Skip to content

Commit 5b7888d

Browse files
ppippi-devcrivetimihai
ppippi-dev
and
crivetimihai
authored
feat(helm): add ServiceAccount support to mcp-stack chart (#1718)
* feat(helm): add ServiceAccount support to mcp-stack chart Add optional ServiceAccount configuration for cloud IAM integration (AWS IRSA, GCP Workload Identity). Disabled by default to maintain backward compatibility. - Add serviceAccount section to values.yaml - Add serviceAccountName helper to _helpers.tpl - Create serviceaccount.yaml template - Attach serviceAccountName to all Deployments and Jobs - Add schema validation in values.schema.json Signed-off-by: ppippi-dev <wjdqlsdlsp@naver.com> * fix(helm): add missing serviceAccountName to pgbouncer deployment The original PR missed adding serviceAccountName to the pgbouncer deployment template. This adds it for consistency with all other deployments and jobs in the chart. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * docs(helm): add ServiceAccount documentation and regenerate README - Add CHANGELOG entry for ServiceAccount support feature - Add helm-docs comments to serviceAccount values for auto-generated docs - Document that automountServiceAccountToken only applies when create=true - Document that all pods share the same ServiceAccount - Regenerate README.md with helm-docs to include new values Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> --------- Signed-off-by: ppippi-dev <wjdqlsdlsp@naver.com> Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> Co-authored-by: Mihai Criveti <crivetimihai@gmail.com>
1 parent 54f75da commit 5b7888d

17 files changed

+109
-4
lines changed

‎charts/mcp-stack/CHANGELOG.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
1010

1111
### Added
1212

13+
#### **🔐 ServiceAccount Support** ([#1718](https://github.com/IBM/mcp-context-forge/pull/1718))
14+
* Optional ServiceAccount configuration for cloud IAM integration (AWS IRSA, GCP Workload Identity)
15+
* `serviceAccount.create` - Create a dedicated ServiceAccount for all pods (default: `false`)
16+
* `serviceAccount.name` - Custom ServiceAccount name (uses release fullname if empty)
17+
* `serviceAccount.annotations` - IAM role annotations for cloud provider integration
18+
* `serviceAccount.automountServiceAccountToken` - Control token mounting (default: `true`)
19+
* Applied to all Deployments and Jobs in the chart
20+
* Disabled by default to maintain backward compatibility
21+
1322
#### **🔧 Extra Environment Variables Support** ([#2047](https://github.com/IBM/mcp-context-forge/issues/2047))
1423
* `extraEnv` - Inject additional environment variables directly into the gateway container
1524
* `extraEnvFrom` - Mount environment variables from existing Secrets or ConfigMaps
1625
* Enables injection of sensitive credentials (SSO secrets, external DB URLs) without modifying templates
1726
* Placed after derived URLs so user values can override `DATABASE_URL`/`REDIS_URL` if needed
1827
* Schema validation catches common mistakes (missing `name`, invalid `secretKeyRef` shape)
1928

29+
### Fixed
30+
31+
* **PgBouncer ServiceAccount** ([#1718](https://github.com/IBM/mcp-context-forge/pull/1718)) - Added missing `serviceAccountName` to pgbouncer deployment for consistency with other components
32+
2033
### Changed
2134

2235
#### **⚡ Metrics Performance Defaults** ([#1799](https://github.com/IBM/mcp-context-forge/issues/1799))

‎charts/mcp-stack/README.md‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# mcp-stack
22

3-
![Version: 1.0.0-BETA-1](https://img.shields.io/badge/Version-1.0.0--BETA--1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0-BETA-1](https://img.shields.io/badge/AppVersion-1.0.0--BETA--1-informational?style=flat-square)
3+
![Version: 1.0.0-BETA-2](https://img.shields.io/badge/Version-1.0.0--BETA--2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0-BETA-2](https://img.shields.io/badge/AppVersion-1.0.0--BETA--2-informational?style=flat-square)
44

55
A full-stack Helm chart for IBM's **Model Context Protocol (MCP) Gateway
66
& Registry - Context-Forge**. It bundles:
@@ -314,8 +314,8 @@ Kubernetes: `>=1.21.0-0`
314314
| mcpContextForge.env.redis.port | int | `6379` | |
315315
| mcpContextForge.envFrom[0].secretRef.name | string | `"mcp-gateway-secret"` | |
316316
| mcpContextForge.envFrom[1].configMapRef.name | string | `"mcp-gateway-config"` | |
317-
| mcpContextForge.extraEnv | list | `[]` | Additional environment variables to inject directly |
318-
| mcpContextForge.extraEnvFrom | list | `[]` | Additional environment variables from secrets or configmaps |
317+
| mcpContextForge.extraEnv | list | `[]` | |
318+
| mcpContextForge.extraEnvFrom | list | `[]` | |
319319
| mcpContextForge.hpa | object | `{"enabled":true,"maxReplicas":10,"minReplicas":2,"targetCPUUtilizationPercentage":90,"targetMemoryUtilizationPercentage":90}` | ------------------------------------------------------------------ |
320320
| mcpContextForge.image.pullPolicy | string | `"Always"` | |
321321
| mcpContextForge.image.repository | string | `"ghcr.io/ibm/mcp-context-forge"` | |
@@ -608,6 +608,7 @@ Kubernetes: `>=1.21.0-0`
608608
| postgres.credentials.password | string | `"test123"` | |
609609
| postgres.credentials.user | string | `"admin"` | |
610610
| postgres.enabled | bool | `true` | |
611+
| postgres.existingSecret | string | `""` | |
611612
| postgres.external.database | string | `""` | |
612613
| postgres.external.databaseKey | string | `"dbname"` | |
613614
| postgres.external.enabled | bool | `false` | |
@@ -620,7 +621,6 @@ Kubernetes: `>=1.21.0-0`
620621
| postgres.external.portKey | string | `"port"` | |
621622
| postgres.external.user | string | `""` | |
622623
| postgres.external.userKey | string | `"user"` | |
623-
| postgres.existingSecret | string | `""` | |
624624
| postgres.image.pullPolicy | string | `"IfNotPresent"` | |
625625
| postgres.image.repository | string | `"postgres"` | |
626626
| postgres.image.tag | string | `"17"` | |
@@ -715,4 +715,8 @@ Kubernetes: `>=1.21.0-0`
715715
| redisCommander.resources.requests.memory | string | `"128Mi"` | |
716716
| redisCommander.service.port | int | `8081` | |
717717
| redisCommander.service.type | string | `"ClusterIP"` | |
718+
| serviceAccount.annotations | object | `{}` | Annotations for the ServiceAccount (e.g., AWS IRSA, GCP Workload Identity) |
719+
| serviceAccount.automountServiceAccountToken | bool | `true` | Mount the ServiceAccount token in pods. Only applies when create=true (existing ServiceAccounts control their own token mounting) |
720+
| serviceAccount.create | bool | `false` | Create a ServiceAccount for all pods in this release |
721+
| serviceAccount.name | string | `""` | ServiceAccount name. If empty and create=true, uses release fullname. If create=false, uses this name or "default" |
718722

