Merge pull request #161 from matzew/sync-downstream-20260226-1523

NO-JIRA: Sync downstream

Author: openshift-merge-bot[bot]

.github/workflows/mcpchecker.yaml

@@ -9,16 +9,24 @@ on:
   issue_comment:
     types: [created]
 
+  # Automatically run kubevirt evals when kubevirt-related files change
+  pull_request:
+    paths:
+      - 'pkg/toolsets/kubevirt/**'
+      - 'evals/tasks/kubevirt/**'
+      - 'build/kubevirt.mk'
+
   # Allow manual workflow dispatch for testing
   workflow_dispatch:
     inputs:
       suite:
-        description: 'Which task suite to run (kubernetes, kiali, or all)'
+        description: 'Which task suite to run (kubernetes, kubevirt, kiali, or all)'
         required: false
         default: 'kubernetes'
         type: choice
         options:
           - kubernetes
+          - kubevirt
           - kiali
           - all
       task-filter:
@@ -59,12 +67,14 @@ jobs:
     if: |
       github.event_name == 'schedule' ||
       github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'pull_request' ||
       (github.event_name == 'issue_comment' &&
        github.event.issue.pull_request &&
        contains(github.event.comment.body, '/run-mcpchecker'))
     outputs:
       should-run: ${{ steps.check.outputs.should-run }}
       kiali-run: ${{ steps.check.outputs.kiali-run }}
+      kubevirt-run: ${{ steps.check.outputs.kubevirt-run }}
       label-selector: ${{ steps.check.outputs.label-selector }}
       pr-number: ${{ steps.check.outputs.pr-number }}
       pr-sha: ${{ steps.check.outputs.pr-sha }}
@@ -94,25 +104,33 @@ jobs:
               echo "should-run=false" >> $GITHUB_OUTPUT
               echo "User ${{ github.event.comment.user.login }} does not have permission to trigger evaluations"
             fi
+          elif [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "should-run=true" >> $GITHUB_OUTPUT
+            echo "is-pr=true" >> $GITHUB_OUTPUT
+            echo "pr-number=${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
+            echo "pr-sha=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
           else
             echo "should-run=true" >> $GITHUB_OUTPUT
             echo "is-pr=false" >> $GITHUB_OUTPUT
             echo "pr-sha=${{ github.sha }}" >> $GITHUB_OUTPUT
           fi
 
           # Suite selection:
+          # - For pull_request, always run kubevirt (triggered by kubevirt path changes).
           # - For workflow_dispatch, use the provided input.
           # - For other triggers (schedule/issue_comment), default to kubernetes.
           SUITE="${{ github.event.inputs.suite || 'kubernetes' }}"
           TASK_FILTER="${{ github.event.inputs.task-filter || '' }}"
 
-          if [[ "${{ github.event_name }}" == "issue_comment" ]]; then
-            # Parse comment: /run-mcpchecker [suite]. Suite = kubernetes | kiali | all
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            SUITE_INPUT="kubevirt"
+          elif [[ "${{ github.event_name }}" == "issue_comment" ]]; then
+            # Parse comment: /run-mcpchecker [suite]. Suite = kubernetes | kubevirt | kiali | all
             COMMENT_BODY="${{ github.event.comment.body }}"
             COMMENT_BODY="${COMMENT_BODY//[[:space:]]/ }"
             read -r _ FIRST_WORD _ <<< "$COMMENT_BODY"
             case "${FIRST_WORD,,}" in
-              kiali|all)
+              kubevirt|kiali|all)
                 SUITE_INPUT="${FIRST_WORD,,}"
                 ;;
               kubernetes)
@@ -127,17 +145,25 @@ jobs:
           # Select label-selector and infrastructure based on suite
           # All suites use the same eval.yaml file; suite controls label-selector + infra.
           case "$SUITE" in
+            kubevirt)
+              echo "label-selector=suite=kubevirt" >> $GITHUB_OUTPUT
+              echo "kiali-run=false" >> $GITHUB_OUTPUT
+              echo "kubevirt-run=true" >> $GITHUB_OUTPUT
+              ;;
             kiali)
               echo "label-selector=suite=kiali" >> $GITHUB_OUTPUT
               echo "kiali-run=true" >> $GITHUB_OUTPUT
+              echo "kubevirt-run=false" >> $GITHUB_OUTPUT
               ;;
             all)
               echo "label-selector=" >> $GITHUB_OUTPUT  # No filter: run all taskSets
               echo "kiali-run=true" >> $GITHUB_OUTPUT
+              echo "kubevirt-run=true" >> $GITHUB_OUTPUT
               ;;
             *)
               echo "label-selector=suite=kubernetes" >> $GITHUB_OUTPUT
               echo "kiali-run=false" >> $GITHUB_OUTPUT
+              echo "kubevirt-run=false" >> $GITHUB_OUTPUT
               ;;
           esac
 
