Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.175.0 to 3.204.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.204.0</h2>
<h2>3.204.0 (2025-10-23)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Print replace diffs when a resource tries to replace but is
blocked by still having an import id set
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20762">#20762</a></p>
</li>
<li>
<p>[engine] Support overriding policy severity on violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20767">#20767</a></p>
</li>
<li>
<p>[backend/service] Send journal entries to the backend if it's
supported
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20343">#20343</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix a potential snapshot integrity error when a resources
dependency fails to be destroyed using <code>destroy
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20692">#20692</a></p>
</li>
<li>
<p>[engine] Fix import error to contain the import ID of non-existent
resources
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20753">#20753</a></p>
</li>
<li>
<p>[sdk/nodejs] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20774">#20774</a></p>
</li>
<li>
<p>[sdk/python] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20769">#20769</a></p>
</li>
<li>
<p>[sdkgen/go] Fix codegen of scalar return SDK functions
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20754">#20754</a></p>
</li>
<li>
<p>[sdkgen/{nodejs,python}] Fix scalar return protocol to allow
returning secret maps
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20747">#20747</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/nodejs] Use Language.Link to link Node.js packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20715">#20715</a></li>
</ul>
<h2>v3.203.0</h2>
<h2>3.203.0 (2025-10-15)</h2>
<h3>Features</h3>
<ul>
<li>[cli/display] Display policy severity for violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20746">#20746</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.204.0 (2025-10-23)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Print replace diffs when a resource tries to replace but is
blocked by still having an import id set
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20762">#20762</a></p>
</li>
<li>
<p>[engine] Support overriding policy severity on violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20767">#20767</a></p>
</li>
<li>
<p>[backend/service] Send journal entries to the backend if it's
supported
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20343">#20343</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix a potential snapshot integrity error when a resources
dependency fails to be destroyed using <code>destroy
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20692">#20692</a></p>
</li>
<li>
<p>[engine] Fix import error to contain the import ID of non-existent
resources
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20753">#20753</a></p>
</li>
<li>
<p>[sdk/nodejs] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20774">#20774</a></p>
</li>
<li>
<p>[sdk/python] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20769">#20769</a></p>
</li>
<li>
<p>[sdkgen/go] Fix codegen of scalar return SDK functions
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20754">#20754</a></p>
</li>
<li>
<p>[sdkgen/{nodejs,python}] Fix scalar return protocol to allow
returning secret maps
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20747">#20747</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/nodejs] Use Language.Link to link Node.js packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20715">#20715</a></li>
</ul>
<h2>3.203.0 (2025-10-15)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli/display] Display policy severity for violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20746">#20746</a></p>
</li>
<li>
<p>[cli/package] Show functions in <code>package info</code></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="24654399ab"><code>2465439</code></a>
Bump dotnet language plugin to latest version (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20778">#20778</a>)</li>
<li><a
href="3882b627ba"><code>3882b62</code></a>
implement journaling API and send journal entries to the service
directly (<a
href="https://redirect.github.com/pulumi/pulumi/issues/2">#2</a>...</li>
<li><a
href="ef3c2a316b"><code>ef3c2a3</code></a>
[Node.js] Pass secret values as Output objects to resource hooks (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20774">#20774</a>)</li>
<li><a
href="86503934b9"><code>8650393</code></a>
Support overriding policy severity on violations (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20767">#20767</a>)</li>
<li><a
href="be6db2b82a"><code>be6db2b</code></a>
Run analyzer lifecycle tests through gRPC (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20766">#20766</a>)</li>
<li><a
href="fd8c0a88b5"><code>fd8c0a8</code></a>
Pass secret values as Outputs to hooks (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20769">#20769</a>)</li>
<li><a
href="d292447a49"><code>d292447</code></a>
Add some tests for Python type inspection utilities (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20736">#20736</a>)</li>
<li><a
href="ba809f361c"><code>ba809f3</code></a>
Add a <code>--version</code> flag to <code>pulumi-language-nodejs</code>
(<a
href="https://redirect.github.com/pulumi/pulumi/issues/20768">#20768</a>)</li>
<li><a
href="89ea89b4da"><code>89ea89b</code></a>
update journaling docs (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20763">#20763</a>)</li>
<li><a
href="22797a9b84"><code>22797a9</code></a>
Share CurrentProjectContradictsWorkspace between backends (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20759">#20759</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.175.0...v3.204.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
Implements automated database backup functionality with Google Cloud
Storage integration, including retention policies and MinIO support for
local development.
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
This change adds critical database backup capabilities to ensure data
durability and disaster recovery. The solution provides automated
backups with configurable retention policies and supports both
production (GCS) and development (MinIO) environments.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
- Tested backup creation and restoration with MinIO in local development
- Verified GCS bucket lifecycle policies for automatic deletion after 60
days
- Tested backup retention and cleanup logic
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No breaking changes. This is an additive feature that doesn't affect
existing functionality.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
- Implements 60-day retention period for backups as a safety net
- Uses GCS lifecycle rules for automatic cleanup
- Includes MinIO setup instructions for local development testing
- Port-forwarding commands updated for consistency across documentation
- Fixes#184
Adds the Pulumi code to:
- Deploy the registry (and associated services e.g. mongodb) to Google
Cloud Platform (GCP), on top of Google Kubernetes Engine (GKE)
- Sets up proper environments and secrets management
- Uses the real container image, now that it's published in #225. At the
moment attached to latest, we might want to pin the version later (or
perhaps always use `latest` in staging, and pin prod)
- Uses real domains (`staging.registry.modelcontextprotocol.io`) rather
than examples (``)
## Motivation and Context
Setting up infrastructure to deploy it. I set something up in Azure in
#227, although not super robust (e.g. no service accounts etc.). Think
we will use GCP as:
- the maintainers have experience with GCP, but none with Azure
- costs are quite low, and Anthropic is happy to cover them in the short
term
- means we only have to maintain one login system (just Google Cloud
Identity), not two (Google Workspace + Azure)
