-
Notifications
You must be signed in to change notification settings - Fork 2
Commit d7d9365
Add MCPRemoteProxy documentation for Kubernetes operator (#267)
* Add MCPRemoteProxy documentation for Kubernetes operator
This commit adds comprehensive documentation for the MCPRemoteProxy CRD,
which enables proxying remote MCP servers in Kubernetes with authentication,
authorization, audit logging, and tool filtering capabilities.
Key features documented:
- Overview and use cases for enterprise SaaS MCP servers
- Basic configuration with OIDC authentication
- Multiple authentication methods (inline OIDC, ConfigMap, Kubernetes SA)
- Authorization policies using Cedar policy language
- Tool filtering and renaming with MCPToolConfig
- Token exchange for federated authentication
- Quick start example for testing
- Exposing proxies externally with Ingress
- Telemetry and observability (audit logs, Prometheus, OpenTelemetry)
- Comprehensive troubleshooting guide
The documentation follows the project's style guide and includes:
- Realistic enterprise examples (avoiding GitHub since it doesn't support OIDC)
- Practical troubleshooting based on real deployment scenarios
- Correct Kubernetes label selectors verified against actual cluster resources
- Cross-references to related documentation
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Address PR review feedback
Fixes identified by copilot-pull-request-reviewer:
1. Clarified that principal attributes are examples from JWT tokens,
with actual attributes depending on IDP configuration
2. Fixed capitalization: "User ID" instead of "user ID"
3. Improved JWT decoding command to handle base64url encoding and
missing padding, with explanatory note
4. Fixed Cedar policy action names throughout:
- Action::"tools/list" → Action::"list_tools"
- Action::"tools/call" → Action::"call_tool"
5. Changed token exchange scope from string to array:
- scope: 'analytics:read analytics:write'
- scopes: ['analytics:read', 'analytics:write']
6. Updated Prometheus metric names to match actual implementation:
- toolhive_mcp_requests_total
- toolhive_mcp_request_duration_seconds
- toolhive_mcp_tool_calls_total
- toolhive_mcp_active_connections
7. Fixed audit log JSON structure to match actual format:
- Moved auditId to metadata.auditId
- Moved duration_ms and transport to metadata.extra
- Changed target.tool to target.name
- Added required fields: loggedAt, source, component
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>1 parent b6852f2 commit d7d9365Copy full SHA for d7d9365
File tree
Expand file treeCollapse file tree
2 files changed
+809
-0
lines changedOpen diff view settings
Filter options
- docs/toolhive/guides-k8s
Expand file treeCollapse file tree
2 files changed
+809
-0
lines changedOpen diff view settings
0 commit comments