Add MCP Service to Helm chart

[ravikiranvm]

Part of OPS-4801

What this adds

An optional MCP server component (openops-mcp) so external agents such as Claude Code or Codex can operate OpenOps. When enabled, it runs as its own Deployment behind nginx at <publicUrl>/mcp and authenticates agents with OAuth issued by the OpenOps API. Turning it on is one flag, mcp.enabled: true, plus one shared secret, OPS_OAUTH_RS_CLIENT_SECRET. The chart derives the API's OAuth settings from that flag and global.publicUrl, so the API and the MCP server always agree on issuer and resource URLs.

Impact on existing installs

MCP is off by default. With it off, the only rendered change is three new plain environment variables on the app and worker pods (OPS_OAUTH_ENABLED=false plus the two derived URLs), which causes one rolling restart on upgrade. No Secret or ExternalSecret entries change, so environments backed by Key Vault are unaffected. Verified by rendering the dev, staging, prod and pentest values files against this branch and the base branch and diffing the output.

Image and CI

The MCP image is only published to the private registry openopsprivate.azurecr.io until its first public release, so that is the default mcp.repository, matching the docker-compose setup. Because the kind cluster in the e2e workflow cannot pull from a private registry, MCP stays disabled there. The enabled path is covered instead by a new values.mcp-example.yaml, which the validation workflow renders on every PR. Once a public image exists, the default can flip and e2e can enable it.

Follow-ups (outside this repo)

• Release the chart as a draft version from mg/OPS-4456 after merge.
• devops: grant the dev cluster's kubelet identity Container Registry Repository Reader on the private registry (Terraform, Owner apply). Without it the MCP pod cannot pull its image.
• devops: generate OPS_OAUTH_RS_CLIENT_SECRET into azure-<env>-infra-secrets via Terraform (openops-cloud/devops#). Replaces the manual Key Vault edit; this chart PR routes the key to the infra secret.
• devops: set mcp.enabled: true, mcp.tag, and declare OPS_OAUTH_RS_CLIENT_SECRET: "" in values.dev.yaml; bump CHART_VERSION in the deploy-helm action.
• Verify on dev: /.well-known/oauth-protected-resource/mcp returns the expected resource, then connect with claude mcp add --transport http openops https://dev.internal.openops.com/mcp.
• Confirm Front Door / WAF passes /mcp and /.well-known/* traffic.
• Retarget this PR to main once OPS-4456 merges.

[linear]

OPS-4801

[Copilot]

🟡 Changes recommended

The README update introduces inconsistencies (many remaining “engine” references and outdated config examples) that can mislead users about current chart values and components.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds an opt-in MCP server to the OpenOps Helm chart, including routing through nginx, gated secret/values handling, and CI rendering to keep the MCP-enabled path validated.

Changes:

• Introduce a new mcp values block (with schema + example overlay) and API-side OAuth env derived from mcp.enabled + global.publicUrl.
• Add MCP Kubernetes resources (Deployment/Service/SA/PDB/HPA) plus nginx routing and NetworkPolicy rules when enabled.
• Extend secret/external-secret generation and Helm validation logic to support MCP-only env and required secret validation.

File summaries

File	Description
README.md	Documents MCP usage and updates component list/repo layout (but still contains outdated “engine” sections elsewhere).
chart/values.yaml	Adds MCP configuration + derived OAuth env vars and MCP-specific env wiring.
chart/values.schema.json	Adds schema for the new mcp values block.
chart/values.mcp-example.yaml	Provides a CI-rendered example overlay that enables MCP.
chart/values.ci.yaml	Keeps MCP disabled in CI while providing resource/PDB defaults.
chart/templates/serviceaccount-mcp.yaml	ServiceAccount for MCP (gated on mcp.enabled).
chart/templates/service-mcp.yaml	ClusterIP service for MCP (gated on mcp.enabled).
chart/templates/secret-env.yaml	Includes MCP env-derived secret keys only when MCP is enabled.
chart/templates/pdb-mcp.yaml	PDB for MCP (gated on mcp.enabled).
chart/templates/NOTES.txt	Adds MCP connection instructions when enabled.
chart/templates/networkpolicy.yaml	Allows nginx → MCP traffic and adds an MCP-specific NetworkPolicy when enabled.
chart/templates/hpa-mcp.yaml	Optional HPA for MCP (gated on mcp.enabled + autoscaling).
chart/templates/external-secret.yaml	Adds MCP env-derived secret entries only when MCP is enabled.
chart/templates/deployment-mcp.yaml	MCP Deployment with restricted env injection and metadata-based probes.
chart/templates/configmap-nginx.yaml	Adds /mcp and RFC 9728 metadata proxy routes when enabled.
chart/templates/_helpers.tpl	Adds openops.mcpServiceUrl and openops.validateMcp validation helper.
chart/.gitignore	Ensures values.mcp-example.yaml is included in the chart repo.
AGENTS.md	Updates repository structure + production features to include MCP.
.github/workflows/helm-validate.yaml	Adds CI templating pass for the MCP-enabled example overlay.

Review details

Suppressed comments (1)

README.md:22

• This section switches terminology to "worker", but large parts of the README still reference "engine" (e.g., production overlay notes, scaling examples, and autoscaling examples). Since the chart values use worker: / per-component autoscaling: blocks, the remaining README sections should be updated to match the current values keys and component names.

- **openops-app**: Main application server.
- **openops-worker**: Workflow execution worker.
- **openops-mcp** (opt-in): MCP server that lets external agents such as Claude Code or Codex operate OpenOps over OAuth.

• Files reviewed: 19/19 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.