feat: add Helm chart scaffolding and core templates by Venkatesh1505 · Pull Request #155 · kubernetes-sigs/mcp-lifecycle-operator

Venkatesh1505 · 2026-05-06T14:06:38Z

What this PR does

Adds an initial Helm chart under dist/chart/ that produces the same resources as the current kustomize deployment with default values.

Closes #132

Resources included

CRD (crds/mcp.x-k8s.io_mcpservers.yaml) — copied from config/crd/bases/
ServiceAccount — conditional via serviceAccount.create
RBAC — manager ClusterRole/Binding, leader-election Role/Binding, metrics-auth ClusterRole/Binding, metrics-reader ClusterRole (conditional via
rbac.create)
Deployment — controller manager with hardened security context
Metrics Service — port 8443

Configurability (values.yaml)

All values are documented with # -- comments. Key options:

Value	Default	Description
`image.repository`	`mcp-lifecycle-operator`	Image repo
`image.tag`	`""` (uses appVersion)	Image tag
`replicas`	`1`	Replica count
`serviceAccount.create`	`true`	Create SA
`rbac.create`	`true`	Create RBAC resources
`nodeSelector`	`{}`	Node selector
`tolerations`	`[]`	Tolerations
`affinity`	`{}`	Affinity rules

Validation

helm lint — passes
helm template — all 10 resources render correctly
helm install on Kind cluster — pod 1/1 Running, controller healthy
helm install --dry-run — passes

Follow-ups (separate issues)

Helm chart optional resource templates #133 — Optional templates (ServiceMonitor, NetworkPolicy)
CI for Helm chart #134 — CI workflow for helm lint/template/install + CRD sync check
Helm installation documentation #135 — Chart README and documentation
Publish Helm chart to ArtifactHub #136 — ArtifactHub publishing

netlify · 2026-05-06T14:06:45Z

✅ Deploy Preview for mcp-lifecycle-operator ready!

Name	Link
🔨 Latest commit	`a7ee27e`
🔍 Latest deploy log	https://app.netlify.com/projects/mcp-lifecycle-operator/deploys/6a1fd0d96954ce000892b323
😎 Deploy Preview	https://deploy-preview-155--mcp-lifecycle-operator.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

k8s-ci-robot · 2026-05-06T14:06:50Z

Hi @Venkatesh1505. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Venkatesh1505 · 2026-05-06T14:11:39Z

@aliok Sending it for your review. TIA

Copilot

Copilot wasn't able to review any files in this pull request.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

aliok

Thanks @Venkatesh1505 !

I had a quick look and have some comments. I want to take a 2nd look later, possibly after comments are addressed.

aliok · 2026-05-07T11:40:52Z

What would happen if we put the CRD under dist/chart/crds rather then dist/chart/templates?

I understand that keeping it upper level would mean no automatic CRD upgrades with helm install but when one does helm uninstall, CRD and thus all the instances are kept.

If we put it under templates, we would have automatic CRD upgrade but introduce this deletion risk.

I don't have that much Helm experience TBH.

cc @ibm-adarsh @Cali0707 @matzew @koksay (Helm expert)?

@aliok looking here it seems like the two best ways to handle CRDs in a PR is:

In crds

In a separate CRD only chart

Helm does not automatically update CRDs during a helm update when they live in the crds directory.

If you expect frequent CRD updates, I suggest moving them to a separate chart. Otherwise, for a couple of updates a year, you can include in the upgrade doc that users update them manually.

e.g.: https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/UPGRADE.md

IMO we should move the CRDs to a separate chart then. Thoughts @aliok ?

We're gonna have frequent updates, as the project is new. So, let's do a separate chart for that.

cc @Venkatesh1505

Done in f13ce27 — moved the CRD to a separate dist/chart-crds/ chart (mcp-lifecycle-operator-crds).

The CRD is now a regular template in the new chart, so helm upgrade will update it automatically. The main chart's crds/ directory has been removed, and NOTES.txt updated to mention installing the CRD chart first.

Tested on a kind cluster:

helm install mcp-lifecycle-operator-crds dist/chart-crds/ — CRD created

helm upgrade mcp-lifecycle-operator-crds dist/chart-crds/ — CRD updated (revision 2)

helm install mcp-lifecycle-operator dist/chart/ — pod 1/1 Running, all RBAC resources created

helm uninstall — both charts cleaned up

Cali0707 · 2026-05-07T19:17:00Z

@aliok looking here it seems like the two best ways to handle CRDs in a PR is:

In crds

In a separate CRD only chart

aliok · 2026-05-14T09:40:46Z

/ok-to-test

k8s-ci-robot · 2026-06-02T10:27:00Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Venkatesh1505
Once this PR has been reviewed and has the lgtm label, please assign soltysh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot

Copilot wasn't able to review any files in this pull request.

Copilot

Copilot wasn't able to review any files in this pull request.

creydr

Left two comments.
But I am also wondering if there is a way to keep the chart manifests in sync with what we have actually in config/, so dist would only be the result of some kustomize patches for example 🤔

creydr · 2026-06-02T13:02:04Z

This file seems to be out of sync with the CRD in config/crd/bases/mcp.x-k8s.io_mcpservers.yaml.
It seems to miss

extraAnnotations field

extraLabels field

mcp section under spec

Can we make sure those are updated as part of make manifests too?

I want to tackle that sync with #134

FWIW: in #207 we added a Makefile target which checks if the generated files & manifests are up-to-date. This also runs then in a workflow.

creydr · 2026-06-02T13:03:46Z

In #204, we added get and list permissions on pods. This seems to be missing here

This is done now

Add initial Helm chart under dist/chart/ with core templates that produce the same resources as the kustomize deployment: - Chart.yaml, values.yaml, .helmignore - CRD (crds/mcp.x-k8s.io_mcpservers.yaml) - ServiceAccount (conditional via serviceAccount.create) - RBAC: manager ClusterRole/Binding, leader-election Role/Binding, metrics-auth ClusterRole/Binding, metrics-reader ClusterRole (conditional via rbac.create) - Controller manager Deployment with configurable image, resources, nodeSelector, tolerations, affinity, podAnnotations, podLabels - Metrics Service (port 8443) - NOTES.txt with post-install instructions - _helpers.tpl with standard naming/labeling helpers Part of kubernetes-sigs#132 Signed-off-by: Venkatesh1505 <venkyravi97@gmail.com>

Signed-off-by: Ali Ok <aliok@redhat.com>

aliok · 2026-06-03T07:01:18Z

@creydr can you take a new look?

creydr · 2026-06-03T07:15:11Z

@creydr can you take a new look?

Looks good from my side (but I can't LGTM because I am not in the org)

matzew · 2026-06-03T08:16:34Z

+    {{- include "mcp-lifecycle-operator.labels" . | nindent 4 }}
+spec:
+  ports:
+    - name: metrics


The Helm chart has name: metrics, while the kustomize file has name: https ( see line 15), and the ServiceMonitor explicitly expects port: https (line 17, with a comment reinforcing it). A Helm-deployed instance would breakPrometheus scraping if someone applies the existing ServiceMonitor config.

ArangoGutierrez

This has clearly been through solid iteration already — the separate CRDs chart, digest-aware image helper, aggregation roles, and healthProbe wiring all landed well, and the manager ClusterRole now matches config/rbac/role.yaml.

One parity gap that I think is a blocker given the PR's stated goal of matching the kustomize output: the default resources diverge from config/manager/manager.yaml (inline). Two smaller suggestions inline as well.

Not re-raising the CRD-sync and metrics port-name topics — those threads already have owners.

ArangoGutierrez · 2026-06-11T08:29:12Z

+resources:
+  limits:
+    cpu: 500m
+    memory: 128Mi


This diverges from config/manager/manager.yaml, which sets limits.memory: 512Mi and requests.memory: 128Mi. Since the chart's contract is "same resources as the kustomize deployment with default values", these should match — and 128Mi is a tight ceiling for a controller running cluster-wide informers on configmaps, secrets, and pods; large clusters will OOM the manager.

ArangoGutierrez · 2026-06-11T08:29:12Z

+
+metrics:
+  # -- Metrics bind address
+  bindAddress: ":8443"


Follow-up to the earlier probe-alignment thread: metrics.bindAddress/metrics.service.port and healthProbe.bindAddress/healthProbe.port are two values encoding one fact each. A user overriding the bind address but not the port (or vice versa) silently breaks the Service or the probes. Suggest keeping only the port values and rendering the args as --metrics-bind-address=:{{ .Values.metrics.service.port }} / --health-probe-bind-address=:{{ .Values.healthProbe.port }} — one knob, nothing to keep in sync.