## How Has This Been Tested?
Deployed this to a staging and production cluster. Try it yourself at:
```bash
curl -H "Host: staging.registry.modelcontextprotocol.io" -k https://35.222.36.75/v0/ping
```
(will be sorting out domains very soon)
## Breaking Changes
NA - just adds support for GCP deployment
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Expected follow-ups:
- GitHub Action setup to deploy things to the cluster from GitHub, to
avoid gatekeeping to just the people with the secrets.
Original PR: #227
- Add Pulumi-based infrastructure as code for deploying MCP Registry to
Kubernetes
- Support for both local development (minikube) and Azure Kubernetes
Service (AKS)
- Complete deployment orchestration including:
- cluster setup: e.g. you point this at an Azure account, and it can set
up and manage the cluster for you. e.g. K8s version, number of nodes,
type of nodes, ...
- cloud agnostic K8s services: cert-manager, nginx-ingress
- app services: MongoDB, and registry application (currently using nginx
as a placeholder, blocked on #225 (as is #190). but should be a 1 line
change)
## How is this different to #190
- Supports cluster setup and management. This enables:
- Non-hosting maintainers managing many devops workflows (e.g. scaling
up the cluster, or bumping K8s versions). Without this, we'd need to
bug/page the organisation hosting the registry when we need these things
changed.
- Makes it easy to spin up things like staging/temporary clusters, as
well as enables contributors to replicate the stack exactly on their own
Azure accounts.
- Sets up cloud-agnostic services. For example, rather than using the
Azure-managed ingresses and CA, we install nginx-ingress and
cert-manager. This enables:
- Running the entire infra stack can also run locally (e.g. in minikube,
k3s, orbstack, colima) - making it much easier for contributors to test
changes to infra stuff.
- Moving between cloud providers much more easily, e.g. we could shift
from Azure to GCP/AWS/other with minimal hassle.
- Everything stays written in Go, rather than Helm templates. This means
we get things like type-checking etc. for free (which from my experience
makes AI tools wayyy better at editing K8s stuff), and contributors
don't need to learn a new language if they're already using Go.
## Testing
I've got this running well:
- locally in minikube
- on cloud in Azure (my personal Azure account)
<details><summary>Claude written architecture and security
review</summary>
<p>
## Deployment Review & Assessment
### Current Architecture Strengths
**Pulumi IaC Approach**
- Well-structured infrastructure as code using Pulumi
- Multi-provider support (AKS, local) with clean abstraction
- Good separation of concerns in `pkg/` directory
**Security Fundamentals**
- Non-root container execution (`appuser` with UID 10001)
- Secrets properly managed via Kubernetes secrets
- TLS/SSL certificate management with cert-manager and Let's Encrypt
### Critical Issues & High-Priority Improvements
**1. Production Deployment Not Ready** 🚨
The registry deployment uses `nginx:alpine` placeholder image instead of
the actual MCP registry:
- `deploy/pkg/k8s/registry.go:67` - TODO comments indicate incomplete
setup
- Health probes are commented out
- Port mapping doesn't match actual application (80 vs 8080)
**Fix:** Build and publish actual registry container image to GHCR,
update deployment
**2. Database Security Considerations** 🔒
- MongoDB deployed without authentication
- No backup/disaster recovery strategy
- Database credentials hardcoded
*Note: MongoDB is not exposed externally (ClusterIP service), so this is
not a critical security risk but should be addressed for production.*
**3. Monitoring & Observability Gaps** 📊
- No Prometheus/Grafana monitoring stack
- No log aggregation (ELK/Loki)
- No application metrics/health dashboards
- No alerting configured
**4. High Availability & Reliability** ⚠️
- Single MongoDB instance (no replication)
- No persistent volume backup strategy
- Fixed 10Gi storage without growth planning
- Only 2 replicas for registry service
- No pod disruption budgets
- No horizontal pod autoscaling
### Recommended Improvements
**Immediate (High Priority)**
1. Complete Registry Deployment - Build proper container image pipeline,
enable health checks
2. Secure MongoDB - Add authentication credentials, implement backup
strategy
**Medium Priority**
3. Add Monitoring Stack - Prometheus, Grafana deployment
4. Security Hardening (Nice to Have) - RBAC policies, Network Policies,
Pod Security Standards
5. CI/CD Pipeline Enhancement - Container image building/publishing,
automated deployment
**Lower Priority**
6. High Availability - MongoDB replica set, HPA for registry pods
7. Operational Excellence - Kubernetes dashboard, cost optimization
### Configuration Issues
- Production config has test credentials: `deploy/Pulumi.prod.yaml:4-5`
- Missing environment-specific resource sizing
- Hardcoded domain names (`example.com`)
The deployment setup shows good architectural foundations but needs
significant work before production readiness. The most critical issue is
the placeholder nginx container - priority should be completing the
actual registry application deployment before addressing the other
improvements. Security measures like RBAC and Network Policies are nice
to have but not strictly necessary given that MongoDB is not exposed
externally.
🤖 Generated with [Claude Code](https://claude.ai/code)
</p>
</details>
## Metadata
Working towards #91
---------
Co-authored-by: Claude <noreply@anthropic.com>
dependabot[bot]
adam jones