{ "description": "MCPRemoteProxy is the deprecated v1alpha1 version of the MCPRemoteProxy resource.", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "MCPRemoteProxySpec defines the desired state of MCPRemoteProxy", "properties": { "allowPrivateEndpoint": { "default": false, "description": "AllowPrivateEndpoint permits RemoteURL to point at a private or\nin-cluster endpoint: RFC 1918 and IPv6 unique-local addresses, and\nhostnames ending in \"cluster.local\". (Bare \".svc\" hostnames are never\nblocked, since no DNS resolution is performed.) Enable this to reach a\nco-located in-cluster backend in-mesh so the backend's workload-identity\nauthorization policy still applies. Loopback, link-local, cloud-metadata,\nand kubernetes.default endpoints remain blocked regardless of this\nsetting.", "type": "boolean" }, "audit": { "description": "Audit defines audit logging configuration for the proxy", "properties": { "enabled": { "default": false, "description": "Enabled controls whether audit logging is enabled\nWhen true, enables audit logging with default configuration", "type": "boolean" } }, "type": "object", "additionalProperties": false }, "authServerRef": { "description": "AuthServerRef optionally references a resource that configures an embedded\nOAuth 2.0/OIDC authorization server to authenticate MCP clients.\nCurrently the only supported kind is MCPExternalAuthConfig (type: embeddedAuthServer).", "properties": { "kind": { "default": "MCPExternalAuthConfig", "description": "Kind identifies the type of the referenced resource.", "enum": [ "MCPExternalAuthConfig" ], "type": "string" }, "name": { "description": "Name is the name of the referenced resource in the same namespace.", "minLength": 1, "type": "string" } }, "required": [ "kind", "name" ], "type": "object", "additionalProperties": false }, "authzConfig": { "description": "AuthzConfig defines authorization policy configuration for the proxy.\nAuthzConfig and AuthzConfigRef are mutually exclusive.", "properties": { "configMap": { "description": "ConfigMap references a ConfigMap containing authorization configuration\nOnly used when Type is \"configMap\"", "properties": { "key": { "default": "authz.json", "description": "Key is the key in the ConfigMap that contains the authorization configuration", "type": "string" }, "name": { "description": "Name is the name of the ConfigMap", "type": "string" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "groupClaimName": { "description": "GroupClaimName is the JWT claim key that contains group membership for the\nprincipal. When set, takes priority over the well-known defaults\n(\"groups\", \"roles\", \"cognito:groups\"). Use this for IDPs that place\ngroups under a URI-style claim (e.g. \"https://example.com/groups\"). When\nType is \"configMap\", a group_claim_name entry in the referenced ConfigMap\nis overridden by this field if both are set.", "maxLength": 253, "type": "string" }, "groupEntityType": { "description": "GroupEntityType is the Cedar entity type name used for principal parent\nUIDs synthesised from JWT group/role claims. Defaults to \"THVGroup\" when\nempty. Must match the entity type used in the static entity store for\ntransitive `in` checks (e.g. `ClaimGroup \u2192 PlatformRole`) to resolve.\nNamespaced names (`Foo::Bar`) are not yet supported. When Type is\n\"configMap\", a group_entity_type entry in the referenced ConfigMap is\noverridden by this field if both are set.", "maxLength": 63, "pattern": "^[A-Za-z_][A-Za-z0-9_]*$", "type": "string" }, "inline": { "description": "Inline contains direct authorization configuration\nOnly used when Type is \"inline\"", "properties": { "entitiesJson": { "default": "[]", "description": "EntitiesJSON is a JSON string representing Cedar entities. Required when\ntransitive policies (e.g. `ClaimGroup \u2192 PlatformRole`) need a static\nentity store; defaults to \"[]\".", "type": "string" }, "policies": { "description": "Policies is a list of Cedar policy strings", "items": { "type": "string" }, "minItems": 1, "type": "array", "x-kubernetes-list-type": "atomic" }, "primaryUpstreamProvider": { "description": "PrimaryUpstreamProvider names the upstream IDP whose access token's\nclaims Cedar should evaluate.\n\nDeprecated: on VirtualMCPServer this field has moved to\nspec.authServerConfig.primaryUpstreamProvider. The old location is\nstill read for one release for backward compatibility; the\nVirtualMCPServer controller emits an AuthzPrimaryUpstreamProviderDeprecated\nWarning event whenever it is consumed, and removal is planned for the\nrelease after the deprecation cycle.\n\nOn MCPServer and MCPRemoteProxy this field has always been a structural\nno-op (those CRDs do not run an embedded auth server). Setting it\ncontinues to surface the AuthzPrimaryUpstreamProviderIgnored advisory\ncondition; the deprecation does not change that behaviour.", "maxLength": 63, "minLength": 1, "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$", "type": "string" } }, "required": [ "policies" ], "type": "object", "additionalProperties": false }, "roleClaimName": { "description": "RoleClaimName is the JWT claim key that contains role membership for the\nprincipal. When set, the claim is extracted separately from GroupClaimName\nand both are mapped to the configured GroupEntityType. When Type is\n\"configMap\", a role_claim_name entry in the referenced ConfigMap is\noverridden by this field if both are set.", "maxLength": 253, "type": "string" }, "type": { "default": "configMap", "description": "Type is the type of authorization configuration", "enum": [ "configMap", "inline" ], "type": "string" } }, "required": [ "type" ], "type": "object", "x-kubernetes-validations": [ { "message": "configMap must be set when type is 'configMap', and must not be set otherwise", "rule": "self.type == 'configMap' ? has(self.configMap) : !has(self.configMap)" }, { "message": "inline must be set when type is 'inline', and must not be set otherwise", "rule": "self.type == 'inline' ? has(self.inline) : !has(self.inline)" } ], "additionalProperties": false }, "authzConfigRef": { "description": "AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.\nThe referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy.\nMutually exclusive with authzConfig.", "properties": { "name": { "description": "Name is the name of the MCPAuthzConfig resource in the same namespace.", "minLength": 1, "type": "string" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "endpointPrefix": { "description": "EndpointPrefix is the path prefix to prepend to SSE endpoint URLs.\nThis is used to handle path-based ingress routing scenarios where the ingress\nstrips a path prefix before forwarding to the backend.", "type": "string" }, "externalAuthConfigRef": { "description": "ExternalAuthConfigRef references a MCPExternalAuthConfig resource for token exchange.\nWhen specified, the proxy will exchange validated incoming tokens for remote service tokens.\nThe referenced MCPExternalAuthConfig must exist in the same namespace as this MCPRemoteProxy.", "properties": { "name": { "description": "Name is the name of the MCPExternalAuthConfig resource", "type": "string" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "groupRef": { "description": "GroupRef references the MCPGroup this proxy belongs to.\nThe referenced MCPGroup must be in the same namespace.", "properties": { "name": { "description": "Name is the name of the MCPGroup resource in the same namespace", "minLength": 1, "type": "string" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "headerForward": { "description": "HeaderForward configures headers to inject into requests to the remote MCP server.\nUse this to add custom headers like X-Tenant-ID or correlation IDs.", "properties": { "addHeadersFromSecret": { "description": "AddHeadersFromSecret references Kubernetes Secrets for sensitive header values.", "items": { "description": "HeaderFromSecret defines a header whose value comes from a Kubernetes Secret.", "properties": { "headerName": { "description": "HeaderName is the HTTP header name (e.g., \"X-API-Key\")", "maxLength": 255, "minLength": 1, "type": "string" }, "valueSecretRef": { "description": "ValueSecretRef references the Secret and key containing the header value", "properties": { "key": { "description": "Key is the key within the secret", "type": "string" }, "name": { "description": "Name is the name of the secret", "type": "string" } }, "required": [ "key", "name" ], "type": "object", "additionalProperties": false } }, "required": [ "headerName", "valueSecretRef" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-map-keys": [ "headerName" ], "x-kubernetes-list-type": "map" }, "addPlaintextHeaders": { "additionalProperties": { "type": "string" }, "description": "AddPlaintextHeaders is a map of header names to literal values to inject into requests.\nWARNING: Values are stored in plaintext and visible via kubectl commands.\nUse addHeadersFromSecret for sensitive data like API keys or tokens.", "type": "object" } }, "type": "object", "additionalProperties": false }, "oidcConfigRef": { "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.\n\nSECURITY: if this field is omitted and no other authentication source is configured,\nthe proxy runs UNAUTHENTICATED. It accepts every request that can reach its port and\nforwards it to the remote MCP server under a synthetic local-user identity, with no\ntoken or credential check. Set this field to enforce identity-based access control\nper request.", "properties": { "audience": { "description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.", "minLength": 1, "type": "string" }, "name": { "description": "Name is the name of the MCPOIDCConfig resource", "minLength": 1, "type": "string" }, "resourceUrl": { "description": "ResourceURL is the public URL for OAuth protected resource metadata (RFC 9728).\nWhen the server is exposed via Ingress or gateway, set this to the external\nURL that MCP clients connect to. If not specified, defaults to the internal\nKubernetes service URL.", "type": "string" }, "scopes": { "description": "Scopes is the list of OAuth scopes to advertise in the well-known endpoint (RFC 9728).\nIf empty, defaults to [\"openid\"].", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "audience", "name" ], "type": "object", "additionalProperties": false }, "podTemplateSpec": { "description": "PodTemplateSpec defines the pod template to use for the MCPRemoteProxy\nThis allows for customizing the pod configuration beyond what is provided by the other fields.\nNote that to modify the specific container the remote proxy runs in, you must specify\nthe `toolhive` container name in the PodTemplateSpec.