Google Workspace MCP Server

apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "workspace-mcp.fullname" . }} labels: {{- include "workspace-mcp.labels" . | nindent 4 }} spec: {{- if not .Values.autoscaling.enabled }} replicas: {{ .Values.replicaCount }} {{- end }} selector: matchLabels: {{- include "workspace-mcp.selectorLabels" . | nindent 6 }} template: metadata: {{- with .Values.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} labels: {{- include "workspace-mcp.selectorLabels" . | nindent 8 }} spec: {{- with .Values.imagePullSecrets }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} serviceAccountName: {{ include "workspace-mcp.serviceAccountName" . }} securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: - name: {{ .Chart.Name }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} ports: - name: http containerPort: {{ .Values.service.targetPort }} protocol: TCP {{- if .Values.healthCheck.enabled }} livenessProbe: httpGet: path: {{ .Values.healthCheck.path }} port: http initialDelaySeconds: {{ .Values.healthCheck.initialDelaySeconds }} periodSeconds: {{ .Values.healthCheck.periodSeconds }} timeoutSeconds: {{ .Values.healthCheck.timeoutSeconds }} successThreshold: {{ .Values.healthCheck.successThreshold }} failureThreshold: {{ .Values.healthCheck.failureThreshold }} readinessProbe: httpGet: path: {{ .Values.healthCheck.path }} port: http initialDelaySeconds: {{ .Values.healthCheck.initialDelaySeconds }} periodSeconds: {{ .Values.healthCheck.periodSeconds }} timeoutSeconds: {{ .Values.healthCheck.timeoutSeconds }} successThreshold: {{ .Values.healthCheck.successThreshold }} failureThreshold: {{ .Values.healthCheck.failureThreshold }} {{- end }} env: # Google OAuth credentials from secret - name: GOOGLE_OAUTH_CLIENT_ID valueFrom: secretKeyRef: name: {{ include "workspace-mcp.fullname" . }}-oauth key: client-id - name: GOOGLE_OAUTH_CLIENT_SECRET valueFrom: secretKeyRef: name: {{ include "workspace-mcp.fullname" . }}-oauth key: client-secret {{- if .Values.secrets.googleOAuth.userEmail }} - name: USER_GOOGLE_EMAIL valueFrom: secretKeyRef: name: {{ include "workspace-mcp.fullname" . }}-oauth key: user-email {{- end }} # Single-user mode {{- if .Values.singleUserMode }} - name: MCP_SINGLE_USER_MODE value: "1" {{- end }} # Tool configuration {{- if .Values.toolTier }} - name: TOOL_TIER value: {{ .Values.toolTier | quote }} {{- end }} {{- if .Values.tools.enabled }} - name: TOOLS value: {{ .Values.tools.enabled | join " " | quote }} {{- end }} # Environment variables from values {{- range $key, $value := .Values.env }} - name: {{ $key }} value: {{ $value | quote }} {{- end }} {{- if .Values.command.override }} command: {{ .Values.command.override }} {{- end }} {{- if not .Values.command.disableArgs }} args: - "uv run main.py --transport streamable-http {{- if .Values.singleUserMode }} --single-user{{- end }} ${TOOL_TIER:+--tool-tier \"$TOOL_TIER\"} ${TOOLS:+--tools $TOOLS}" {{- end }} resources: {{- toYaml .Values.resources | nindent 12 }} volumeMounts: - name: credentials mountPath: /app/.credentials readOnly: false - name: tmp mountPath: /tmp readOnly: false volumes: - name: credentials emptyDir: sizeLimit: 100Mi - name: tmp emptyDir: sizeLimit: 100Mi {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} {{- with .Values.affinity }} affinity: {{- toYaml . | nindent 8 }} {{- end }} {{- with .Values.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }}