Skip to main content
Glama
toreydai

ingress2gateway-aws-mcp

by toreydai

ingress2gateway-aws-mcp

MCP Server:将 Nginx Ingress 转换为 AWS Gateway API(ALB / NLB)资源的对话式迁移工具。

背景

Ingress-NGINX 已于 2026 年 3 月退役,AWS Load Balancer Controller v2.14+ 正式支持 Kubernetes Gateway API。本工具封装社区官方转换器 ingress2gateway,在其基础上叠加 AWS 专属后处理,提供对话式迁移体验。

Related MCP server: ARC Config MCP Server

工具列表

工具

功能

check_prerequisites

检查 LBC 版本、Gateway API CRD、feature gate、ACM 证书

analyze_ingress

分析 Nginx Ingress 注解分布、路由类型、成本预估

convert_to_gateway_api

完整转换管道 → 生成可 kubectl apply 的 YAML

generate_migration_report

输出 Markdown 迁移报告(成本/DNS/健康检查/Checklist)

validate_output

离线校验生成的 Gateway API YAML

安装

方式一:本地 pip

pip install .

需要 Python 3.11+。可选:安装 ingress2gateway Go 二进制以获得官方转换器覆盖;AWS LBC 不支持的能力仍会由本工具报告为 warning/error(不安装时自动使用内置转换器):

go install github.com/kubernetes-sigs/ingress2gateway@v1.1.0

方式二:Docker

docker build -t ingress2gateway-aws-mcp .
docker run --rm -i ingress2gateway-aws-mcp

连接到 AI 客户端

Kiro

Kiro CLI

kiro-cli mcp add --name ingress2gateway-aws-mcp \
  --scope global \
  --command python3 \
  --args "/path/to/ingress2gateway-aws-mcp/src/server.py"

Kiro IDE(工作区:.kiro/settings/mcp.json,全局:~/.kiro/settings/mcp.json):

{
  "mcpServers": {
    "ingress2gateway-aws-mcp": {
      "command": "python3",
      "args": ["/path/to/ingress2gateway-aws-mcp/src/server.py"]
    }
  }
}

Kiro IDE 支持热重载,修改 mcp.json 后无需重启,下次空闲时自动生效。

Claude

Claude Code CLI

claude mcp add ingress2gateway-aws-mcp python3 /path/to/ingress2gateway-aws-mcp/src/server.py

Claude Desktop~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "ingress2gateway-aws-mcp": {
      "command": "python3",
      "args": ["/path/to/ingress2gateway-aws-mcp/src/server.py"]
    }
  }
}

EKS 集群前置要求

目标集群必须满足以下条件,生成的 YAML 才能成功 apply:

项目

要求

AWS LBC 版本

≥ v2.14.0(L7)/ ≥ v2.13.3(L4)

LBC feature gate

ALBGatewayAPI=true(默认开启)

Gateway API standard channel

v1.5.0+(HTTPRoute / GRPCRoute / ReferenceGrant)

Gateway API experimental channel

仅当有 TCP/UDP/TLSRoute 或 BackendTLSPolicy 时需要

AWS 定制 CRD

LoadBalancerConfigurationTargetGroupConfigurationListenerRuleConfiguration

ACM 证书

每个 TLS hostname 在同 Region 有对应证书

Subnet 标签

kubernetes.io/role/elb: "1"(公网)/ kubernetes.io/role/internal-elb: "1"(内网)