\nThis field accepts a PodTemplateSpec object as JSON/YAML.", "type": "object", "x-kubernetes-preserve-unknown-fields": true }, "proxyPort": { "default": 8080, "description": "ProxyPort is the port to expose the MCP proxy on", "format": "int32", "maximum": 65535, "minimum": 1, "type": "integer" }, "remoteUrl": { "description": "RemoteURL is the URL of the remote MCP server to proxy", "pattern": "^https?://", "type": "string" }, "replicas": { "description": "Replicas is the desired number of proxy pod replicas.\nMCPRemoteProxy creates a single Deployment for the proxy process, so there\nis only one replicas field (mirrors VirtualMCPServer.spec.replicas).\nWhen nil, the operator does not set Deployment.Spec.Replicas, leaving replica\nmanagement to an HPA or other external controller.\nWhen set above 1, also configure sessionStorage with the redis provider and\nsessionAffinity: \"None\" so sessions resolve across replicas; otherwise a\nSessionStorageWarning condition is surfaced on the resource status.", "format": "int32", "minimum": 0, "type": "integer" }, "resourceOverrides": { "description": "ResourceOverrides allows overriding annotations and labels for resources created by the operator", "properties": { "proxyDeployment": { "description": "ProxyDeployment defines overrides for the Proxy Deployment resource (toolhive proxy)", "properties": { "affinity": { "description": "Affinity sets node/pod affinity and anti-affinity for the proxy pod.\nOn MCPRemoteProxy, spec.podTemplateSpec also reaches the proxy pod: the two\nare merged per sub-field, and podTemplateSpec wins on sub-fields set in both.", "properties": { "nodeAffinity": { "description": "Describes node affinity scheduling rules for the pod.", "properties": { "preferredDuringSchedulingIgnoredDuringExecution": { "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node matches the corresponding matchExpressions; the\nnode(s) with the highest sum are the most preferred.", "items": { "description": "An empty preferred scheduling term matches all objects with implicit weight 0\n(i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).", "properties": { "preference": { "description": "A node selector term, associated with the corresponding weight.", "properties": { "matchExpressions": { "description": "A list of node selector requirements by node's labels.", "items": { "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", "properties": { "key": { "description": "The label key that the selector applies to.", "type": "string" }, "operator": { "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", "type": "string" }, "values": { "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "matchFields": { "description": "A list of node selector requirements by node's fields.", "items": { "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", "properties": { "key": { "description": "The label key that the selector applies to.", "type": "string" }, "operator": { "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", "type": "string" }, "values": { "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "type": "object", "x-kubernetes-map-type": "atomic", "additionalProperties": false }, "weight": { "description": "Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.", "format": "int32", "type": "integer" } }, "required": [ "preference", "weight" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "requiredDuringSchedulingIgnoredDuringExecution": { "description": "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to an update), the system\nmay or may not try to eventually evict the pod from its node.", "properties": { "nodeSelectorTerms": { "description": "Required. A list of node selector terms. The terms are ORed.", "items": { "description": "A null or empty node selector term matches no objects. The requirements of\nthem are ANDed.\nThe TopologySelectorTerm type implements a subset of the NodeSelectorTerm.", "properties": { "matchExpressions": { "description": "A list of node selector requirements by node's labels.", "items": { "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", "properties": { "key": { "description": "The label key that the selector applies to.", "type": "string" }, "operator": { "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", "type": "string" }, "values": { "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "matchFields": { "description": "A list of node selector requirements by node's fields.", "items": { "description": "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", "properties": { "key": { "description": "The label key that the selector applies to.", "type": "string" }, "operator": { "description": "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", "type": "string" }, "values": { "description": "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "type": "object", "x-kubernetes-map-type": "atomic", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "nodeSelectorTerms" ], "type": "object", "x-kubernetes-map-type": "atomic", "additionalProperties": false } }, "type": "object", "additionalProperties": false }, "podAffinity": { "description": "Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).", "properties": { "preferredDuringSchedulingIgnoredDuringExecution": { "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", "items": { "description": "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", "properties": { "podAffinityTerm": { "description": "Required. A pod affinity term, associated with the corresponding weight.", "properties": { "labelSelector": { "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", "properties": { "matchExpressions": { "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", "items": { "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", "properties": { "key": { "description": "key is the label key that the selector applies to.", "type": "string" }, "operator": { "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", "type": "string" }, "values": { "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", "type": "object" } }, "type": "object", "x-kubernetes-map-type": "atomic", "additionalProperties": false }, "matchLabelKeys": { "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" }, "mismatchLabelKeys": { "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" }, "namespaceSelector": { "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", "properties": { "matchExpressions": { "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", "items": { "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", "properties": { "key": { "description": "key is the label key that the selector applies to.", "type": "string" }, "operator": { "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", "type": "string" }, "values": { "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", "type": "object" } }, "type": "object", "x-kubernetes-map-type": "atomic", "additionalProperties": false }, "namespaces": { "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" }, "topologyKey": { "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", "type": "string" } }, "required": [ "topologyKey" ], "type": "object", "additionalProperties": false }, "weight": { "description": "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", "format": "int32", "type": "integer" } }, "required": [ "podAffinityTerm", "weight" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "requiredDuringSchedulingIgnoredDuringExecution": { "description": "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", "items": { "description": "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", "properties": { "labelSelector": { "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", "properties": { "matchExpressions": { "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", "items": { "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", "properties": { "key": { "description": "key is the label key that the selector applies to.", "type": "string" }, "operator": { "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", "type": "string" }, "values": { "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", "type": "object" } }, "type": "object", "x-kubernetes-map-type": "atomic", "additionalProperties": false }, "matchLabelKeys": { "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" }, "mismatchLabelKeys": { "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" }, "namespaceSelector": { "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", "properties": { "matchExpressions": { "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", "items": { "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", "properties": { "key": { "description": "key is the label key that the selector applies to.", "type": "string" }, "operator": { "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", "type": "string" }, "values": { "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", "type": "object" } }, "type": "object", "x-kubernetes-map-type": "atomic", "additionalProperties": false }, "namespaces": { "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" }, "topologyKey": { "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", "type": "string" } }, "required": [ "topologyKey" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "type": "object", "additionalProperties": false }, "podAntiAffinity": { "description": "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", "properties": { "preferredDuringSchedulingIgnoredDuringExecution": { "description": "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", "items": { "description": "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", "properties": { "podAffinityTerm": { "description": "Required. A pod affinity term, associated with the corresponding weight.", "properties": { "labelSelector": { "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", "properties": { "matchExpressions": { "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", "items": { "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", "properties": { "key": { "description": "key is the label key that the selector applies to.", "type": "string" }, "operator": { "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", "type": "string" }, "values": { "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", "type": "object" } }, "type": "object", "x-kubernetes-map-type": "atomic", "additionalProperties": false }, "matchLabelKeys": { "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" }, "mismatchLabelKeys": { "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" }, "namespaceSelector": { "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", "properties": { "matchExpressions": { "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", "items": { "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", "properties": { "key": { "description": "key