@@ -168,10 +194,20 @@ jobs:
         if: needs.check-trigger.outputs.kiali-run == 'true'
         run: make setup-kiali
 
+      - name: Install KubeVirt
+        if: needs.check-trigger.outputs.kubevirt-run == 'true'
+        run: make kubevirt-install
+
       - name: Start MCP server
         run: make run-server
         env:
-          TOOLSETS: ${{ needs.check-trigger.outputs.kiali-run == 'true' && 'kiali' || '' }}
+          TOOLSETS: >-
+            ${{
+              (needs.check-trigger.outputs.kiali-run == 'true' && needs.check-trigger.outputs.kubevirt-run == 'true' && 'kiali,kubevirt') ||
+              (needs.check-trigger.outputs.kiali-run == 'true' && 'kiali') ||
+              (needs.check-trigger.outputs.kubevirt-run == 'true' && 'kubevirt') ||
+              ''
+            }}
 
       - name: Run mcpchecker evaluation
         id: mcpchecker

README.md

@@ -46,8 +46,9 @@ If you're using the native binaries you don't need to have Node or Python instal
 - **✅ High-Performance / Low-Latency**: Directly interacts with the Kubernetes API server without the overhead of calling and waiting for external commands.
 - **✅ Multi-Cluster**: Can interact with multiple Kubernetes clusters simultaneously (as defined in your kubeconfig files).
 - **✅ Cross-Platform**: Available as a native binary for Linux, macOS, and Windows, as well as an npm package, a Python package, and container/Docker image.
-- **✅ Configurable**: Supports [command-line arguments](#configuration)  to configure the server behavior.
+- **✅ Configurable**: Supports [command-line arguments](#configuration), [TOML configuration files](docs/configuration.md), and environment variables.
 - **✅ Well tested**: The server has an extensive test suite to ensure its reliability and correctness across different Kubernetes environments.
+- **📚 Documentation**: Comprehensive [user documentation](docs/) including setup guides, configuration reference, and observability.
 
 ## 🚀 Getting Started <a id="getting-started"></a>
 
@@ -199,7 +200,9 @@ uvx kubernetes-mcp-server@latest --help
 | `--stateless`             | If set, the MCP server will run in stateless mode, disabling tool and prompt change notifications. This is useful for container deployments, load balancing, and serverless environments where maintaining client state is not desired.                                                       |
 | `--toolsets`              | Comma-separated list of toolsets to enable. Check the [🛠️ Tools and Functionalities](#tools-and-functionalities) section for more information.                                                                                                                                                |
 | `--disable-multi-cluster` | If set, the MCP server will disable multi-cluster support and will only use the current context from the kubeconfig file. This is useful if you want to restrict the MCP server to a single cluster.                                                                                          |
-| `--cluster-provider`.     | Cluster provider strategy to use (one of: kubeconfig, in-cluster, kcp, disabled). If not set, the server will auto-detect based on the environment.                                                                                                                                           |
+| `--cluster-provider`      | Cluster provider strategy to use (one of: kubeconfig, in-cluster, kcp, disabled). If not set, the server will auto-detect based on the environment.                                                                                                                                           |
+
+> **Note**: Most CLI options have equivalent TOML configuration fields. The `--disable-multi-cluster` flag is equivalent to setting `cluster_provider_strategy = "disabled"` in TOML. See the [Configuration Reference](docs/configuration.md) for all TOML options.
 
 ### TOML Configuration Files
 
@@ -216,6 +219,12 @@ log_level = 2
 read_only = true
 toolsets = ["core", "config", "helm", "kubevirt"]
 