快速搭建满足上述条件的集群,参见 infra/cluster.yaml

使用示例

你:帮我分析一下这个 Ingress 文件
<粘贴 ingress.yaml 内容>

AI 调用 analyze_ingress →
返回注解兼容性报告、路由类型分布、成本预估

你:转换成 Gateway API YAML
AI 调用 convert_to_gateway_api → 返回可直接 apply 的 YAML

你:生成完整迁移报告
AI 调用 generate_migration_report → 返回 Markdown 报告

示例输入文件见 examples/input/,对应转换结果见 examples/output/

目录结构

详见 docs/architecture.md

转换管道概览

Ingress YAML
    │
    ▼ converter.run()          ← ingress2gateway 二进制 / 内置 Python 转换器
    │
    ▼ gateway.inject()         ← 注入 aws-alb / aws-nlb GatewayClass
    ▼ gateway.fix_tls()        ← 移除 certificateRefs,改 hostname → ACM 自动发现
    ▼ gateway.split()          ← L4/L7 强制分离,重写 parentRefs
    ▼ gateway.merge()          ← 按策略合并 Gateway,控制 ALB/NLB 数量
    │
    ▼ crd.generate_for_resources()   ← LoadBalancerConfiguration(每个 Gateway)
    ▼ crd.generate_for_routes()      ← TargetGroupConfiguration(每个 Service / 健康检查 / stickiness)
    ▼ crd.generate_for_ingresses()   ← ListenerRuleConfiguration(OIDC / 源 IP)
    ▼ crd.attach_listener_rule_configs() ← 通过 HTTPRoute ExtensionRef 绑定认证 / 源 IP 条件
    │
    ▼ 可 kubectl apply 的 Gateway API YAML

文档

文档

内容

docs/architecture.md

模块职责、转换管道数据流、AWS 资源模型、关键设计决策

docs/annotation-reference.md

Nginx 注解兼容性速查表(auto / partial / warning / error 分类)

docs/deployment.md

部署手册(本地/Docker/Kiro+Claude 接入、EKS 前置条件)+ 故障排查

开发

pip install -e ".[dev]"
pytest tests/ -v

License

MIT - see the LICENSE file for details.

免责声明

  • 本项目仅供学习与技术参考,不构成生产部署方案。

  • 使用本工具生成的 Gateway API YAML 在 apply 到集群前,请结合实际业务进行安全评估与调整。

  • 部署过程中会在 AWS 上创建 EKS 集群、ALB/NLB 及相关资源并产生费用,请在实验结束后及时清理。

  • 作者不对因使用本项目产生的任何费用或损失承担责任。

  • 本项目与 Amazon Web Services 及 Kubernetes SIGs 无官方关联,相关服务的可用性与定价以各方官方文档为准。

Available Tools

5 tools
analyze_ingressA

Analyze Nginx Ingress configuration and return a structured summary. Reports annotation compatibility, route type distribution, TLS hosts, cross-namespace refs, and cost estimate.

Args: ingress_yaml: Nginx Ingress YAML content (multi-document supported) or file path. tcp_services_yaml: Optional tcp-services ConfigMap YAML for L4 TCP routes. udp_services_yaml: Optional udp-services ConfigMap YAML for L4 UDP routes.

ParametersJSON Schema
NameRequiredDescriptionDefault
ingress_yamlYes
tcp_services_yamlNo
udp_services_yamlNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It states the tool analyzes and returns a summary but does not disclose whether it modifies anything, requires network access, or has rate limits. As an analysis tool, it is likely read-only, but this is not explicitly stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with a clear structure: a brief purpose paragraph followed by parameter details. Every sentence adds value, and the information is front-loaded. No redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool's purpose and parameters are well-covered. The description lists output components, and an output schema exists (though not shown). Missing behavioral context (e.g., error handling, idempotency) but adequate for the complexity. Could mention it is a static analysis tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates excellently with an 'Args' bullet that explains each parameter's meaning, format (e.g., multi-document supported, file path), and optionality. This adds significant value beyond the schema's type and title.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool analyzes Nginx Ingress configuration and returns a structured summary listing specific aspects (annotation compatibility, route type distribution, etc.). However, it does not differentiate from sibling tools like check_prerequisites or convert_to_gateway_api, missing an explicit statement of its unique role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, workflow positioning, or exclusions. The sibling tool names offer context, but the description itself lacks any usage direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_prerequisitesA

Check if the target environment meets AWS Gateway API migration prerequisites.

Args: lbc_version: AWS Load Balancer Controller version (e.g. "2.14.1"). Leave empty to skip. needs_l4: Set true if migration includes TCP/UDP/TLS routes (requires experimental channel). tls_hostnames: Comma-separated TLS hostnames to check ACM certificate coverage.