‎charts/mcp-stack/templates/_helpers.tpl‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,20 @@ helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
2323
app.kubernetes.io/managed-by: {{ .Release.Service }}
2424
{{- end }}
2525

26+
{{- /* --------------------------------------------------------------------
27+
Helper: mcp-stack.serviceAccountName
28+
Returns the ServiceAccount name to use.
29+
If serviceAccount.create is true and name is empty, uses fullname.
30+
If serviceAccount.create is false, uses the provided name or "default".
31+
-------------------------------------------------------------------- */}}
32+
{{- define "mcp-stack.serviceAccountName" -}}
33+
{{- if .Values.serviceAccount.create }}
34+
{{- default (include "mcp-stack.fullname" .) .Values.serviceAccount.name }}
35+
{{- else }}
36+
{{- default "default" .Values.serviceAccount.name }}
37+
{{- end }}
38+
{{- end }}
39+
2640
{{- /* --------------------------------------------------------------------
2741
Helper: mcp-stack.postgresSecretName
2842
Returns the Secret name that the Postgres deployment should mount.

‎charts/mcp-stack/templates/deployment-mcp-fast-time-server.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ spec:
3030
- name: {{ . }}
3131
{{- end }}
3232
{{- end }}
33+
serviceAccountName: {{ include "mcp-stack.serviceAccountName" . }}
3334
containers:
3435
- name: mcp-fast-time-server
3536
image: "{{ .Values.mcpFastTimeServer.image.repository }}:{{ .Values.mcpFastTimeServer.image.tag }}"

‎charts/mcp-stack/templates/deployment-mcpgateway.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ spec:
3535
- name: {{ . }}
3636
{{- end }}
3737
{{- end }}
38+
serviceAccountName: {{ include "mcp-stack.serviceAccountName" . }}
3839
containers:
3940
- name: mcp-context-forge
4041
image: "{{ .Values.mcpContextForge.image.repository }}:{{ .Values.mcpContextForge.image.tag }}"

‎charts/mcp-stack/templates/deployment-pgadmin.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ spec:
2828
- name: {{ . }}
2929
{{- end }}
3030
{{- end }}
31+
serviceAccountName: {{ include "mcp-stack.serviceAccountName" . }}
3132
containers:
3233
- name: pgadmin
3334
image: "{{ .Values.pgadmin.image.repository }}:{{ .Values.pgadmin.image.tag }}"

‎charts/mcp-stack/templates/deployment-pgbouncer.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ spec:
3030
- name: {{ . }}
3131
{{- end }}
3232
{{- end }}
33+
serviceAccountName: {{ include "mcp-stack.serviceAccountName" . }}
3334
containers:
3435
- name: pgbouncer
3536
image: "{{ .Values.pgbouncer.image.repository }}:{{ .Values.pgbouncer.image.tag }}"

‎charts/mcp-stack/templates/deployment-postgres.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ spec:
4646
- name: {{ . }}
4747
{{- end }}
4848
{{- end }}
49+
serviceAccountName: {{ include "mcp-stack.serviceAccountName" . }}
4950
initContainers:
5051
{{- if and .Values.postgres.upgrade.enabled (eq $targetVersion "18") .Values.postgres.upgrade.backupCompleted }}
5152
# Init container to upgrade PostgreSQL data from version 17 to 18

‎charts/mcp-stack/templates/deployment-redis-commander.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ spec:
2828
- name: {{ . }}
2929
{{- end }}
3030
{{- end }}
31+
serviceAccountName: {{ include "mcp-stack.serviceAccountName" . }}
3132
containers:
3233
- name: redis-commander
3334
image: "{{ .Values.redisCommander.image.repository }}:{{ .Values.redisCommander.image.tag }}"

‎charts/mcp-stack/templates/deployment-redis.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ spec:
3131
- name: {{ . }}
3232
{{- end }}
3333
{{- end }}
34+
serviceAccountName: {{ include "mcp-stack.serviceAccountName" . }}
3435
containers:
3536
- name: redis
3637
image: "{{ .Values.redis.image.repository }}:{{ .Values.redis.image.tag }}"

0 commit comments

Comments
 (0)