From ade1b797b22a40dd5a5547babfd10c17201d4910 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Thu, 2 Oct 2025 18:20:32 +0300 Subject: [PATCH] Enable a gitops way of promoting to prod (#582) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Motivation and Context The following PR moves away from automatically promoting latest releases to production in favour of specifying the released version explicitly via a PR & Review process. Still sets the image tag to latest for now so we can enable it separately whenever we decide 👍 ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- deploy/Pulumi.gcpProd.yaml | 1 + deploy/README.md | 11 ++++++++++- deploy/pkg/k8s/registry.go | 4 +++- docs/guides/contributing/releasing.md | 2 ++ 4 files changed, 16 insertions(+), 2 deletions(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index f3a0c88..5283152 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,6 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp + mcp-registry:imageTag: latest # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: diff --git a/deploy/README.md b/deploy/README.md index c2557e9..3e4142d 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -29,7 +29,15 @@ PULUMI_CONFIG_PASSPHRASE="" pulumi config set mcp-registry:githubClientSecret -- ### Production Deployment (GCP) -**Note:** The production deployment is automatically handled by GitHub Actions. All merges to the `main` branch trigger an automatic deployment to GCP via [the configured GitHub Actions workflow](../.github/workflows/deploy.yml). The steps below are preserved as a log of what we did, or if a manual override is needed. +**Note:** The production deployment is automatically handled by GitHub Actions. All merges to the `main` branch trigger an automatic deployment the `staging` environment at GCP via [the configured GitHub Actions workflow](../.github/workflows/deploy.yml). + +**Important:** Deployment to `prod` require explicit configuration of the Docker image tag in `Pulumi.gcpProd.yaml`. This prevents automatic promotion of new releases and provides manual control over production versions. To deploy a specific version: + +1. Update `mcp-registry:imageTag` in `Pulumi.gcpProd.yaml` to the desired version (e.g., `v1.0.0`, `main-20250930-abc123d`) +2. Commit the changes and open a PR to `main` +3. Once merged, the GitHub Actions workflow will deploy the specified version + +The steps below are preserved as a log of what we did, or if a manual override is needed. Pre-requisites: - [Pulumi CLI installed](https://www.pulumi.com/docs/iac/download-install/) @@ -113,6 +121,7 @@ Pre-requisites: | `provider` | Kubernetes provider (local/gcp) | No (default: local) | | `githubClientId` | GitHub OAuth Client ID | Yes | | `githubClientSecret` | GitHub OAuth Client Secret | Yes | +| `imageTag` | Docker image tag for production environment | Yes (prod only) | | `gcpProjectId` | GCP Project ID (required when provider=gcp) | No | | `gcpRegion` | GCP Region (default: us-central1) | No | diff --git a/deploy/pkg/k8s/registry.go b/deploy/pkg/k8s/registry.go index 2e8df17..d4a3c13 100644 --- a/deploy/pkg/k8s/registry.go +++ b/deploy/pkg/k8s/registry.go @@ -35,7 +35,9 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env // Determine Docker image tag based on environment imageTag := "main" // Default for staging if environment == "prod" { - imageTag = "latest" // Use latest release for production + // Use explicitly configured image tag for production + // This prevents automatic promotion and requires manual control of production releases + imageTag = conf.Require("imageTag") // Explicit configuration required - no fallback } // Create Secret with sensitive configuration diff --git a/docs/guides/contributing/releasing.md b/docs/guides/contributing/releasing.md index cfb485c..9ce96f8 100644 --- a/docs/guides/contributing/releasing.md +++ b/docs/guides/contributing/releasing.md @@ -21,6 +21,8 @@ The release workflow will automatically: - `ghcr.io/modelcontextprotocol/registry:vX.Y.Z` - Specific release version - Binaries can be downloaded from the GitHub release page +**Note:** Releases do not automatically deploy to production. See the [deployment documentation](../../deploy/README.md) for production deployment instructions. + ## Docker Image Tags The registry publishes different Docker image tags for different use cases: