registry

2026-06-02 20:59:26 +01:00
parent fb5c4ab51f
commit b4820326db
9 changed files with 109 additions and 3 deletions
@@ -3,6 +3,11 @@ kind: VirtualMCPServer
 metadata:
  name: dev-safe-vmcp
  namespace: toolhive-system
+  annotations:
+    toolhive.stacklok.dev/registry-export: "true"
+    toolhive.stacklok.dev/registry-title: Dev Safe Virtual MCP
+    toolhive.stacklok.dev/registry-description: Development-focused virtual MCP combining safe Gitea and AutoMem tools.
+    toolhive.stacklok.dev/registry-url: http://vmcp-dev-safe-vmcp.toolhive-system.svc.cluster.local:4483
 spec:
  groupRef:
    name: homelab-core
@@ -25,4 +30,4 @@ spec:
        - workload: kubernetes-mcp
          excludeAll: true
    optimizer:
-      maxToolsToReturn: 5
+      maxToolsToReturn: 5
@@ -3,6 +3,11 @@ kind: VirtualMCPServer
 metadata:
  name: full-vmcp
  namespace: toolhive-system
+  annotations:
+    toolhive.stacklok.dev/registry-export: "true"
+    toolhive.stacklok.dev/registry-title: Full Homelab Virtual MCP
+    toolhive.stacklok.dev/registry-description: Full virtual MCP exposing the homelab MCP tool group through ToolHive aggregation.
+    toolhive.stacklok.dev/registry-url: http://vmcp-full-vmcp.toolhive-system.svc.cluster.local:4483
 spec:
  groupRef:
    name: homelab-core
@@ -14,4 +19,4 @@ spec:
    aggregation:
      conflictResolution: prefix
    optimizer:
-      maxToolsToReturn: 8
+      maxToolsToReturn: 8
@@ -0,0 +1,73 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: k8s-registry-api-discovery
+rules:
+  - apiGroups:
+      - toolhive.stacklok.dev
+    resources:
+      - mcpservers
+      - mcpremoteproxies
+      - virtualmcpservers
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - gateway.networking.k8s.io
+    resources:
+      - httproutes
+      - gateways
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: k8s-registry-api-discovery
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: k8s-registry-api-discovery
+subjects:
+  - kind: ServiceAccount
+    name: k8s-registry-registry-api
+    namespace: toolhive-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: k8s-registry-api-events
+  namespace: toolhive-system
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: k8s-registry-api-events
+  namespace: toolhive-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: k8s-registry-api-events
+subjects:
+  - kind: ServiceAccount
+    name: k8s-registry-registry-api
+    namespace: toolhive-system
@@ -24,5 +24,6 @@ resources:
  - ops-safe-vmcp.yaml
  - ops-safe-vmcp-ingress.yaml
  - k8s-registry.yaml
+  - k8s-registry-rbac.yaml
  - toolhive-registry-backup.yaml
  - toolhive-registry-postgres.yaml
@@ -3,6 +3,11 @@ kind: MCPServer
 metadata:
  name: argocd-mcp
  namespace: toolhive-system
+  annotations:
+    toolhive.stacklok.dev/registry-export: "true"
+    toolhive.stacklok.dev/registry-title: Argo CD MCP
+    toolhive.stacklok.dev/registry-description: Read-only Argo CD MCP server for inspecting homelab GitOps applications and resources.
+    toolhive.stacklok.dev/registry-url: http://mcp-argocd-mcp-proxy.toolhive-system.svc.cluster.local:8080/mcp
 spec:
  # argoproj-labs MCP server for Argo CD. v0.7.0 starts streamable HTTP on
  # port 3000 by default; setting args: ["stdio"] makes the image try to run
@@ -3,6 +3,11 @@ kind: MCPServer
 metadata:
  name: gitea-mcp
  namespace: toolhive-system
+  annotations:
+    toolhive.stacklok.dev/registry-export: "true"
+    toolhive.stacklok.dev/registry-title: Gitea MCP
+    toolhive.stacklok.dev/registry-description: Gitea MCP server for repository, issue, and pull request workflows in the homelab Gitea instance.
+    toolhive.stacklok.dev/registry-url: http://mcp-gitea-mcp-proxy.toolhive-system.svc.cluster.local:8080/mcp
 spec:
  # Upstream Gitea MCP server. Speaks stdio; ToolHive's proxy runner wraps it and
  # exposes streamable-http at http://mcp-gitea-mcp-proxy.mcp-services:8080/mcp.
@@ -3,6 +3,11 @@ kind: MCPServer
 metadata:
  name: kubernetes-mcp
  namespace: toolhive-system
+  annotations:
+    toolhive.stacklok.dev/registry-export: "true"
+    toolhive.stacklok.dev/registry-title: Kubernetes MCP
+    toolhive.stacklok.dev/registry-description: Read-only Kubernetes MCP server for safe cluster inspection and troubleshooting.
+    toolhive.stacklok.dev/registry-url: http://mcp-kubernetes-mcp-proxy.toolhive-system.svc.cluster.local:8080/mcp
 spec:
  # containers/kubernetes-mcp-server. Authenticates to the API in-cluster via the
  # kubernetes-mcp ServiceAccount (read-only ClusterRole, see rbac file). Speaks
@@ -3,6 +3,11 @@ kind: VirtualMCPServer
 metadata:
  name: ops-safe-vmcp
  namespace: toolhive-system
+  annotations:
+    toolhive.stacklok.dev/registry-export: "true"
+    toolhive.stacklok.dev/registry-title: Ops Safe Virtual MCP
+    toolhive.stacklok.dev/registry-description: Operations-focused virtual MCP combining safe Argo CD and Kubernetes tools.
+    toolhive.stacklok.dev/registry-url: http://vmcp-ops-safe-vmcp.toolhive-system.svc.cluster.local:4483
 spec:
  groupRef:
    name: homelab-core
@@ -25,4 +30,4 @@ spec:
          toolConfigRef:
            name: ops-tools
    optimizer:
-      maxToolsToReturn: 6
+      maxToolsToReturn: 6
@@ -22,6 +22,8 @@ spec:
    initdb:
      database: toolhive-reg-pg
      owner: toolhive-registry
+      postInitSQL:
+        - CREATE ROLE toolhive_registry_server;
  postgresql:
    parameters:
      max_connections: "200"