667e2840b8Original PR: #227 - Add Pulumi-based infrastructure as code for deploying MCP Registry to Kubernetes - Support for both local development (minikube) and Azure Kubernetes Service (AKS) - Complete deployment orchestration including: - cluster setup: e.g. you point this at an Azure account, and it can set up and manage the cluster for you. e.g. K8s version, number of nodes, type of nodes, ... - cloud agnostic K8s services: cert-manager, nginx-ingress - app services: MongoDB, and registry application (currently using nginx as a placeholder, blocked on #225 (as is #190). but should be a 1 line change) ## How is this different to #190 - Supports cluster setup and management. This enables: - Non-hosting maintainers managing many devops workflows (e.g. scaling up the cluster, or bumping K8s versions). Without this, we'd need to bug/page the organisation hosting the registry when we need these things changed. - Makes it easy to spin up things like staging/temporary clusters, as well as enables contributors to replicate the stack exactly on their own Azure accounts. - Sets up cloud-agnostic services. For example, rather than using the Azure-managed ingresses and CA, we install nginx-ingress and cert-manager. This enables: - Running the entire infra stack can also run locally (e.g. in minikube, k3s, orbstack, colima) - making it much easier for contributors to test changes to infra stuff. - Moving between cloud providers much more easily, e.g. we could shift from Azure to GCP/AWS/other with minimal hassle. - Everything stays written in Go, rather than Helm templates. This means we get things like type-checking etc. for free (which from my experience makes AI tools wayyy better at editing K8s stuff), and contributors don't need to learn a new language if they're already using Go. ## Testing I've got this running well: - locally in minikube - on cloud in Azure (my personal Azure account) <details><summary>Claude written architecture and security review</summary> <p> ## Deployment Review & Assessment ### Current Architecture Strengths **Pulumi IaC Approach** - Well-structured infrastructure as code using Pulumi - Multi-provider support (AKS, local) with clean abstraction - Good separation of concerns in `pkg/` directory **Security Fundamentals** - Non-root container execution (`appuser` with UID 10001) - Secrets properly managed via Kubernetes secrets - TLS/SSL certificate management with cert-manager and Let's Encrypt ### Critical Issues & High-Priority Improvements **1. Production Deployment Not Ready** 🚨 The registry deployment uses `nginx:alpine` placeholder image instead of the actual MCP registry: - `deploy/pkg/k8s/registry.go:67` - TODO comments indicate incomplete setup - Health probes are commented out - Port mapping doesn't match actual application (80 vs 8080) **Fix:** Build and publish actual registry container image to GHCR, update deployment **2. Database Security Considerations** 🔒 - MongoDB deployed without authentication - No backup/disaster recovery strategy - Database credentials hardcoded *Note: MongoDB is not exposed externally (ClusterIP service), so this is not a critical security risk but should be addressed for production.* **3. Monitoring & Observability Gaps** 📊 - No Prometheus/Grafana monitoring stack - No log aggregation (ELK/Loki) - No application metrics/health dashboards - No alerting configured **4. High Availability & Reliability** ⚠️ - Single MongoDB instance (no replication) - No persistent volume backup strategy - Fixed 10Gi storage without growth planning - Only 2 replicas for registry service - No pod disruption budgets - No horizontal pod autoscaling ### Recommended Improvements **Immediate (High Priority)** 1. Complete Registry Deployment - Build proper container image pipeline, enable health checks 2. Secure MongoDB - Add authentication credentials, implement backup strategy **Medium Priority** 3. Add Monitoring Stack - Prometheus, Grafana deployment 4. Security Hardening (Nice to Have) - RBAC policies, Network Policies, Pod Security Standards 5. CI/CD Pipeline Enhancement - Container image building/publishing, automated deployment **Lower Priority** 6. High Availability - MongoDB replica set, HPA for registry pods 7. Operational Excellence - Kubernetes dashboard, cost optimization ### Configuration Issues - Production config has test credentials: `deploy/Pulumi.prod.yaml:4-5` - Missing environment-specific resource sizing - Hardcoded domain names (`example.com`) The deployment setup shows good architectural foundations but needs significant work before production readiness. The most critical issue is the placeholder nginx container - priority should be completing the actual registry application deployment before addressing the other improvements. Security measures like RBAC and Network Policies are nice to have but not strictly necessary given that MongoDB is not exposed externally. 🤖 Generated with [Claude Code](https://claude.ai/code) </p> </details> ## Metadata Working towards #91 --------- Co-authored-by: Claude <noreply@anthropic.com>