ArangoGutierrez · 2026-06-11T08:29:12Z

+NOTE: This chart requires the mcp-lifecycle-operator-crds chart to be installed first.
+If you haven't already, install it with:
+
+  helm install mcp-lifecycle-operator-crds dist/chart-crds/


nit: helm install mcp-lifecycle-operator-crds dist/chart-crds/ only works from a repo checkout. Once the charts are published, this path is wrong — worth phrasing it in terms of the chart name (with the repo/OCI ref once one exists) or noting it's a from-source instruction.

ArangoGutierrez

Nice iteration — the RBAC is now byte-for-byte identical to config/default (manager role plus the admin/edit/view aggregation roles), the CRD chart matches config/crd/bases exactly, the digest-aware image helper works, and the container security context is fully hardened. Two things still block a clean approval. First, the default resources: they match this branch's config, but main has since moved to 512Mi/128Mi, so please rebase and bump the chart to keep the "same as kustomize" contract (128Mi is also a tight limit for cluster-wide informers). Second, metrics/health each expose one port through two values, and a partial override renders the Service and probes on a port the manager never binds — I reproduced a probe crash-loop via helm template — so please collapse each to a single knob and derive the flags. The "metrics" vs "https" port-name thread and the CRD/manifest sync automation (#134) already have owners; worth closing them out. Could you rebase on main, fix the resources and the port-DRY footgun, and re-request review?

ArangoGutierrez · 2026-07-13T10:55:37Z

+resources:
+  limits:
+    cpu: 500m
+    memory: 128Mi


Heads up on the resources contract: at this branch's HEAD they match config/manager/manager.yaml (128Mi/64Mi), but main has since bumped to limits.memory 512Mi / requests.memory 128Mi. After a rebase the chart will diverge again, and 128Mi is a tight ceiling for cluster-wide informers. Suggest rebasing on main and setting limits.memory: 512Mi / requests.memory: 128Mi.

ArangoGutierrez · 2026-07-13T10:55:37Z

+
+metrics:
+  # -- Metrics bind address
+  bindAddress: ":8443"


metrics.bindAddress and metrics.service.port encode the same port twice (same for healthProbe). A partial override breaks silently: setting metrics.service.port=9443 and healthProbe.port=9081 alone renders the Service/containerPort/probes on the new ports while the manager still listens on :8443 / :8081 (verified via helm template), so probes crash-loop the pod. Suggest one port key per fact and deriving the arg, e.g. --metrics-bind-address=:{{ .Values.metrics.service.port }}.

ArangoGutierrez · 2026-07-13T10:55:37Z

+    {{- include "mcp-lifecycle-operator.labels" . | nindent 4 }}
+spec:
+  ports:
+    - name: metrics


Naming this port "metrics" keeps the chart internally consistent, but the kustomize Service uses "https" and config/prometheus/monitor.yaml scrapes port: https. A user who applies that ServiceMonitor against a Helm install gets no scraping. Worth aligning the name (or shipping a chart ServiceMonitor) so both paths agree — this thread already has owners, flagging for closure.

ArangoGutierrez · 2026-07-13T10:55:37Z

+NOTE: This chart requires the mcp-lifecycle-operator-crds chart to be installed first.
+If you haven't already, install it with:
+
+  helm install mcp-lifecycle-operator-crds dist/chart-crds/


nit: helm install mcp-lifecycle-operator-crds dist/chart-crds/ only works from a repo checkout. Once published this path is wrong — phrase by chart name (with the repo/OCI ref) or mark it as a from-source instruction.

