Secure MCP Server

apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: secure-mcp-production namePrefix: prod- nameSuffix: -prod commonLabels: environment: production app.kubernetes.io/environment: production criticality: high commonAnnotations: environment: production compliance: "pci-dss,hipaa,soc2" resources: - ../../base replicas: - name: secure-mcp count: 5 images: - name: secure-mcp-server newName: registry.example.com/secure-mcp/server newTag: v1.0.0 configMapGenerator: - name: secure-mcp-config behavior: merge literals: - NODE_ENV=production - LOG_LEVEL=warn - CORS_ORIGINS=https://app.example.com,https://admin.example.com - RATE_LIMIT_WINDOW_MS=900000 - RATE_LIMIT_MAX_REQUESTS=100 - MFA_ENABLED=true - TRACING_SAMPLE_RATE=0.01 - DB_POOL_MIN=5 - DB_POOL_MAX=20 - REDIS_CLUSTER_MODE=true secretGenerator: - name: secure-mcp-secrets behavior: replace envs: - secrets.env patches: - target: kind: Deployment name: secure-mcp patch: |- - op: replace path: /spec/replicas value: 5 - op: add path: /spec/template/spec/affinity/podAntiAffinity/requiredDuringSchedulingIgnoredDuringExecution/0/topologyKey value: failure-domain.beta.kubernetes.io/zone - op: add path: /spec/template/spec/tolerations value: - key: "production" operator: "Equal" value: "true" effect: "NoSchedule" - target: kind: HorizontalPodAutoscaler name: secure-mcp-hpa patch: |- - op: replace path: /spec/minReplicas value: 5 - op: replace path: /spec/maxReplicas value: 30 - op: replace path: /spec/metrics/0/resource/target/averageUtilization value: 60 - op: replace path: /spec/metrics/1/resource/target/averageUtilization value: 70 - target: kind: Ingress name: secure-mcp-ingress patch: |- - op: replace path: /spec/rules/0/host value: api.example.com - op: replace path: /spec/tls/0/hosts/0 value: api.example.com - op: add path: /metadata/annotations/nginx.ingress.kubernetes.io~1limit-rps value: "1000" - op: add path: /metadata/annotations/nginx.ingress.kubernetes.io~1enable-modsecurity value: "true" - target: kind: PodDisruptionBudget name: secure-mcp-pdb patch: |- - op: replace path: /spec/minAvailable value: 3 - target: kind: NetworkPolicy name: secure-mcp-network-policy patch: |- - op: remove path: /spec/ingress/3 patchesStrategicMerge: - deployment-patch.yaml - monitoring-patch.yaml