ParametersJSON Schema
NameRequiredDescriptionDefault
needs_l4No
lbc_versionNo
tls_hostnamesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavioral traits. It only lists parameters and their meanings, but does not describe what happens when prerequisites fail, whether the tool makes any changes, or other side effects. This is insufficient for a tool with no annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: one sentence for purpose followed by a parameter list. Every sentence adds value, and the structure is front-loaded with the main purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While an output schema exists (so return values are covered), the description lacks contextual completeness regarding behavior, side effects, or error handling. With no annotations, more detail is needed for a fully adequate description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the description provides clear, meaningful explanations for all three parameters (lbc_version, needs_l4, tls_hostnames), including default behaviors like 'Leave empty to skip' and conditions for setting needs_l4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Check if the target environment meets AWS Gateway API migration prerequisites.' It uses a specific verb ('Check') and resource ('prerequisites'), and distinguishes from sibling tools like convert_to_gateway_api.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage as a preliminary step for AWS Gateway API migration and explains parameter usage (e.g., 'Leave empty to skip' for lbc_version). However, it does not explicitly state when to use this tool versus alternatives or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

convert_to_gateway_apiA

Convert Nginx Ingress YAML to AWS Gateway API resources (full pipeline).

Steps: base conversion → GatewayClass injection → TLS fixup → L4/L7 split → Gateway merge → LoadBalancerConfiguration → TargetGroupConfiguration → ListenerRuleConfiguration

Args: ingress_yaml: Nginx Ingress YAML content or file path. tcp_services_yaml: Optional tcp-services ConfigMap YAML for TCP routes. udp_services_yaml: Optional udp-services ConfigMap YAML for UDP routes. scheme: ALB scheme — "internet-facing" or "internal". namespace: Default namespace if not specified in resources. alb_gateway_class: Name for the ALB GatewayClass (default: aws-alb). nlb_gateway_class: Name for the NLB GatewayClass (default: aws-nlb). gateway_grouping: Gateway consolidation strategy: "by-class-scheme" (default) | "by-namespace" | "by-host" | "single" health_check_path: TargetGroupConfiguration health check path. health_check_interval: TargetGroupConfiguration health check interval seconds. healthy_threshold: TargetGroupConfiguration healthy threshold count. unhealthy_threshold: TargetGroupConfiguration unhealthy threshold count.

ParametersJSON Schema
NameRequiredDescriptionDefault
schemeNointernet-facing
namespaceNodefault
ingress_yamlYes
gateway_groupingNoby-class-scheme
alb_gateway_classNoaws-alb
health_check_pathNo/
healthy_thresholdNo
nlb_gateway_classNoaws-nlb
tcp_services_yamlNo
udp_services_yamlNo
unhealthy_thresholdNo
health_check_intervalNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It outlines the pipeline steps but does not disclose error handling, idempotency, or whether the tool is destructive (likely it returns converted YAML without side effects).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a summary line, pipeline steps, and parameter list. It front-loads the purpose. While slightly lengthy, the parameter list is justified due to low schema coverage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (12 parameters, 0% schema coverage) and presence of output schema, the description covers the conversion pipeline and parameter meanings well. It lacks mention of error conditions or output format, but output schema may address that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description adds value by explaining most parameters, e.g., 'ingress_yaml: Nginx Ingress YAML content or file path' and 'gateway_grouping: Gateway consolidation strategy...'. However, some health-check parameters are only named without detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Convert Nginx Ingress YAML to AWS Gateway API resources (full pipeline)', with a specific verb and resource. It distinguishes from sibling tools like analyze_ingress and validate_output by being the actual conversion step.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for converting Nginx Ingress to AWS Gateway API but does not explicitly state when to use vs alternatives like check_prerequisites or generate_migration_report. No when-not guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_migration_reportB

Generate a complete Markdown migration report. Includes: summary, cost impact, DNS changes, annotation analysis, health check reminders, ACM checklist, migration checklist, and rollback plan.

