Skip to content

feat(helm): support namespaced RBAC for MCP controller #127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
EItanya merged 8 commits into from
Mar 27, 2026
+3,923 −137
Merged

feat(helm): support namespaced RBAC for MCP controller #127

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
6b52326
rbac
supreme-gg-gg Mar 27, 2026
c72b9bf
attempt to improve e2e
supreme-gg-gg Mar 27, 2026
e3eeab5
attempt to improve e2e
supreme-gg-gg Mar 27, 2026
2317a1d
ci
supreme-gg-gg Mar 27, 2026
6f8fcc2
attempt to fix tests again
supreme-gg-gg Mar 27, 2026
492330a
Revert "attempt to fix tests again"
supreme-gg-gg Mar 27, 2026
c605751
fix
supreme-gg-gg Mar 27, 2026
c635268
fix ci finally?
supreme-gg-gg Mar 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions .github/workflows/test-e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,15 @@ jobs:

- name: Create k8s Kind Cluster
uses: helm/kind-action@v1
- name: Running Test e2e
with:
cluster_name: kind

- name: Build controller image
run: make docker-build CONTROLLER_IMG=ghcr.io/kagent-dev/kmcp/controller:e2e-test
timeout-minutes: 15

- name: Run e2e tests
run: |
kind create cluster
go mod tidy
make test-e2e
timeout-minutes: 20
4 changes: 2 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ HELM_REPO ?= oci://ghcr.io/kagent-dev

BUILD_DATE := $(shell date -u '+%Y-%m-%d')
GIT_COMMIT := $(shell git rev-parse --short HEAD || echo "unknown")
VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null | sed 's/-dirty//' | grep v || echo "v0.0.1+$(GIT_COMMIT)")
VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null | sed 's/-dirty//' | grep v || echo "v0.0.1-$(GIT_COMMIT)")


# Version information for the build
Expand Down Expand Up @@ -166,7 +166,7 @@ test-e2e: manifests generate fmt vet ## Run the e2e tests. Expected an isolated
echo "No Kind cluster is running. Please start a Kind cluster before running the e2e tests."; \
exit 1; \
}
go test ./test/e2e/ -v
go test ./test/e2e/ -v -timeout 30m

.PHONY: lint
lint: golangci-lint ## Run golangci-lint linter
Expand Down
2 changes: 1 addition & 1 deletion api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ rules:
- ""
resources:
- configmaps
- serviceaccounts
- services
verbs:
- create
Expand Down
3,350 changes: 3,309 additions & 41 deletions helm/kmcp-crds/templates/mcpserver-crd.yaml
View file
Open in desktop

Large diffs are not rendered by default.

4 changes: 4 additions & 0 deletions helm/kmcp/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,5 +83,9 @@ Create controller manager container args
{{- if .Values.controller.metrics.enabled }}
{{- $args = append $args (printf "--metrics-bind-address=%s" .Values.controller.metrics.bindAddress) }}
{{- end }}
{{- if not .Values.rbac.clusterScoped }}
{{- $namespaces := .Values.rbac.namespaces | default (list (include "kmcp.namespace" .)) }}
{{- $args = append $args (printf "--watch-namespaces=%s" (join "," $namespaces)) }}
{{- end }}
{{- toYaml $args }}
{{- end }}
37 changes: 29 additions & 8 deletions helm/kmcp/templates/rbac/clusterrole.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,4 @@
{{- if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "kmcp.fullname" . }}-manager-role
labels:
{{- include "kmcp.labels" . | nindent 4 }}
rules:
{{- define "kmcp.manager.rules" -}}
- apiGroups:
- ""
resources:
Expand Down Expand Up @@ -58,4 +51,32 @@ rules:
- get
- patch
- update
{{- end -}}

