MCPRemoteProxy
MCPRemoteProxy fronts a remote MCP server (reachable over HTTPS) with the same authentication, telemetry, and tool-filtering features that the operator applies to containerized servers. Use this when you want to apply ToolHive policies to a third-party hosted MCP endpoint.
API: toolhive.stacklok.dev/v1beta1
· Scope: Namespaced · Short names: rp, mcprp
Example
apiVersion: toolhive.stacklok.dev/v1beta1
kind: MCPRemoteProxy
metadata:
name: my-mcpremoteproxy
namespace: default
spec:
remoteUrl: https://example.com
Schema
spec
MCPRemoteProxySpec defines the desired state of MCPRemoteProxy
| Field | Type | Description |
|---|---|---|
allowPrivateEndpoint | boolean | AllowPrivateEndpoint permits RemoteURL to point at a private or in-cluster endpoint: RFC 1918 and IPv6 unique-local addresses, and hostnames ending in "cluster.local". (Bare ".svc" hostnames are never blocked, since no DNS resolution is performed.) Enable this to reach a co-located in-cluster backend in-mesh so the backend's workload-identity authorization policy still applies. Loopback, link-local, cloud-metadata, and kubernetes.default endpoints remain blocked regardless of this setting. default false |
audit | object | Audit defines audit logging configuration for the proxy |
authServerRef | object | AuthServerRef optionally references a resource that configures an embedded OAuth 2.0/OIDC authorization server to authenticate MCP clients. Currently the only supported kind is MCPExternalAuthConfig (type: embeddedAuthServer). |
authzConfig | object | AuthzConfig defines authorization policy configuration for the proxy. AuthzConfig and AuthzConfigRef are mutually exclusive. |
authzConfigRef | object | AuthzConfigRef references a shared MCPAuthzConfig resource for authorization. The referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy. Mutually exclusive with authzConfig. |
endpointPrefix | string | EndpointPrefix is the path prefix to prepend to SSE endpoint URLs. This is used to handle path-based ingress routing scenarios where the ingress strips a path prefix before forwarding to the backend. |
externalAuthConfigRef | object | ExternalAuthConfigRef references a MCPExternalAuthConfig resource for token exchange. When specified, the proxy will exchange validated incoming tokens for remote service tokens. The referenced MCPExternalAuthConfig must exist in the same namespace as this MCPRemoteProxy. |
groupRef | object | GroupRef references the MCPGroup this proxy belongs to. The referenced MCPGroup must be in the same namespace. |
headerForward | object | HeaderForward configures headers to inject into requests to the remote MCP server. Use this to add custom headers like X-Tenant-ID or correlation IDs. |
oidcConfigRef | object | OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication. The referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy. Per-server overrides (audience, scopes) are specified here; shared provider config lives in the MCPOIDCConfig resource. SECURITY: if this field is omitted and no other authentication source is configured, the proxy runs UNAUTHENTICATED. It accepts every request that can reach its port and forwards it to the remote MCP server under a synthetic local-user identity, with no token or credential check. Set this field to enforce identity-based access control per request. |
podTemplateSpec | object | PodTemplateSpec defines the pod template to use for the MCPRemoteProxy This allows for customizing the pod configuration beyond what is provided by the other fields. Note that to modify the specific container the remote proxy runs in, you must specify the `toolhive` container name in the PodTemplateSpec. This field accepts a PodTemplateSpec object as JSON/YAML. |
proxyPort | integer | ProxyPort is the port to expose the MCP proxy on default 8080 · format int32 · min 1 · max 65535 |
remoteUrlrequired | string | RemoteURL is the URL of the remote MCP server to proxy pattern ^https?:// |
replicas | integer | Replicas is the desired number of proxy pod replicas. MCPRemoteProxy creates a single Deployment for the proxy process, so there is only one replicas field (mirrors VirtualMCPServer.spec.replicas). When nil, the operator does not set Deployment.Spec.Replicas, leaving replica management to an HPA or other external controller. When set above 1, also configure sessionStorage with the redis provider and sessionAffinity: "None" so sessions resolve across replicas; otherwise a SessionStorageWarning condition is surfaced on the resource status. format int32 · min 0 |
