From b2aed7c42c78b7cbecff58df346c8022e4da10a7 Mon Sep 17 00:00:00 2001 From: nick-gorse Date: Sun, 31 May 2026 19:34:19 +0100 Subject: [PATCH] add groupRef --- manifest/overlays/production/mcpserver-argocd.yaml | 2 ++ manifest/overlays/production/mcpserver-gitea.yaml | 2 ++ manifest/overlays/production/mcpserver-kubernetes.yaml | 2 ++ 3 files changed, 6 insertions(+) diff --git a/manifest/overlays/production/mcpserver-argocd.yaml b/manifest/overlays/production/mcpserver-argocd.yaml index c0df3d1..7025845 100644 --- a/manifest/overlays/production/mcpserver-argocd.yaml +++ b/manifest/overlays/production/mcpserver-argocd.yaml @@ -26,6 +26,8 @@ spec: # the token natively on the `mcp` container via podTemplateSpec. podTemplateSpec: spec: + groupRef: + name: homelab-core containers: - name: mcp env: diff --git a/manifest/overlays/production/mcpserver-gitea.yaml b/manifest/overlays/production/mcpserver-gitea.yaml index 6263d1f..7487279 100644 --- a/manifest/overlays/production/mcpserver-gitea.yaml +++ b/manifest/overlays/production/mcpserver-gitea.yaml @@ -19,6 +19,8 @@ spec: # inject the token natively on the `mcp` container via podTemplateSpec. podTemplateSpec: spec: + groupRef: + name: homelab-core containers: - name: mcp env: diff --git a/manifest/overlays/production/mcpserver-kubernetes.yaml b/manifest/overlays/production/mcpserver-kubernetes.yaml index 8fd2364..a1d6045 100644 --- a/manifest/overlays/production/mcpserver-kubernetes.yaml +++ b/manifest/overlays/production/mcpserver-kubernetes.yaml @@ -12,6 +12,8 @@ spec: transport: stdio proxyMode: streamable-http proxyPort: 8080 + groupRef: + name: homelab-core # Pin the MCP server pod to our read-only ServiceAccount. The ClusterRole is # the real guardrail: even if a write tool is invoked, the API rejects it. serviceAccount: kubernetes-mcp