# Credentials from Secrets and ConfigMaps
# =======================================
# Environment wiring is the part of a server the operator genuinely owns: it
# builds the workload, so `env` with `secretKeyRef` / `configMapKeyRef` is
# resolved by Kubernetes exactly as it is for a Deployment.

apiVersion: mcp-hangar.io/v1alpha2
kind: MCPServer
metadata:
  name: github-tools
  namespace: mcp-servers
  labels:
    app.kubernetes.io/name: github-tools
    mcp-hangar.io/category: vcs
spec:
  mode: container
  image: ghcr.io/modelcontextprotocol/mcp-github:latest

  # Cold start: no workload until something asks for it.
  replicas: 0

  env:
    # From a Secret
    - name: GITHUB_TOKEN
      valueFrom:
        secretKeyRef:
          name: github-credentials
          key: token

    # From a ConfigMap
    - name: GITHUB_ORG
      valueFrom:
        configMapKeyRef:
          name: github-config
          key: organization

    # Literal value
    - name: LOG_LEVEL
      value: "info"

  capabilities:
    network:
      egress:
        - host: api.github.com
          port: 443
          protocol: https
      dnsAllowed: true
    enforcementMode: alert

---
# Secret for the GitHub token
apiVersion: v1
kind: Secret
metadata:
  name: github-credentials
  namespace: mcp-servers
type: Opaque
stringData:
  token: "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

---
# ConfigMap for non-secret configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: github-config
  namespace: mcp-servers
data:
  organization: "my-org"

# ---------------------------------------------------------------------------
# Not fields on this CR, deliberately
# ---------------------------------------------------------------------------
# This example used to declare a `tools` allow-list with a per-minute rate
# limit, and a `circuitBreaker`. The operator read none of them
# (mcp-hangar/mcp-hangar-operator#112) -- which matters here, because an
# allow-list that is silently ignored reads as a security control and is not
# one. Both belong to Hangar, where the calls actually pass through:
#
#   * tool allow/deny lists and rate limits -> tool-access policy, `config.yaml`
#                                              or the REST API
#   * circuit breaking                      -> `config.yaml` on the gateway