resourceOverrides | object | ResourceOverrides allows overriding annotations and labels for resources created by the operator |
resources | object | Resources defines the resource requirements for the proxy container |
serviceAccount | string | ServiceAccount is the name of an already existing service account to use by the proxy. If not specified, a ServiceAccount will be created automatically and used by the proxy. |
sessionAffinity | string | SessionAffinity controls whether the Service routes repeated client connections to the same pod. MCP protocols (SSE, streamable-http) are stateful, so ClientIP is the default. Set to "None" for stateless servers or when using an external load balancer with its own affinity. Interaction with sessionStorage: when running multiple replicas with sessionStorage.provider "redis", set this to "None" so requests are distributed across replicas and sessions resolve via the shared store. Conversely, "None" without Redis-backed sessionStorage breaks session continuity — any request landing on a different pod fails with "Session not found". default "ClientIP" · enum: ClientIP | None |
sessionStorage | object | SessionStorage configures session storage for stateful horizontal scaling. When nil, no session storage is configured and the proxy falls back to pod-local in-memory session state — incompatible with multi-replica deployments behind load balancers that don't preserve client-IP affinity (e.g. AWS ALB across multiple AZs). The transparent proxy validates `Mcp-Session-Id` against this store on every non-initialize request (see pkg/transport/proxy/transparent/ transparent_proxy.go) and rewrites client-facing session IDs to backend session IDs using session metadata. Both lookups require shared state across replicas. When using the Redis provider, also set sessionAffinity to "None" so the Service routes requests round-robin and all replicas rely on the shared session store rather than pod-local state. Mirrors MCPServer.spec.sessionStorage and VirtualMCPServer.spec.sessionStorage. |
telemetryConfigRef | object | TelemetryConfigRef references an MCPTelemetryConfig resource for shared telemetry configuration. The referenced MCPTelemetryConfig must exist in the same namespace as this MCPRemoteProxy. Cross-namespace references are not supported for security and isolation reasons. |
toolConfigRef | object | ToolConfigRef references a MCPToolConfig resource for tool filtering and renaming. The referenced MCPToolConfig must exist in the same namespace as this MCPRemoteProxy. Cross-namespace references are not supported for security and isolation reasons. If specified, this allows filtering and overriding tools from the remote MCP server. |
transport | string | Transport is the transport method for the remote proxy (sse or streamable-http) default "streamable-http" · enum: sse | streamable-http |
trustProxyHeaders | boolean | TrustProxyHeaders indicates whether to trust X-Forwarded-* headers from reverse proxies When enabled, the proxy will use X-Forwarded-Proto, X-Forwarded-Host, X-Forwarded-Port, and X-Forwarded-Prefix headers to construct endpoint URLs default false |
spec.audit
Audit defines audit logging configuration for the proxy
| Field | Type | Description |
|---|---|---|
enabled | boolean | Enabled controls whether audit logging is enabled When true, enables audit logging with default configuration default false |
spec.authServerRef
AuthServerRef optionally references a resource that configures an embedded OAuth 2.0/OIDC authorization server to authenticate MCP clients. Currently the only supported kind is MCPExternalAuthConfig (type: embeddedAuthServer).
| Field | Type | Description |
|---|---|---|
kindrequired | string | Kind identifies the type of the referenced resource. default "MCPExternalAuthConfig" · enum: MCPExternalAuthConfig |
namerequired | string | Name is the name of the referenced resource in the same namespace. minLength 1 |
spec.authzConfig
AuthzConfig defines authorization policy configuration for the proxy. AuthzConfig and AuthzConfigRef are mutually exclusive.
