Documentation
¶
Overview ¶
Package mcpserver reconciles MCPServer objects. MCPServer is a built-in, core-hosted "provider": the CRD is distributed to tenant workspaces via the core.railgrid.ai APIExport/APIBinding, and this reconciler — running in-process in the hub against the core.railgrid.ai multicluster manager — provisions each server's long-lived identity (ServiceAccount + token Secret + RBAC) and publishes its endpoint URL + token reference on status. The aggregate MCP serving itself lives in pkg/hub/mcpaggregate.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func SetupWithManager ¶
func SetupWithManager(mgr mcmanager.Manager, kcpConfig *rest.Config, hubExternalURL string, enumerate ProviderEnumerator, registry *providers.Registry) error
SetupWithManager registers the MCPServer controller with the core.railgrid.ai multicluster manager. kcpConfig is the hub's admin config, used to build a direct per-tenant client for identity provisioning (the token controller populates legacy token Secrets written through a direct client, which the APIExport virtual-workspace client does not guarantee). enumerate lists the Ready MCP-exposing providers each server discovers its tools from. registry is the shared source of validated provider declarations.
Types ¶
type BoundResource ¶ added in v0.2.9
type BoundResource struct {
apisv1alpha2.BoundAPIResource
APIExportPath string
APIExportName string
}
BoundResource carries the identity of the APIExport a tenant bound along with the bound resource. The APIBinding's status alone has only group/resource/schema identity; its export reference is needed to match a provider declaration without crossing an export boundary.
type ProviderEnumerator ¶
type ProviderEnumerator = mcpaggregate.ProviderEnumerator
ProviderEnumerator returns the Ready, MCP-exposing providers visible to a caller. Wired from the hub's provider registry — the same enumerator the aggregate endpoint federates with (mcpaggregate.RegistryEnumerator).
type Reconciler ¶
type Reconciler struct {
// contains filtered or unexported fields
}
Reconciler provisions each MCPServer's identity and publishes its status.
func (*Reconciler) Reconcile ¶
func (r *Reconciler) Reconcile(ctx context.Context, req mcreconcile.Request) (ctrl.Result, error)
Reconcile provisions the server's identity and writes status. Provisioned objects are owned by the MCPServer, so they are garbage-collected when it is deleted. Until kcp's token controller populates the token Secret, the server stays Provisioning and the reconcile requeues.
type SubresourceGrant ¶ added in v0.2.9
type SubresourceGrant struct {
Group string
Resource string
Name string
ReadOnly bool
// AllowPrivilegedWrite is set only for coordinates in the existing
// server-owned data-plane allowlist. Those deliberate capabilities remain
// available on writable MCPServers even when the parent resource itself is
// read-only to ordinary actions.
AllowPrivilegedWrite bool
APIExportPath string
APIExportName string
}
SubresourceGrant is one provider-declared action or custom verb, expressed as the RBAC coordinate a provider checks before invoking it: the provider-sdk/dataplane subresource verbs on <Resource>/<Name> in Group. ExportPath and ExportName identify the APIExport whose declaration owns the coordinate, so a different export serving the same group/resource cannot inherit it accidentally.
Source Files