{{- if .Values.rbac.create }}

{{- if .Values.rbac.clusterScoped }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "kmcp.fullname" . }}-manager-role
labels:
{{- include "kmcp.labels" . | nindent 4 }}
rules:
{{- include "kmcp.manager.rules" . | nindent 2 }}
{{- else }}
{{- $namespaces := .Values.rbac.namespaces | default (list (include "kmcp.namespace" .)) }}
{{- range $namespace := $namespaces }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ include "kmcp.fullname" $ }}-manager-role
namespace: {{ $namespace }}
labels:
{{- include "kmcp.labels" $ | nindent 4 }}
rules:
{{- include "kmcp.manager.rules" $ | nindent 2 }}
{{- end }}
{{- end }}
{{- end }}
22 changes: 22 additions & 0 deletions helm/kmcp/templates/rbac/clusterrolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
{{- if .Values.rbac.create }}
{{- if .Values.rbac.clusterScoped }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
Expand All @@ -13,4 +14,25 @@ subjects:
- kind: ServiceAccount
name: {{ include "kmcp.serviceAccountName" . }}
namespace: {{ include "kmcp.namespace" . }}
{{- else }}
{{- $namespaces := .Values.rbac.namespaces | default (list (include "kmcp.namespace" .)) }}
{{- range $namespace := $namespaces }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "kmcp.fullname" $ }}-manager-rolebinding
namespace: {{ $namespace }}
labels:
{{- include "kmcp.labels" $ | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ include "kmcp.fullname" $ }}-manager-role
subjects:
- kind: ServiceAccount
name: {{ include "kmcp.serviceAccountName" $ }}
namespace: {{ include "kmcp.namespace" $ }}
{{- end }}
{{- end }}
{{- end }}
48 changes: 24 additions & 24 deletions helm/kmcp/tests/__snapshot__/deployment_test.yaml.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ should create deployment with default values:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kmcp
control-plane: controller-manager
helm.sh/chart: kmcp-0.1.0
helm.sh/chart: kmcp-1.0.0
name: RELEASE-NAME-controller-manager
namespace: NAMESPACE
spec:
Expand Down Expand Up @@ -73,7 +73,7 @@ should create deployment with default values:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
serviceAccountName: RELEASE-NAME-controller-manager
terminationGracePeriodSeconds: 10
volumes: []
should include health probe ports when health probe enabled:
Expand All @@ -86,7 +86,7 @@ should include health probe ports when health probe enabled:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kmcp
control-plane: controller-manager
helm.sh/chart: kmcp-0.1.0
helm.sh/chart: kmcp-1.0.0
name: RELEASE-NAME-controller-manager
namespace: NAMESPACE
spec:
Expand Down Expand Up @@ -151,7 +151,7 @@ should include health probe ports when health probe enabled:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
serviceAccountName: RELEASE-NAME-controller-manager
terminationGracePeriodSeconds: 10
volumes: []
should include image pull secrets when specified:
Expand All @@ -164,7 +164,7 @@ should include image pull secrets when specified:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kmcp
control-plane: controller-manager
helm.sh/chart: kmcp-0.1.0
helm.sh/chart: kmcp-1.0.0
name: RELEASE-NAME-controller-manager
namespace: NAMESPACE
spec:
Expand Down Expand Up @@ -231,7 +231,7 @@ should include image pull secrets when specified:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
serviceAccountName: RELEASE-NAME-controller-manager
terminationGracePeriodSeconds: 10
volumes: []
should include metrics port when metrics enabled:
Expand All @@ -244,7 +244,7 @@ should include metrics port when metrics enabled:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kmcp
control-plane: controller-manager
helm.sh/chart: kmcp-0.1.0
helm.sh/chart: kmcp-1.0.0
name: RELEASE-NAME-controller-manager
namespace: NAMESPACE
spec:
Expand Down Expand Up @@ -309,7 +309,7 @@ should include metrics port when metrics enabled:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
serviceAccountName: RELEASE-NAME-controller-manager
terminationGracePeriodSeconds: 10
volumes: []
should include node selector when specified:
Expand All @@ -322,7 +322,7 @@ should include node selector when specified:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kmcp