is the label key that the selector applies to.", "type": "string" }, "operator": { "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", "type": "string" }, "values": { "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", "type": "object" } }, "type": "object", "x-kubernetes-map-type": "atomic", "additionalProperties": false }, "namespaces": { "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" }, "topologyKey": { "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", "type": "string" } }, "required": [ "topologyKey" ], "type": "object", "additionalProperties": false }, "weight": { "description": "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", "format": "int32", "type": "integer" } }, "required": [ "podAffinityTerm", "weight" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "requiredDuringSchedulingIgnoredDuringExecution": { "description": "If the anti-affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the anti-affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", "items": { "description": "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", "properties": { "labelSelector": { "description": "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", "properties": { "matchExpressions": { "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", "items": { "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", "properties": { "key": { "description": "key is the label key that the selector applies to.", "type": "string" }, "operator": { "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", "type": "string" }, "values": { "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", "type": "object" } }, "type": "object", "x-kubernetes-map-type": "atomic", "additionalProperties": false }, "matchLabelKeys": { "description": "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" }, "mismatchLabelKeys": { "description": "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" }, "namespaceSelector": { "description": "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", "properties": { "matchExpressions": { "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", "items": { "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", "properties": { "key": { "description": "key is the label key that the selector applies to.", "type": "string" }, "operator": { "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", "type": "string" }, "values": { "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "required": [ "key", "operator" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", "type": "object" } }, "type": "object", "x-kubernetes-map-type": "atomic", "additionalProperties": false }, "namespaces": { "description": "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "atomic" }, "topologyKey": { "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", "type": "string" } }, "required": [ "topologyKey" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "type": "object", "additionalProperties": false } }, "type": "object", "additionalProperties": false }, "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations to add or override on the resource", "type": "object" }, "env": { "description": "Env are environment variables to set in the proxy container (thv run process)\nThese affect the toolhive proxy itself, not the MCP server it manages\nUse TOOLHIVE_DEBUG=true to enable debug logging in the proxy", "items": { "description": "EnvVar represents an environment variable in a container", "properties": { "name": { "description": "Name of the environment variable", "type": "string" }, "value": { "description": "Value of the environment variable", "type": "string" } }, "required": [ "name", "value" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-map-keys": [ "name" ], "x-kubernetes-list-type": "map" }, "imagePullSecrets": { "description": "ImagePullSecrets allows specifying image pull secrets for the proxy runner\nThese are applied to both the Deployment and the ServiceAccount", "items": { "description": "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", "properties": { "name": { "default": "", "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", "type": "string" } }, "type": "object", "x-kubernetes-map-type": "atomic", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels to add or override on the resource", "type": "object" }, "nodeSelector": { "additionalProperties": { "type": "string" }, "description": "NodeSelector constrains the proxy pod to nodes with matching labels.\nMirrors the scheduling control podTemplateSpec gives the MCP server pod, so\nthe proxy can be steered onto the same nodes (e.g. a pre-warmed pool).\nOn MCPRemoteProxy, spec.podTemplateSpec also reaches the proxy pod: the two\nmaps are merged, and podTemplateSpec wins on keys set in both.", "type": "object" }, "podTemplateMetadataOverrides": { "description": "ResourceMetadataOverrides defines metadata overrides for a resource", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations to add or override on the resource", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels to add or override on the resource", "type": "object" } }, "type": "object", "additionalProperties": false }, "tolerations": { "description": "Tolerations allow the proxy pod to schedule onto tainted nodes, such as a\ndedicated pre-warmed pool.