Args: ingress_yaml: Nginx Ingress YAML content or file path. tcp_services_yaml: Optional tcp-services ConfigMap YAML. udp_services_yaml: Optional udp-services ConfigMap YAML. scheme: ALB scheme — "internet-facing" or "internal". gateway_grouping: Gateway consolidation strategy. lbc_version: AWS LBC version for pre-flight checks (optional). health_check_path: TargetGroupConfiguration health check path. health_check_interval: TargetGroupConfiguration health check interval seconds. healthy_threshold: TargetGroupConfiguration healthy threshold count. unhealthy_threshold: TargetGroupConfiguration unhealthy threshold count.

ParametersJSON Schema
NameRequiredDescriptionDefault
schemeNointernet-facing
lbc_versionNo
ingress_yamlYes
gateway_groupingNoby-class-scheme
health_check_pathNo/
healthy_thresholdNo
tcp_services_yamlNo
udp_services_yamlNo
unhealthy_thresholdNo
health_check_intervalNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description lacks any behavioral traits such as whether the tool is read-only, requires specific permissions, or has side effects. It only describes the output content, not the operational behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a bullet list of report contents and a clear parameter list. It is front-loaded with the purpose, and every sentence provides value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (10 parameters, output schema exists), the description covers the report contents and parameter roles. It lacks behavioral context and prerequisites, but is otherwise complete for a report generation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description adds meaningful parameter explanations for most parameters (e.g., ingress_yaml, scheme, health check fields). Some parameters like gateway_grouping lack detailed meaning, but overall it compensates well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it generates a comprehensive Markdown migration report and lists its contents. However, it does not explicitly differentiate from sibling tools like analyze_ingress or convert_to_gateway_api, which are more specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It implies a comprehensive use case but does not state when to prefer it or when to use sibling tools instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

validate_outputA

Validate Gateway API YAML against schema rules and AWS LBC constraints. Checks: required fields, L4/L7 mixing, certificateRefs misuse, parentRef consistency, experimental channel requirements, and cross-namespace reference coverage.

Args: yaml_content: Gateway API YAML content to validate, or file path.

ParametersJSON Schema
NameRequiredDescriptionDefault
yaml_contentYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It lists checks but does not disclose whether the tool is read-only, requires authentication, or has side effects. It does not describe the output format or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with the main purpose stated first, followed by a bullet list of checks. Every sentence adds value without unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only one parameter and uses an output schema, the description covers the key aspects: what the tool does, what it checks, and the parameter's dual nature. It is sufficient for a single-parameter validation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, but the description adds meaning by clarifying that yaml_content can be either actual YAML content or a file path. This goes beyond the schema's type definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool validates Gateway API YAML against schema rules and AWS LBC constraints, listing specific checks like required fields, L4/L7 mixing, etc. This distinguishes it from siblings such as analyze_ingress or convert_to_gateway_api.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for validation but does not explicitly state when to use this tool versus alternatives. No exclusions or when-not-to-use guidance is provided; the sibling tools are not compared.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.1.0
    • First observedanalyze_ingress
    • First observedcheck_prerequisites
    • First observedconvert_to_gateway_api
    • First observedgenerate_migration_report
    • First observedvalidate_output

TDQS

A4/5.0

Scored across 5 tools

Disambiguation5/5

Each tool serves a distinct step in the migration pipeline: analysis, prerequisites check, conversion, validation, and report generation. No overlapping purposes.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern (e.g., analyze_ingress, check_prerequisites), with clear and specific verbs appropriate to the action.

Tool Count5/5

5 tools cover the essential migration workflow without excess or deficiency. Each tool has a clear role and sufficient parameters.

Completeness5/5

The toolset covers the full migration lifecycle from analysis to validation and reporting, including prerequisites checking and rollback planning in the report. No obvious gaps.

Maintenance

ActivityStale
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables natural language management of GitHub Actions Runner Controller (ARC) in Kubernetes clusters. Supports automated installation, scaling, monitoring, and troubleshooting of GitHub Actions runners through conversational AI commands.
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to interact with Argo CD applications, managing clusters, applications, and resources through natural language.
    Apache 2.0
  • A
    license
    A
    quality
    C
    maintenance
    Exposes a Kubernetes cluster to MCP-compatible AI clients, enabling read-only and optional write operations on cluster resources like pods, deployments, and namespaces through natural language.
    9
    1
    MIT