string values (integers, booleans, arrays, objects) are passed as-is.\nNote: the templating is only supported on the first level of the key-value pairs.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"collection": {
|
||||
"description": "Collection is a Go template expression that resolves to a JSON array or a slice.\nOnly used when Type is \"forEach\".",
|
||||
"type": "string"
|
||||
},
|
||||
"condition": {
|
||||
"description": "Condition is a template expression that determines if the step should execute",
|
||||
"type": "string"
|
||||
},
|
||||
"defaultResults": {
|
||||
"description": "DefaultResults provides fallback output values when this step is skipped\n(due to condition evaluating to false) or fails (when onError.action is \"continue\").\nEach key corresponds to an output field name referenced by downstream steps.\nRequired if the step may be skipped AND downstream steps reference this step's output.",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"dependsOn": {
|
||||
"description": "DependsOn lists step IDs that must complete before this step",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"id": {
|
||||
"description": "ID is the unique identifier for this step.",
|
||||
"type": "string"
|
||||
},
|
||||
"itemVar": {
|
||||
"description": "ItemVar is the variable name used to reference the current item in forEach templates.\nDefaults to \"item\" if not specified.\nOnly used when Type is \"forEach\".",
|
||||
"type": "string"
|
||||
},
|
||||
"maxIterations": {
|
||||
"description": "MaxIterations limits the number of items that can be iterated over.\nDefaults to 100, hard cap at 1000.\nOnly used when Type is \"forEach\".",
|
||||
"type": "integer"
|
||||
},
|
||||
"maxParallel": {
|
||||
"description": "MaxParallel limits the number of concurrent iterations in a forEach step.\nDefaults to the DAG executor's maxParallel (10).\nOnly used when Type is \"forEach\".",
|
||||
"type": "integer"
|
||||
},
|
||||
"message": {
|
||||
"description": "Message is the elicitation message\nOnly used when Type is \"elicitation\"",
|
||||
"type": "string"
|
||||
},
|
||||
"onCancel": {
|
||||
"description": "OnCancel defines the action to take when the user cancels/dismisses the elicitation\nOnly used when Type is \"elicitation\"",
|
||||
"properties": {
|
||||
"action": {
|
||||
"default": "abort",
|
||||
"description": "Action defines the action to take when the user declines or cancels\n- skip_remaining: Skip remaining steps in the workflow\n- abort: Abort the entire workflow execution\n- continue: Continue to the next step",
|
||||
"enum": [
|
||||
"skip_remaining",
|
||||
"abort",
|
||||
"continue"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"onDecline": {
|
||||
"description": "OnDecline defines the action to take when the user explicitly declines the elicitation\nOnly used when Type is \"elicitation\"",
|
||||
"properties": {
|
||||
"action": {
|
||||
"default": "abort",
|
||||
"description": "Action defines the action to take when the user declines or cancels\n- skip_remaining: Skip remaining steps in the workflow\n- abort: Abort the entire workflow execution\n- continue: Continue to the next step",
|
||||
"enum": [
|
||||
"skip_remaining",
|
||||
"abort",
|
||||
"continue"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"onError": {
|
||||
"description": "OnError defines error handling behavior",
|
||||
"properties": {
|
||||
"action": {
|
||||
"default": "abort",
|
||||
"description": "Action defines the action to take on error",
|
||||
"enum": [
|
||||
"abort",
|
||||
"continue",
|
||||
"retry"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"retryCount": {
|
||||
"description": "RetryCount is the maximum number of retries\nOnly used when Action is \"retry\"",
|
||||
"type": "integer"
|
||||
},
|
||||
"retryDelay": {
|
||||
"description": "RetryDelay is the delay between retry attempts\nOnly used when Action is \"retry\"",
|
||||
"pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"schema": {
|
||||
"description": "Schema defines the expected response schema for elicitation",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"step": {
|
||||
"description": "InnerStep defines the step to execute for each item in the collection.\nOnly used when Type is \"forEach\". Only tool-type inner steps are supported.",
|
||||
"type": "object",
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
},
|
||||
"timeout": {
|
||||
"description": "Timeout is the maximum execution time for this step",
|
||||
"pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
|
||||
"type": "string"
|
||||
},
|
||||
"tool": {
|
||||
"description": "Tool is the tool to call (format: \"workload.tool_name\")\nOnly used when Type is \"tool\"",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"default": "tool",
|
||||
"description": "Type is the step type (tool, elicitation, etc.)",
|
||||
"enum": [
|
||||
"tool",
|
||||
"elicitation",
|
||||
"forEach"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"id"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"timeout": {
|
||||
"description": "Timeout is the maximum workflow execution time.",
|
||||
"pattern": "^([0-9]+(\\.[0-9]+)?(ns|us|\u00b5s|ms|s|m|h))+$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"name",
|
||||
"steps"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "VirtualMCPCompositeToolDefinitionStatus defines the observed state of VirtualMCPCompositeToolDefinition",
|
||||
"properties": {
|
||||
"conditions": {
|
||||
"description": "Conditions represent the latest available observations of the workflow's state",
|
||||
"items": {
|
||||
"description": "Condition contains details for one aspect of the current state of this API Resource.",
|
||||
"properties": {
|
||||
"lastTransitionTime": {
|
||||
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"message": {
|
||||
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
|
||||
"maxLength": 32768,
|
||||
"type": "string"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
|
||||
"format": "int64",
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"reason": {
|
||||
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
|
||||
"maxLength": 1024,
|
||||
"minLength": 1,
|
||||
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
|
||||
"type": "string"
|
||||
},
|
||||
"status": {
|
||||
"description": "status of the condition, one of True, False, Unknown.",
|
||||
"enum": [
|
||||
"True",
|
||||
"False",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
|
||||
"maxLength": 316,
|
||||
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"lastTransitionTime",
|
||||
"message",
|
||||
"reason",
|
||||
"status",
|
||||
"type"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-map-keys": [
|
||||
"type"
|
||||
],
|
||||
"x-kubernetes-list-type": "map"
|
||||
},
|
||||
"observedGeneration": {
|
||||
"description": "ObservedGeneration is the most recent generation observed for this VirtualMCPCompositeToolDefinition\nIt corresponds to the resource's generation, which is updated on mutation by the API Server",
|
||||
"format": "int64",
|
||||
"type": "integer"
|
||||
},
|
||||
"referencingVirtualServers": {
|
||||
"description": "ReferencingVirtualServers lists VirtualMCPServer resources that reference this workflow\nThis helps track which servers need to be reconciled when this workflow changes",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "set"
|
||||
},
|
||||
"validationErrors": {
|
||||
"description": "ValidationErrors contains validation error messages if ValidationStatus is Invalid",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array",
|
||||
"x-kubernetes-list-type": "atomic"
|
||||
},
|
||||
"validationStatus": {
|
||||
"description": "ValidationStatus indicates the validation state of the workflow\n- Valid: Workflow structure is valid\n- Invalid: Workflow has validation errors",
|
||||
"enum": [
|
||||
"Valid",
|
||||
"Invalid",
|
||||
"Unknown"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user