control-plane: controller-manager
helm.sh/chart: kmcp-0.1.0
helm.sh/chart: kmcp-1.0.0
name: RELEASE-NAME-controller-manager
namespace: NAMESPACE
spec:
Expand Down Expand Up @@ -389,7 +389,7 @@ should include node selector when specified:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
serviceAccountName: RELEASE-NAME-controller-manager
terminationGracePeriodSeconds: 10
volumes: []
should include pod annotations when specified:
Expand All @@ -402,7 +402,7 @@ should include pod annotations when specified:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kmcp
control-plane: controller-manager
helm.sh/chart: kmcp-0.1.0
helm.sh/chart: kmcp-1.0.0
name: RELEASE-NAME-controller-manager
namespace: NAMESPACE
spec:
Expand Down Expand Up @@ -469,7 +469,7 @@ should include pod annotations when specified:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
serviceAccountName: RELEASE-NAME-controller-manager
terminationGracePeriodSeconds: 10
volumes: []
should include tolerations when specified:
Expand All @@ -482,7 +482,7 @@ should include tolerations when specified:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kmcp
control-plane: controller-manager
helm.sh/chart: kmcp-0.1.0
helm.sh/chart: kmcp-1.0.0
name: RELEASE-NAME-controller-manager
namespace: NAMESPACE
spec:
Expand Down Expand Up @@ -547,7 +547,7 @@ should include tolerations when specified:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
serviceAccountName: RELEASE-NAME-controller-manager
terminationGracePeriodSeconds: 10
tolerations:
- effect: NoSchedule
Expand All @@ -565,7 +565,7 @@ should set custom replica count:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kmcp
control-plane: controller-manager
helm.sh/chart: kmcp-0.1.0
helm.sh/chart: kmcp-1.0.0
name: RELEASE-NAME-controller-manager
namespace: NAMESPACE
spec:
Expand Down Expand Up @@ -630,7 +630,7 @@ should set custom replica count:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
serviceAccountName: RELEASE-NAME-controller-manager
terminationGracePeriodSeconds: 10
volumes: []
should set custom resources:
Expand All @@ -643,7 +643,7 @@ should set custom resources:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kmcp
control-plane: controller-manager
helm.sh/chart: kmcp-0.1.0
helm.sh/chart: kmcp-1.0.0
name: RELEASE-NAME-controller-manager
namespace: NAMESPACE
spec:
Expand Down Expand Up @@ -708,7 +708,7 @@ should set custom resources:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
serviceAccountName: RELEASE-NAME-controller-manager
terminationGracePeriodSeconds: 10
volumes: []
should set pod security context:
Expand All @@ -721,7 +721,7 @@ should set pod security context:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kmcp
control-plane: controller-manager
helm.sh/chart: kmcp-0.1.0
helm.sh/chart: kmcp-1.0.0
name: RELEASE-NAME-controller-manager
namespace: NAMESPACE
spec:
Expand Down Expand Up @@ -786,7 +786,7 @@ should set pod security context:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
serviceAccountName: RELEASE-NAME-controller-manager
terminationGracePeriodSeconds: 10
volumes: []
should set security context:
Expand All @@ -799,7 +799,7 @@ should set security context:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kmcp
control-plane: controller-manager
helm.sh/chart: kmcp-0.1.0
helm.sh/chart: kmcp-1.0.0
name: RELEASE-NAME-controller-manager
namespace: NAMESPACE
spec:
Expand Down Expand Up @@ -864,7 +864,7 @@ should set security context:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
serviceAccountName: RELEASE-NAME-controller-manager
terminationGracePeriodSeconds: 10
volumes: []
should set termination grace period:
Expand All @@ -877,7 +877,7 @@ should set termination grace period:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: kmcp
control-plane: controller-manager
helm.sh/chart: kmcp-0.1.0
helm.sh/chart: kmcp-1.0.0
name: RELEASE-NAME-controller-manager
namespace: NAMESPACE
spec:
Expand Down Expand Up @@ -942,6 +942,6 @@ should set termination grace period:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
serviceAccountName: RELEASE-NAME-controller-manager
terminationGracePeriodSeconds: 10
volumes: []
Loading
Loading