+# Deny access to sensitive resources
+[[denied_resources]]
+group = ""
+version = "v1"
+kind = "Secret"
+
 [telemetry]
 endpoint = "http://localhost:4317"
 ```
@@ -224,8 +233,10 @@ For comprehensive TOML configuration documentation, including:
 - All configuration options and their defaults
 - Drop-in configuration files for modular settings
 - Dynamic configuration reload via SIGHUP
+- Denied resources for restricting access to sensitive resource types
 - Server instructions for MCP Tool Search
-- Custom MCP prompts
+- [Custom MCP prompts](docs/prompts.md)
+- [OAuth/OIDC authentication](docs/KEYCLOAK_OIDC_SETUP.md) for HTTP mode
 
 See the **[Configuration Reference](docs/configuration.md)**.
 
@@ -255,9 +266,8 @@ The following sets of tools are available (toolsets marked with ✓ in the Defau
 | core          | Most common tools for Kubernetes management (Pods, Generic Resources, Events, etc.)                                                                             | ✓       |
 | helm          | Tools for managing Helm charts and releases                                                                                                                     | ✓       |
 | kcp           | Manage kcp workspaces and multi-tenancy features                                                                                                                |         |
-| openshift     | OpenShift-specific tools for cluster management and troubleshooting, check the [OpenShift documentation](docs/OPENSHIFT.md) for more details.                   |         |
 | kubevirt      | KubeVirt virtual machine management tools                                                                                                                       |         |
-| observability | Cluster observability tools for querying Prometheus metrics and Alertmanager alerts                                                                             | ✓       |
+| observability | Cluster observability tools for querying Prometheus metrics and Alertmanager alerts                                                                             |         |
 | ossm          | Most common tools for managing OSSM, check the [OSSM documentation](https://github.com/openshift/openshift-mcp-server/blob/main/docs/OSSM.md) for more details. |         |
 
 <!-- AVAILABLE-TOOLSETS-END -->
@@ -554,25 +564,6 @@ Common use cases:
 
 </details>
 
-<details>
-
-<summary>openshift</summary>
-
-- **plan_mustgather** - Plan for collecting a must-gather archive from an OpenShift cluster, must-gather is a tool for collecting cluster data related to debugging and troubleshooting like logs, kubernetes resources, etc.
-  - `node_name` (`string`) - Optional node to run the mustgather pod. If not provided, a random control-plane node will be selected automatically
-  - `node_selector` (`string`) - Optional node label selector to use, only relevant when specifying a command and image which needs to capture data on a set of cluster nodes simultaneously
-  - `host_network` (`boolean`) - Optionally run the must-gather pods in the host network of the node. This is only relevant if a specific gather image needs to capture host-level data
-  - `gather_command` (`string`) - Optionally specify a custom gather command to run a specialized script, eg. /usr/bin/gather_audit_logs (default: /usr/bin/gather)
-  - `all_component_images` (`boolean`) - Optional when enabled, collects and runs multiple must gathers for all operators and components on the cluster that have an annotated must-gather image available
-  - `images` (`array`) - Optional list of images to use for gathering custom information about specific operators or cluster components. If not specified, OpenShift's default must-gather image will be used by default
-  - `source_dir` (`string`) - Optional to set a specific directory where the pod will copy gathered data from (default: /must-gather)
-  - `timeout` (`string`) - Timeout of the gather process eg. 30s, 6m20s, or 2h10m30s
-  - `namespace` (`string`) - Optional to specify an existing privileged namespace where must-gather pods should run. If not provided, a temporary namespace will be created
-  - `keep_resources` (`boolean`) - Optional to retain all temporary resources when the mustgather completes, otherwise temporary resources created will be advised to be cleaned up
-  - `since` (`string`) - Optional to collect logs newer than a relative duration like 5s, 2m5s, or 3h6m10s. If unspecified, all available logs will be collected
-
-</details>
-
 
 <!-- AVAILABLE-TOOLSETS-TOOLS-END -->
 
@@ -605,7 +596,13 @@ Common use cases:
 
 ## Helm Chart
 
-A [Helm Chart](https://helm.sh) is available to simplify the deployment of the Kubernetes MCP server. Additional details can be found in the [chart README](./charts/kubernetes-mcp-server/README.md).
+A [Helm Chart](https://helm.sh) is available to simplify the deployment of the Kubernetes MCP server.
+
+```shell
+helm install kubernetes-mcp-server oci://ghcr.io/containers/charts/kubernetes-mcp-server
+```
+
+For configuration options including OAuth, telemetry, and resource limits, see the [chart README](./charts/kubernetes-mcp-server/README.md) and [values.yaml](./charts/kubernetes-mcp-server/values.yaml).
 
