- Python 87%
- Rust 9.2%
- JavaScript 2%
- Dockerfile 0.6%
- Go Template 0.4%
- Other 0.8%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
6f0af8b1cc* fix: issue #8 — adminRoute inherit/path, merged RHM, upgrade notes adminRoute without gatewayRef no longer crashes reconcile: hostname and parent Gateway inherit from publicRoute, mapping errors become InvalidSpec. Same-host /admin is a first-class path (default /admin). Strip and hop inject merge into one RequestHeaderModifier; Authentik identity headers are kept when hop inject is on because HTTPRoute filters run after kgateway extAuth. Document CRD/image skew and observedGeneration. Co-authored-by: netromnik <hewimetall@users.noreply.github.com> * feat: ListenerPolicy early strip + vmcp 1.3.0 gcf/G25 Apply a same-namespace kgateway ListenerPolicy earlyRequestHeaderModifier when stripClientIdentityHeaders is on, matching vmcp ADR 0001 (strip before extAuth). Cross-namespace parent Gateways skip attach and set status.listenerPolicy=SkippedCrossNamespace so login stays intact. Project vmcp 1.3.0: spec.gql.gcf / spec.proxy.gcf, document G25 upstream: catalog scopes in groupScopes, recommend image 1.3.0. Co-authored-by: netromnik <hewimetall@users.noreply.github.com> * fix: read hop Secret via kr8s Secret object Live KWOK run showed adminHopHeaderInjected stayed false: api.get() is an async generator in kr8s 0.20, so the loader swallowed TypeError. Load with Secret.exists/refresh like the other cluster adapters. Co-authored-by: netromnik <hewimetall@users.noreply.github.com> * feat: CRD skew status, operator /healthz, extraRoutes Detect live VmcpGateway CRD vs this image (status.crdSkew / CRDsReady). Wire Kopf liveness on :8081 with kubelet probes. Add spec.extraRoutes for path HTTPRoutes (/mcp, /health, /api/v1) on the public hostname. Co-authored-by: netromnik <hewimetall@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: netromnik <hewimetall@users.noreply.github.com> |
||
| .github/workflows | ||
| charts/vmcp-operator | ||
| crates | ||
| deploy | ||
| docs | ||
| python/vmcp_operator | ||
| scripts | ||
| tests | ||
| .dockerignore | ||
| .gitignore | ||
| .python-version | ||
| Cargo.lock | ||
| Cargo.toml | ||
| Dockerfile | ||
| Makefile | ||
| pyproject.toml | ||
| README.md | ||
| uv.lock | ||
vmcp-operator
Kubernetes operator for managing multiple isolated vmcp gateway instances.
One singleton operator watches an explicit namespace allowlist and reconciles
independent {namespace}/{VmcpGateway} stacks (Deployment, Service, PVC,
atomic artifact ConfigMap, credentials, public/admin HTTPRoutes) plus attached
VmcpMcpServer upstreams (ContainerImage or RemoteHttp).
Stack
- Python 3.15 free-threaded controller (
PYTHON_LAZY_IMPORTS=normal) - Pure Rust
vmcp-op-core+ thin PyO3vmcp-op-pyo3(abi3t-py315) - Helm chart installs CRDs/RBAC/operator/dashboard only (never vmcp workloads)
- Vendored Grid.js 6.2.0 + Tabler 1.4.0 dashboard assets
- TDD gates: Python ≥98%, Rust core ≥93%
Layout
charts/vmcp-operator/ Helm install surface
python/vmcp_operator/ HEX controller + dashboard static
crates/ vmcp-op-core, vmcp-op-pyo3
deploy/samples/ example CRs
deploy/profiles/ resurche / code / other bundles
scripts/ compatibility spike helpers
docs/ gate notes
Quick checks
uv sync --extra dev
uv run maturin develop
make test-py test-rs helm-lint
Release image (GHCR)
Same release workflow shape as hewimetall/vmcp:
# Tag push → build Dockerfile target `runtime` → ghcr.io/hewimetall/vmcp_operator:<semver>
git tag v0.1.0
git push origin v0.1.0
GHCR packages for this repo are not anonymously pullable — crane ls /
docker pull without credentials returns DENIED (not “not found”). Authenticate
first:
echo "$GHCR_TOKEN" | docker login ghcr.io -u USERNAME --password-stdin
# cluster: imagePullSecrets for ghcr.io/hewimetall/vmcp_operator
Local build:
docker build --target runtime -t ghcr.io/hewimetall/vmcp_operator:local .
Chart default image: ghcr.io/hewimetall/vmcp_operator.
uv.lock pins cryptography>=50 (via [tool.uv] override-dependencies) so
free-threaded CPython 3.15t image builds do not need UV_OVERRIDE.
Phase −1 compatibility results: docs/phase-minus-one.md.
Gateway contract (vmcp ≥1.3 recommended: G25 catalog + optional GCF;
≥1.2 AuthFacade / hop trust / forward_identity):
docs/compatibility.md.
Operator control plane above vmcp (MCP add/remove/update + NL CRUD,
peer Gateways via VmcpProxy / vmcp-proxy):
docs/control-plane.md.
C4 delta for issue #4 (status / finalizers / ownership) — import into
architect-c4 workspace ws-vmcp-operator:
docs/architecture-issue4.md.
0.0.2 adoption (adminRoute same-host path, CRD/image skew, observedGeneration): docs/issue-8-adoption.md.