# Ingress for MCP Server with TLS
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: mcp-server-ingress
namespace: mcp-server
labels:
app: mcp-server
annotations:
# Nginx ingress controller annotations
kubernetes.io/ingress.class: "nginx"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
# Rate limiting
nginx.ingress.kubernetes.io/rate-limit-enabled: "true"
nginx.ingress.kubernetes.io/rate-limit-requests-per-minute: "100"
nginx.ingress.kubernetes.io/rate-limit-requests-per-second: "5"
# CORS
nginx.ingress.kubernetes.io/enable-cors: "true"
nginx.ingress.kubernetes.io/cors-allow-methods: "GET, POST, PUT, DELETE, OPTIONS"
nginx.ingress.kubernetes.io/cors-allow-headers: "DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization"
# Security headers
nginx.ingress.kubernetes.io/configuration-snippet: |
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
# Load balancing
nginx.ingress.kubernetes.io/upstream-hash-by: "$request_uri"
# Timeouts
nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
nginx.ingress.kubernetes.io/proxy-send-timeout: "30"
nginx.ingress.kubernetes.io/proxy-read-timeout: "30"
# TLS with cert-manager (if using cert-manager)
cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
tls:
- hosts:
- api.yourdomain.com
secretName: mcp-server-tls
rules:
- host: api.yourdomain.com
http:
paths:
# Main API paths
- path: /
pathType: Prefix
backend:
service:
name: mcp-server-service
port:
number: 8000
# Health check (no auth required)
- path: /health
pathType: Exact
backend:
service:
name: mcp-server-service
port:
number: 8000
# Metrics endpoint (if exposing externally)
- path: /metrics
pathType: Exact
backend:
service:
name: mcp-server-service
port:
number: 8001
---
# Separate ingress for monitoring dashboard (optional)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: mcp-monitoring-ingress
namespace: mcp-server
labels:
app: mcp-monitoring
annotations:
kubernetes.io/ingress.class: "nginx"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
# Basic auth for monitoring
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/auth-secret: monitoring-auth
nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - Monitoring'
# TLS
cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
tls:
- hosts:
- monitoring.yourdomain.com
secretName: mcp-monitoring-tls
rules:
- host: monitoring.yourdomain.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: grafana-service # Assuming Grafana service exists
port:
number: 3000
