# MCPServerGroup: a health view over a set of servers
# ===================================================
# An `MCPServerGroup` selects `MCPServer`s by label and aggregates their health
# into one status. That is all it does.
#
# It is NOT a load balancer. This example used to declare
# `strategy: LeastConnections`, a `failover` block with retries, and session
# affinity -- none of which the operator ever read. Load balancing, failover and
# retry policy are Hangar's, configured on a group in `config.yaml` or over the
# REST API, because they are runtime routing decisions and the operator is not
# on the request path.

apiVersion: mcp-hangar.io/v1alpha2
kind: MCPServerGroup
metadata:
  name: database-tools-ha
  namespace: mcp-servers
spec:
  # Which servers belong to the group.
  selector:
    matchLabels:
      mcp-hangar.io/category: database

  # When the group as a whole counts as healthy. The controller writes
  # readyCount / degradedCount / deadCount and a condition onto `.status`;
  # nothing here changes how traffic is routed.
  healthPolicy:
    minHealthyPercentage: 50
    unhealthyThreshold: 3

---
# The members. Each is an ordinary MCPServer carrying the group's label.

apiVersion: mcp-hangar.io/v1alpha2
kind: MCPServer
metadata:
  name: postgres-tools
  namespace: mcp-servers
  labels:
    mcp-hangar.io/category: database
spec:
  mode: container
  image: ghcr.io/modelcontextprotocol/mcp-postgres:latest
  replicas: 2
  env:
    - name: POSTGRES_URL
      valueFrom:
        secretKeyRef:
          name: postgres-credentials
          key: url
  capabilities:
    network:
      egress:
        - host: postgres.databases.svc.cluster.local
          port: 5432
          protocol: tcp
      dnsAllowed: true
    enforcementMode: alert

---
apiVersion: mcp-hangar.io/v1alpha2
kind: MCPServer
metadata:
  name: sqlite-tools-replica
  namespace: mcp-servers
  labels:
    mcp-hangar.io/category: database
spec:
  mode: container
  image: ghcr.io/modelcontextprotocol/mcp-sqlite:latest
  replicas: 1
  capabilities:
    network:
      egress: []
      dnsAllowed: false
    enforcementMode: alert