| Field | Type | Description |
|---|---|---|
configMap | object | ConfigMap references a ConfigMap containing authorization configuration Only used when Type is "configMap" |
groupClaimName | string | GroupClaimName is the JWT claim key that contains group membership for the principal. When set, takes priority over the well-known defaults ("groups", "roles", "cognito:groups"). Use this for IDPs that place groups under a URI-style claim (e.g. "https://example.com/groups"). When Type is "configMap", a group_claim_name entry in the referenced ConfigMap is overridden by this field if both are set. maxLength 253 |
groupEntityType | string | GroupEntityType is the Cedar entity type name used for principal parent UIDs synthesised from JWT group/role claims. Defaults to "THVGroup" when empty. Must match the entity type used in the static entity store for transitive `in` checks (e.g. `ClaimGroup → PlatformRole`) to resolve. Namespaced names (`Foo::Bar`) are not yet supported. When Type is "configMap", a group_entity_type entry in the referenced ConfigMap is overridden by this field if both are set. pattern ^[A-Za-z_][A-Za-z0-9_]*$ · maxLength 63 |
inline | object | Inline contains direct authorization configuration Only used when Type is "inline" |
roleClaimName | string | RoleClaimName is the JWT claim key that contains role membership for the principal. When set, the claim is extracted separately from GroupClaimName and both are mapped to the configured GroupEntityType. When Type is "configMap", a role_claim_name entry in the referenced ConfigMap is overridden by this field if both are set. maxLength 253 |
typerequired | string | Type is the type of authorization configuration default "configMap" · enum: configMap | inline |
spec.authzConfig.configMap
ConfigMap references a ConfigMap containing authorization configuration Only used when Type is "configMap"
| Field | Type | Description |
|---|---|---|
key | string | Key is the key in the ConfigMap that contains the authorization configuration default "authz.json" |
namerequired | string | Name is the name of the ConfigMap |
spec.authzConfig.inline
Inline contains direct authorization configuration Only used when Type is "inline"
| Field | Type | Description |
|---|---|---|
entitiesJson | string | EntitiesJSON is a JSON string representing Cedar entities. Required when transitive policies (e.g. `ClaimGroup → PlatformRole`) need a static entity store; defaults to "[]". default "[]" |
policiesrequired | string[] | Policies is a list of Cedar policy strings |
primaryUpstreamProvider | string | PrimaryUpstreamProvider names the upstream IDP whose access token's claims Cedar should evaluate. Deprecated: on VirtualMCPServer this field has moved to spec.authServerConfig.primaryUpstreamProvider. The old location is still read for one release for backward compatibility; the VirtualMCPServer controller emits an AuthzPrimaryUpstreamProviderDeprecated Warning event whenever it is consumed, and removal is planned for the release after the deprecation cycle. On MCPServer and MCPRemoteProxy this field has always been a structural no-op (those CRDs do not run an embedded auth server). Setting it continues to surface the AuthzPrimaryUpstreamProviderIgnored advisory condition; the deprecation does not change that behaviour. pattern ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ · minLength 1 · maxLength 63 |
spec.authzConfigRef
AuthzConfigRef references a shared MCPAuthzConfig resource for authorization. The referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy. Mutually exclusive with authzConfig.
| Field | Type | Description |
|---|---|---|
namerequired | string | Name is the name of the MCPAuthzConfig resource in the same namespace. minLength 1 |
spec.externalAuthConfigRef
ExternalAuthConfigRef references a MCPExternalAuthConfig resource for token exchange. When specified, the proxy will exchange validated incoming tokens for remote service tokens. The referenced MCPExternalAuthConfig must exist in the same namespace as this MCPRemoteProxy.
| Field | Type | Description |
|---|---|---|
namerequired | string | Name is the name of the MCPExternalAuthConfig resource |
spec.groupRef
GroupRef references the MCPGroup this proxy belongs to. The referenced MCPGroup must be in the same namespace.
| Field | Type | Description |
|---|---|---|
namerequired | string | Name is the name of the MCPGroup resource in the same namespace minLength 1 |
spec.headerForward
HeaderForward configures headers to inject into requests to the remote MCP server. Use this to add custom headers like X-Tenant-ID or correlation IDs.
| Field | Type | Description |
|---|---|---|
addHeadersFromSecret | object[] | AddHeadersFromSecret references Kubernetes Secrets for sensitive header values. |
addPlaintextHeaders | map<string, string> | AddPlaintextHeaders is a map of header names to literal values to inject into requests. WARNING: Values are stored in plaintext and visible via kubectl commands. Use addHeadersFromSecret for sensitive data like API keys or tokens. |
spec.headerForward.addHeadersFromSecret[]
AddHeadersFromSecret references Kubernetes Secrets for sensitive header values.