ArangoGutierrez · 2026-07-13T10:55:38Z

+{{- if .Values.serviceAccount.create }}
+{{- default (printf "%s-controller-manager" (include "mcp-lifecycle-operator.fullname" .)) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}


With serviceAccount.create=false and name unset, the Deployment falls back to the namespace "default" ServiceAccount (verified). That's a quiet least-privilege regression; consider requiring serviceAccount.name when create=false, or documenting it.

kubernetes-prow · 2026-07-13T10:55:46Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Venkatesh1505
Once this PR has been reviewed and has the lgtm label, please assign soltysh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label May 6, 2026

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 6, 2026

k8s-ci-robot requested review from ArangoGutierrez and mrunalp May 6, 2026 14:06

k8s-ci-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label May 6, 2026

Venkatesh1505 force-pushed the feat/helm-chart-scaffold branch from e41c668 to 54d8880 Compare May 6, 2026 14:09

k8s-ci-robot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label May 6, 2026

ibm-adarsh reviewed May 7, 2026

View reviewed changes

Comment thread dist/chart/Chart.yaml Outdated

ibm-adarsh reviewed May 7, 2026

View reviewed changes

Comment thread dist/chart/templates/deployment.yaml Outdated

aliok requested a review from Copilot May 7, 2026 07:25

Copilot AI reviewed May 7, 2026

View reviewed changes

aliok reviewed May 7, 2026

View reviewed changes

Comment thread dist/chart-crds/templates/mcp.x-k8s.io_mcpservers.yaml

aliok mentioned this pull request May 7, 2026

CI for Helm chart #134

Open

aliok reviewed May 7, 2026

View reviewed changes

Comment thread dist/chart/templates/manager-clusterrole.yaml

Comment thread dist/chart/Chart.yaml Outdated

aliok reviewed May 7, 2026

View reviewed changes

Comment thread dist/chart/Chart.yaml Outdated

Comment thread dist/chart/values.yaml Outdated

aliok reviewed May 7, 2026

View reviewed changes

Cali0707 reviewed May 7, 2026

View reviewed changes

aliok self-requested a review May 12, 2026 06:05

aliok mentioned this pull request May 12, 2026

[WIP] feat: add helm unit tests #167

Open

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 14, 2026

aliok requested a review from Copilot June 2, 2026 11:22

Copilot AI reviewed Jun 2, 2026

View reviewed changes

aliok requested a review from Copilot June 2, 2026 11:33

Copilot AI reviewed Jun 2, 2026

View reviewed changes

creydr suggested changes Jun 2, 2026

View reviewed changes

Venkatesh1505 and others added 9 commits June 3, 2026 09:54

use v-prefixed appVersion to match published image tags

4537835

Signed-off-by: Ali Ok <aliok@redhat.com>

set image repository to the full published registry path

be86fbf

Signed-off-by: Ali Ok <aliok@redhat.com>

make health probe port configurable instead of hardcoded

df78c28

Signed-off-by: Ali Ok <aliok@redhat.com>

add MCPServer aggregation ClusterRoles for admin/edit/view

181dd55

Signed-off-by: Ali Ok <aliok@redhat.com>

handle digest-based image references in image helper

e42b3c8

Signed-off-by: Ali Ok <aliok@redhat.com>

rename metrics service port from https to metrics

ed53269

Signed-off-by: Ali Ok <aliok@redhat.com>

move CRD to a separate Helm chart

ad06312

Signed-off-by: Ali Ok <aliok@redhat.com>

sync CRD in chart with latest from config/crd/bases

a7ee27e

Signed-off-by: Ali Ok <aliok@redhat.com>

aliok force-pushed the feat/helm-chart-scaffold branch from f13ce27 to a7ee27e Compare June 3, 2026 06:59

matzew reviewed Jun 3, 2026

View reviewed changes

ArangoGutierrez requested changes Jun 11, 2026

View reviewed changes

ArangoGutierrez requested changes Jul 13, 2026

View reviewed changes

Uh oh!

Conversation

Venkatesh1505 commented May 6, 2026

What this PR does

Resources included

Configurability (values.yaml)

Validation

Follow-ups (separate issues)

Uh oh!

netlify Bot commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for mcp-lifecycle-operator ready!

Uh oh!

k8s-ci-robot commented May 6, 2026

Uh oh!

Venkatesh1505 commented May 6, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aliok left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

aliok May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aliok commented May 14, 2026

Uh oh!

k8s-ci-robot commented Jun 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

creydr left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aliok commented Jun 3, 2026

Uh oh!

creydr commented Jun 3, 2026

Uh oh!

netlify Bot commented May 6, 2026 •

edited

Loading

aliok May 7, 2026 •

edited

Loading