[WIP] feat: integrate MCP Gateway, OpenShell, and Model as a Service into OpenShift Helm chart#307
Open
luis5tb wants to merge 6 commits into
Open
[WIP] feat: integrate MCP Gateway, OpenShell, and Model as a Service into OpenShift Helm chart#307luis5tb wants to merge 6 commits into
luis5tb wants to merge 6 commits into
Conversation
When mcpGateway.enabled is true: - MCP server runs as standalone Deployment+Service (not a sidecar) - HTTPRoute registers the MCP server with the Gateway API gateway - MCPServerRegistration CR registers it with Kuadrant MCP Gateway - Agent MCP_SERVER_URL points to the gateway /mcp endpoint - NetworkPolicy restricts MCP pod ingress to agent and gateway namespace - MCP sidecar and mcp-tmp volume are removed from the agent pod Requires: Red Hat Connectivity Link 1.3+, Gateway API CRDs, a pre-configured Gateway with MCPGatewayExtension. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When kagenti.enabled is true: - Agent Deployment labeled with kagenti.io/type, protocol.kagenti.io/a2a, and kagenti.io/framework for operator discovery - AgentRuntime CR (agent.kagenti.dev/v1alpha1) enrolls the agent for SPIFFE workload identity, OTEL tracing, and A2A discovery - OTEL config auto-overridden to point at Kagenti's collector - Kagenti operator injects sidecars (SPIFFE, Keycloak, Envoy) automatically Requires: Kagenti Operator v0.2.0+, SPIRE, Keycloak, Istio Ambient mesh. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When modelService.enabled is true: - LLM_PROVIDER set to litellm (OpenAI-compatible protocol) - LLM_MODEL and LLM_API_BASE point to the MaaS gateway endpoint - Direct Gemini/Vertex AI config remains but is not used Supports OpenShift AI MaaS, external LiteLLM proxy, or any OpenAI-compatible endpoint (vLLM, KServe InferenceService). Requires: OpenShift AI 3.4+ with MaaS enabled, or any external OpenAI-compatible model gateway. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…fig reference - Prerequisites table with required operators and minimum versions (Connectivity Link 1.3+, Kagenti v0.2.0+, OpenShift AI 3.4+) - Detailed usage sections for MCP Gateway, Kagenti, and Model as a Service with configuration examples and verification commands - Configuration reference tables for mcpGateway, kagenti, and modelService - Combined deployment example for enabling all three features - Updated MCP Sidecar section header to note MCP Gateway alternative Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When kagenti.enabled is true, OTEL tracing is auto-enabled but otel.metricsEnabled remains independent and defaults to false. Users wanting both must set both flags explicitly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove Kagenti agent identity and monitoring integration (AgentRuntime CR, SPIFFE labels, OTEL override) and replace with NVIDIA OpenShell sandboxed execution support. When openshell.enabled is true: - A SandboxTemplate CR (agents.x-k8s.io/v1beta1) is created for the OpenShell gateway to spawn sandboxed agent instances - The agent Deployment is labeled for OpenShell discovery - A NetworkPolicy allows ingress from the OpenShell gateway namespace - Sandbox pods use GCP service account credentials (not API key) MCP Gateway and Model as a Service integrations are unchanged. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
luis5tb
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the OpenShift Helm chart with three optional platform integrations,
all disabled by default for full backward compatibility:
mcpGateway.enabled) — Replaces the MCP sidecar with a standalone MCP server registeredbehind the Kuadrant MCP Gateway, enabling federated tool discovery, centralized auth, and per-tool metrics
openshell.enabled) — Registers the agent with NVIDIA's OpenShellsandboxed execution platform. Creates a
SandboxTemplateCR (agents.x-k8s.io/v1beta1) so the OpenShellgateway can spawn sandboxed agent instances with policy-enforced filesystem, network, process, and inference
constraints. Sandbox pods use GCP service account credentials for secure authentication.
modelService.enabled) — Points the agent at an external OpenShift AI MaaS endpoint(or any OpenAI-compatible gateway) instead of direct Gemini/Vertex AI access
Changes
MCP Gateway (
mcpGateway.enabled: true)OpenShell (
openshell.enabled: true)SandboxTemplateCR defines how sandboxed agent instances are provisionedopenshell.nvidia.com/sandbox-templatefor discoveryModel as a Service (
modelService.enabled: true)litellm, sets LLM_API_BASE and LLM_MODELDocumentation
Test plan
helm templatewith all features disabled — no new resources renderedhelm template --set openshell.enabled=true— SandboxTemplate, NetworkPolicy, labels presenthelm template --set mcpGateway.enabled=true— MCP standalone resources rendered, sidecar removedhelm template --set modelService.enabled=true— LLM_PROVIDER=litellm in ConfigMapgrep -ri kagenti deploy/openshift/returns zero matches🤖 Generated with Claude Code