 ## 🧑‍💻 Development <a id="development"></a>
 

docs/configuration.md

@@ -259,7 +259,7 @@ Toolsets group related tools together. Enable only the toolsets you need to redu
 | helm          | Tools for managing Helm charts and releases                                                                                                                     | ✓       |
 | kcp           | Manage kcp workspaces and multi-tenancy features                                                                                                                |         |
 | kubevirt      | KubeVirt virtual machine management tools                                                                                                                       |         |
-| observability | Cluster observability tools for querying Prometheus metrics and Alertmanager alerts                                                                             | ✓       |
+| observability | Cluster observability tools for querying Prometheus metrics and Alertmanager alerts                                                                             |         |
 | ossm          | Most common tools for managing OSSM, check the [OSSM documentation](https://github.com/openshift/openshift-mcp-server/blob/main/docs/OSSM.md) for more details. |         |
 
 <!-- AVAILABLE-TOOLSETS-END -->

evals/claude-code/eval.yaml

@@ -43,6 +43,16 @@ config:
             toolPattern: "helm_.*"
         minToolCalls: 1
         maxToolCalls: 10
+    # KubeVirt tasks
+    - glob: ../tasks/kubevirt/*/*.yaml
+      labelSelector:
+        suite: kubevirt
+      assertions:
+        toolsUsed:
+          - server: kubernetes
+            toolPattern: ".*"
+        minToolCalls: 1
+        maxToolCalls: 20
     # Kiali tasks
     - glob: ../tasks/*/*/*.yaml
       labelSelector:

evals/openai-agent/eval.yaml

@@ -43,6 +43,16 @@ config:
             toolPattern: "helm_.*"
         minToolCalls: 1
         maxToolCalls: 10
+    # KubeVirt tasks
+    - glob: ../tasks/kubevirt/*/*.yaml
+      labelSelector:
+        suite: kubevirt
+      assertions:
+        toolsUsed:
+          - server: kubernetes
+            toolPattern: ".*"
+        minToolCalls: 1
+        maxToolCalls: 20
     # Kiali tasks
     - glob: ../tasks/*/*/*.yaml
       labelSelector:

evals/tasks/kubernetes/fix-service-with-no-endpoints/fix-service-with-no-endpoints.yaml

@@ -12,4 +12,4 @@ steps:
   cleanup:
     file: cleanup.sh
   prompt:
-    inline: "Our frontend application in the webshop-frontend namespace is reporting connection errors. The logs show: 'Error: connection to web-app-service.webshop-frontend.svc.cluster.local failed: connection refused'. Can you help diagnose and fix this issue?"
+    inline: "Our frontend application in the webshop-frontend namespace is reporting connection errors. The logs show: 'Error: connection to web-app-service.webshop-frontend.svc.cluster.local failed: connection refused'. Can you help diagnose why pods aren't running and fix the deployment?"

evals/tasks/kubernetes/multi-container-pod-communication/multi-container-pod-communication.yaml

@@ -17,5 +17,6 @@ steps:
       1. A 'web-server' nginx instance that serves traffic
       2. A 'logger' busybox instance that processes those logs from a shared volume, 'logs-volume' with 'tail -f /var/log/nginx/access.log'
 
+      Both containers should be defined in spec.containers (not as init containers or sidecars).
       Both containers should mount logs-volume at '/var/log/nginx'.
-      The logger should only start once the web server is ready. The pod should be considered ready when the web server is serving traffic.
+      The pod should be considered ready when the web server is serving traffic.

pkg/config/config_default.go

@@ -6,26 +6,24 @@ import (
 	"github.com/BurntSushi/toml"
 )
 
-func Default() *StaticConfig {
-	defaultConfig := StaticConfig{
+// BaseDefault returns the upstream base defaults before any
+// build-time overrides are applied. This is useful for understanding
+// the raw upstream configuration independent of downstream customization.
+func BaseDefault() *StaticConfig {
+	return &StaticConfig{
 		ListOutput: "table",
 		Toolsets:   []string{"core", "config", "helm"},
 	}
-	overrides := defaultOverrides()
-	mergedConfig := mergeConfig(defaultConfig, overrides)
-	return &mergedConfig
 }
 
-// HasDefaultOverrides indicates whether the internal defaultOverrides function
-// provides any overrides or an empty StaticConfig.
-func HasDefaultOverrides() bool {
+// Default returns the effective default configuration, with any
+// downstream build-time overrides (from defaultOverrides) merged
+// on top of the base defaults.
+func Default() *StaticConfig {
+	base := BaseDefault()
 	overrides := defaultOverrides()
-	var buf bytes.Buffer
-	if err := toml.NewEncoder(&buf).Encode(overrides); err != nil {
-		// If marshaling fails, assume no overrides
-		return false
-	}
-	return len(bytes.TrimSpace(buf.Bytes())) > 0
+	merged := mergeConfig(*base, overrides)
+	return &merged
 }
 
 // mergeConfig applies non-zero values from override to base using TOML serialization