92 lines
4.2 KiB
Modula-2
92 lines
4.2 KiB
Modula-2
module github.com/modelcontextprotocol/registry
|
|
|
|
go 1.24.0
|
|
|
|
require (
|
|
github.com/caarlos0/env/v11 v11.3.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
|
|
github.com/stretchr/testify v1.10.0
|
|
github.com/swaggo/files v1.0.1
|
|
github.com/swaggo/http-swagger v1.3.4
|
|
go.mongodb.org/mongo-driver v1.17.3
|
|
golang.org/x/net v0.39.0
|
|
)
|
|
|
|
require (
|
|
github.com/KyleBanks/depth v1.2.1 // indirect
|
|
github.com/Microsoft/go-winio v0.5.2 // indirect
|
|
github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7 // indirect
|
|
github.com/acomagu/bufpipe v1.0.3 // indirect
|
|
github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da // indirect
|
|
github.com/blang/semver v3.5.1+incompatible // indirect
|
|
github.com/cheggaaa/pb v1.0.18 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/djherbis/times v1.2.0 // indirect
|
|
github.com/emirpasic/gods v1.12.0 // indirect
|
|
github.com/go-git/gcfg v1.5.0 // indirect
|
|
github.com/go-git/go-billy/v5 v5.3.1 // indirect
|
|
github.com/go-git/go-git/v5 v5.4.2 // indirect
|
|
github.com/go-openapi/jsonpointer v0.21.1 // indirect
|
|
github.com/go-openapi/jsonreference v0.21.0 // indirect
|
|
github.com/go-openapi/spec v0.21.0 // indirect
|
|
github.com/go-openapi/swag v0.23.1 // indirect
|
|
github.com/gofrs/uuid v3.3.0+incompatible // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b // indirect
|
|
github.com/golang/protobuf v1.5.2 // indirect
|
|
github.com/golang/snappy v0.0.4 // indirect
|
|
github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
|
|
github.com/hashicorp/errwrap v1.0.0 // indirect
|
|
github.com/hashicorp/go-multierror v1.0.0 // indirect
|
|
github.com/imdario/mergo v0.3.12 // indirect
|
|
github.com/inconshreveable/mousetrap v1.0.0 // indirect
|
|
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
|
|
github.com/josharian/intern v1.0.0 // indirect
|
|
github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351 // indirect
|
|
github.com/klauspost/compress v1.16.7 // indirect
|
|
github.com/mailru/easyjson v0.9.0 // indirect
|
|
github.com/mattn/go-runewidth v0.0.8 // indirect
|
|
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
|
github.com/mitchellh/go-ps v1.0.0 // indirect
|
|
github.com/montanaflynn/stats v0.7.1 // indirect
|
|
github.com/opentracing/basictracer-go v1.0.0 // indirect
|
|
github.com/opentracing/opentracing-go v1.1.0 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/pkg/term v1.1.0 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/pulumi/pulumi-azure-native-sdk v1.104.0 // indirect
|
|
github.com/pulumi/pulumi-azure-native/sdk v1.93.0 // indirect
|
|
github.com/pulumi/pulumi/sdk/v3 v3.51.1 // indirect
|
|
github.com/rivo/uniseg v0.2.0 // indirect
|
|
github.com/rogpeppe/go-internal v1.11.0 // indirect
|
|
github.com/sabhiram/go-gitignore v0.0.0-20180611051255-d3107576ba94 // indirect
|
|
github.com/sergi/go-diff v1.1.0 // indirect
|
|
github.com/spf13/cobra v1.4.0 // indirect
|
|
github.com/spf13/pflag v1.0.5 // indirect
|
|
github.com/stretchr/objx v0.5.2 // indirect
|
|
github.com/swaggo/swag v1.16.4 // indirect
|
|
github.com/texttheater/golang-levenshtein v0.0.0-20191208221605-eb6844b05fc6 // indirect
|
|
github.com/tweekmonster/luser v0.0.0-20161003172636-3fa38070dbd7 // indirect
|
|
github.com/uber/jaeger-client-go v2.22.1+incompatible // indirect
|
|
github.com/uber/jaeger-lib v2.2.0+incompatible // indirect
|
|
github.com/xanzy/ssh-agent v0.3.2 // indirect
|
|
github.com/xdg-go/pbkdf2 v1.0.0 // indirect
|
|
github.com/xdg-go/scram v1.1.2 // indirect
|
|
github.com/xdg-go/stringprep v1.0.4 // indirect
|
|
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
|
|
go.uber.org/atomic v1.6.0 // indirect
|
|
golang.org/x/crypto v0.37.0 // indirect
|
|
golang.org/x/sync v0.13.0 // indirect
|
|
golang.org/x/sys v0.32.0 // indirect
|
|
golang.org/x/term v0.31.0 // indirect
|
|
golang.org/x/text v0.24.0 // indirect
|
|
golang.org/x/tools v0.32.0 // indirect
|
|
google.golang.org/genproto v0.0.0-20200608115520-7c474a2e3482 // indirect
|
|
google.golang.org/grpc v1.51.0 // indirect
|
|
google.golang.org/protobuf v1.27.1 // indirect
|
|
gopkg.in/warnings.v0 v0.1.2 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
lukechampine.com/frand v1.4.2 // indirect
|
|
sourcegraph.com/sourcegraph/appdash v0.0.0-20190731080439-ebfcffb1b5c0 // indirect
|
|
)
|