\nOn MCPRemoteProxy, spec.podTemplateSpec also reaches the proxy pod, and this\nlist is atomic: a podTemplateSpec that sets tolerations replaces this field\nrather than adding to it.", "items": { "description": "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", "properties": { "effect": { "description": "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", "type": "string" }, "key": { "description": "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", "type": "string" }, "operator": { "description": "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", "type": "string" }, "tolerationSeconds": { "description": "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", "format": "int64", "type": "integer" }, "value": { "description": "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", "type": "string" } }, "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-type": "atomic" } }, "type": "object", "additionalProperties": false }, "proxyService": { "description": "ProxyService defines overrides for the Proxy Service resource (points to the proxy deployment)", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations to add or override on the resource", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels to add or override on the resource", "type": "object" } }, "type": "object", "additionalProperties": false } }, "type": "object", "additionalProperties": false }, "resources": { "description": "Resources defines the resource requirements for the proxy container", "properties": { "limits": { "description": "Limits describes the maximum amount of compute resources allowed", "properties": { "cpu": { "description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)", "type": "string" }, "memory": { "description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)", "type": "string" } }, "type": "object", "additionalProperties": false }, "requests": { "description": "Requests describes the minimum amount of compute resources required", "properties": { "cpu": { "description": "CPU is the CPU limit in cores (e.g., \"500m\" for 0.5 cores)", "type": "string" }, "memory": { "description": "Memory is the memory limit in bytes (e.g., \"64Mi\" for 64 megabytes)", "type": "string" } }, "type": "object", "additionalProperties": false } }, "type": "object", "additionalProperties": false }, "serviceAccount": { "description": "ServiceAccount is the name of an already existing service account to use by the proxy.\nIf not specified, a ServiceAccount will be created automatically and used by the proxy.", "type": "string" }, "sessionAffinity": { "default": "ClientIP", "description": "SessionAffinity controls whether the Service routes repeated client connections to the same pod.\nMCP protocols (SSE, streamable-http) are stateful, so ClientIP is the default.\nSet to \"None\" for stateless servers or when using an external load balancer with its own affinity.\n\nInteraction with sessionStorage: when running multiple replicas with\nsessionStorage.provider \"redis\", set this to \"None\" so requests are\ndistributed across replicas and sessions resolve via the shared store.\nConversely, \"None\" without Redis-backed sessionStorage breaks session\ncontinuity \u2014 any request landing on a different pod fails with\n\"Session not found\".", "enum": [ "ClientIP", "None" ], "type": "string" }, "sessionStorage": { "description": "SessionStorage configures session storage for stateful horizontal scaling.\nWhen nil, no session storage is configured and the proxy falls back to\npod-local in-memory session state \u2014 incompatible with multi-replica\ndeployments behind load balancers that don't preserve client-IP affinity\n(e.g. AWS ALB across multiple AZs).\n\nThe transparent proxy validates `Mcp-Session-Id` against this store on\nevery non-initialize request (see pkg/transport/proxy/transparent/\ntransparent_proxy.go) and rewrites client-facing session IDs to backend\nsession IDs using session metadata. Both lookups require shared state\nacross replicas.\n\nWhen using the Redis provider, also set sessionAffinity to \"None\" so the\nService routes requests round-robin and all replicas rely on the shared\nsession store rather than pod-local state.\n\nMirrors MCPServer.spec.sessionStorage and VirtualMCPServer.spec.sessionStorage.", "properties": { "address": { "description": "Address is the Redis server address (required when provider is redis)", "minLength": 1, "type": "string" }, "db": { "default": 0, "description": "DB is the Redis database number", "format": "int32", "minimum": 0, "type": "integer" }, "keyPrefix": { "description": "KeyPrefix is an optional prefix for all Redis keys used by ToolHive", "type": "string" }, "passwordRef": { "description": "PasswordRef is a reference to a Secret key containing the Redis password", "properties": { "key": { "description": "Key is the key within the secret", "type": "string" }, "name": { "description": "Name is the name of the secret", "type": "string" } }, "required": [ "key", "name" ], "type": "object", "additionalProperties": false }, "provider": { "description": "Provider is the session storage backend type", "enum": [ "memory", "redis" ], "type": "string" } }, "required": [ "provider" ], "type": "object", "x-kubernetes-validations": [ { "message": "address is required", "rule": "self.provider == 'redis' ? has(self.address) : true" } ], "additionalProperties": false }, "telemetryConfigRef": { "description": "TelemetryConfigRef references an MCPTelemetryConfig resource for shared telemetry configuration.\nThe referenced MCPTelemetryConfig must exist in the same namespace as this MCPRemoteProxy.\nCross-namespace references are not supported for security and isolation reasons.", "properties": { "name": { "description": "Name is the name of the MCPTelemetryConfig resource", "minLength": 1, "type": "string" }, "serviceName": { "description": "ServiceName overrides the telemetry service name for this specific server.\nThis MUST be unique per server for proper observability (e.g., distinguishing\ntraces and metrics from different servers sharing the same collector).\nIf empty, defaults to the server name with \"thv-\" prefix at runtime.", "type": "string" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "toolConfigRef": { "description": "ToolConfigRef references a MCPToolConfig resource for tool filtering and renaming.\nThe referenced MCPToolConfig must exist in the same namespace as this MCPRemoteProxy.\nCross-namespace references are not supported for security and isolation reasons.\nIf specified, this allows filtering and overriding tools from the remote MCP server.", "properties": { "name": { "description": "Name is the name of the MCPToolConfig resource in the same namespace", "type": "string" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "transport": { "default": "streamable-http", "description": "Transport is the transport method for the remote proxy (sse or streamable-http)", "enum": [ "sse", "streamable-http" ], "type": "string" }, "trustProxyHeaders": { "default": false, "description": "TrustProxyHeaders indicates whether to trust X-Forwarded-* headers from reverse proxies\nWhen enabled, the proxy will use X-Forwarded-Proto, X-Forwarded-Host, X-Forwarded-Port,\nand X-Forwarded-Prefix headers to construct endpoint URLs", "type": "boolean" } }, "required": [ "remoteUrl" ], "type": "object", "x-kubernetes-validations": [ { "message": "authzConfig and authzConfigRef are mutually exclusive; use authzConfigRef to reference a shared MCPAuthzConfig", "rule": "!(has(self.authzConfig) && has(self.authzConfigRef))" } ], "additionalProperties": false }, "status": { "description": "MCPRemoteProxyStatus defines the observed state of MCPRemoteProxy", "properties": { "authServerConfigHash": { "description": "AuthServerConfigHash is the hash of the referenced authServerRef spec,\nused to detect configuration changes and trigger reconciliation.", "type": "string" }, "authzConfigHash": { "description": "AuthzConfigHash is the hash of the referenced MCPAuthzConfig spec for change detection", "type": "string" }, "conditions": { "description": "Conditions represent the latest available observations of the MCPRemoteProxy's state", "items": { "description": "Condition contains details for one aspect of the current state of this API Resource.", "properties": { "lastTransitionTime": { "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", "format": "date-time", "type": "string" }, "message": { "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", "maxLength": 32768, "type": "string" }, "observedGeneration": { "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "minimum": 0, "type": "integer" }, "reason": { "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", "maxLength": 1024, "minLength": 1, "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", "type": "string" }, "status": { "description": "status of the condition, one of True, False, Unknown.", "enum": [ "True", "False", "Unknown" ], "type": "string" }, "type": { "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", "maxLength": 316, "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", "type": "string" } }, "required": [ "lastTransitionTime", "message", "reason", "status", "type" ], "type": "object", "additionalProperties": false }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "externalAuthConfigHash": { "description": "ExternalAuthConfigHash is the hash of the referenced MCPExternalAuthConfig spec", "type": "string" }, "externalUrl": { "description": "ExternalURL is the external URL where the proxy can be accessed (if exposed externally)", "type": "string" }, "message": { "description": "Message provides additional information about the current phase", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration reflects the generation of the most recently observed MCPRemoteProxy", "format": "int64", "type": "integer" }, "oidcConfigHash": { "description": "OIDCConfigHash is the hash of the referenced MCPOIDCConfig spec for change detection", "type": "string" }, "phase": { "description": "Phase is the current phase of the MCPRemoteProxy", "enum": [ "Pending", "Ready", "Failed", "Terminating" ], "type": "string" }, "telemetryConfigHash": { "description": "TelemetryConfigHash stores the hash of the referenced MCPTelemetryConfig for change detection", "type": "string" }, "toolConfigHash": { "description": "ToolConfigHash stores the hash of the referenced ToolConfig for change detection", "type": "string" }, "url": { "description": "URL is the internal cluster URL where the proxy can be accessed", "type": "string" } }, "type": "object", "additionalProperties": false } }, "type": "object" }