| Field | Type | Description |
|---|---|---|
headerNamerequired | string | HeaderName is the HTTP header name (e.g., "X-API-Key") minLength 1 · maxLength 255 |
valueSecretRefrequired | object | ValueSecretRef references the Secret and key containing the header value |
spec.headerForward.addHeadersFromSecret.valueSecretRef
ValueSecretRef references the Secret and key containing the header value
| Field | Type | Description |
|---|---|---|
keyrequired | string | Key is the key within the secret |
namerequired | string | Name is the name of the secret |
spec.oidcConfigRef
OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication. The referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy. Per-server overrides (audience, scopes) are specified here; shared provider config lives in the MCPOIDCConfig resource. SECURITY: if this field is omitted and no other authentication source is configured, the proxy runs UNAUTHENTICATED. It accepts every request that can reach its port and forwards it to the remote MCP server under a synthetic local-user identity, with no token or credential check. Set this field to enforce identity-based access control per request.
| Field | Type | Description |
|---|---|---|
audiencerequired | string | Audience is the expected audience for token validation. This MUST be unique per server to prevent token replay attacks. minLength 1 |
namerequired | string | Name is the name of the MCPOIDCConfig resource minLength 1 |
resourceUrl | string | ResourceURL is the public URL for OAuth protected resource metadata (RFC 9728). When the server is exposed via Ingress or gateway, set this to the external URL that MCP clients connect to. If not specified, defaults to the internal Kubernetes service URL. |
scopes | string[] | Scopes is the list of OAuth scopes to advertise in the well-known endpoint (RFC 9728). If empty, defaults to ["openid"]. |
spec.resourceOverrides
ResourceOverrides allows overriding annotations and labels for resources created by the operator
| Field | Type | Description |
|---|---|---|
proxyDeployment | object | ProxyDeployment defines overrides for the Proxy Deployment resource (toolhive proxy) |
proxyService | object | ProxyService defines overrides for the Proxy Service resource (points to the proxy deployment) |
spec.resourceOverrides.proxyDeployment
ProxyDeployment defines overrides for the Proxy Deployment resource (toolhive proxy)
| Field | Type | Description |
|---|---|---|
affinity | object | Affinity sets node/pod affinity and anti-affinity for the proxy pod. On MCPRemoteProxy, spec.podTemplateSpec also reaches the proxy pod: the two are merged per sub-field, and podTemplateSpec wins on sub-fields set in both. |
annotations | map<string, string> | Annotations to add or override on the resource |
env | object[] | Env are environment variables to set in the proxy container (thv run process) These affect the toolhive proxy itself, not the MCP server it manages Use TOOLHIVE_DEBUG=true to enable debug logging in the proxy |
imagePullSecrets | object[] | ImagePullSecrets allows specifying image pull secrets for the proxy runner These are applied to both the Deployment and the ServiceAccount |
labels | map<string, string> | Labels to add or override on the resource |
nodeSelector | map<string, string> | NodeSelector constrains the proxy pod to nodes with matching labels. Mirrors the scheduling control podTemplateSpec gives the MCP server pod, so the proxy can be steered onto the same nodes (e.g. a pre-warmed pool). On MCPRemoteProxy, spec.podTemplateSpec also reaches the proxy pod: the two maps are merged, and podTemplateSpec wins on keys set in both. |
podTemplateMetadataOverrides | object | ResourceMetadataOverrides defines metadata overrides for a resource |
tolerations | object[] | Tolerations allow the proxy pod to schedule onto tainted nodes, such as a dedicated pre-warmed pool. On MCPRemoteProxy, spec.podTemplateSpec also reaches the proxy pod, and this list is atomic: a podTemplateSpec that sets tolerations replaces this field rather than adding to it. |
spec.resourceOverrides.proxyDeployment.affinity
Affinity sets node/pod affinity and anti-affinity for the proxy pod. On MCPRemoteProxy, spec.podTemplateSpec also reaches the proxy pod: the two are merged per sub-field, and podTemplateSpec wins on sub-fields set in both.
| Field | Type | Description |
|---|---|---|
nodeAffinity | object | Describes node affinity scheduling rules for the pod. |
podAffinity | object | Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). |
podAntiAffinity | object | Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). |
spec.resourceOverrides.proxyDeployment.affinity.nodeAffinity
Describes node affinity scheduling rules for the pod.
| Field | Type | Description |
|---|---|---|
preferredDuringSchedulingIgnoredDuringExecution | object[] | The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. |
requiredDuringSchedulingIgnoredDuringExecution | object | If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. |
spec.resourceOverrides.proxyDeployment.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[]
The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.
| Field | Type | Description |
|---|---|---|
preferencerequired | object | A node selector term, associated with the corresponding weight. |
weightrequired | integer | Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. format int32 |
spec.resourceOverrides.proxyDeployment.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution.preference
A node selector term, associated with the corresponding weight.
| Field | Type | Description |
|---|---|---|
matchExpressions | object[] | A list of node selector requirements by node's labels. |
matchFields | object[] | A list of node selector requirements by node's fields. |
spec.resourceOverrides.proxyDeployment.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution.preference.matchExpressions[]
A list of node selector requirements by node's labels.
| Field | Type | Description |
|---|---|---|
keyrequired | string | The label key that the selector applies to. |
operatorrequired | string | Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. |
values | string[] | An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. |
spec.resourceOverrides.proxyDeployment.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution.preference.matchFields[]
A list of node selector requirements by node's fields.
| Field | Type | Description |
|---|---|---|
keyrequired | string | The label key that the selector applies to. |
operatorrequired | string | Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. |
values | string[] | An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. |
spec.resourceOverrides.proxyDeployment.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution
If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.
| Field | Type | Description |
|---|---|---|
nodeSelectorTermsrequired | object[] | Required. A list of node selector terms. The terms are ORed. |
spec.resourceOverrides.proxyDeployment.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[]
Required. A list of node selector terms. The terms are ORed.
| Field | Type | Description |
|---|---|---|
matchExpressions | object[] | A list of node selector requirements by node's labels. |
matchFields | object[] | A list of node selector requirements by node's fields. |
spec.resourceOverrides.proxyDeployment.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms.matchExpressions[]
A list of node selector requirements by node's labels.
| Field | Type | Description |
|---|---|---|
keyrequired | string | The label key that the selector applies to. |
operatorrequired | string | Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. |
values | string[] | An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. |
spec.resourceOverrides.proxyDeployment.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms.matchFields[]
A list of node selector requirements by node's fields.
| Field | Type | Description |
|---|---|---|
keyrequired | string | The label key that the selector applies to. |
operatorrequired | string | Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. |
values | string[] | An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. |
spec.resourceOverrides.proxyDeployment.affinity.podAffinity
Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
| Field | Type | Description |
|---|---|---|
preferredDuringSchedulingIgnoredDuringExecution | object[] | The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. |
requiredDuringSchedulingIgnoredDuringExecution | object[] | If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. |
spec.resourceOverrides.proxyDeployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[]
The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
| Field | Type | Description |
|---|---|---|
podAffinityTermrequired | object | Required. A pod affinity term, associated with the corresponding weight. |
weightrequired | integer | weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format int32 |
spec.resourceOverrides.proxyDeployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution.podAffinityTerm
Required. A pod affinity term, associated with the corresponding weight.
| Field | Type | Description |
|---|---|---|
labelSelector | object | A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. |
matchLabelKeys | string[] | MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. |
mismatchLabelKeys | string[] | MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. |
namespaceSelector | object | A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. |
namespaces | string[] | namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". |
topologyKeyrequired | string | This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. |
spec.resourceOverrides.proxyDeployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution.podAffinityTerm.labelSelector
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
| Field | Type | Description |
|---|---|---|
matchExpressions | object[] | matchExpressions is a list of label selector requirements. The requirements are ANDed. |
matchLabels | map<string, string> | matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. |
spec.resourceOverrides.proxyDeployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution.podAffinityTerm.labelSelector.matchExpressions[]
matchExpressions is a list of label selector requirements. The requirements are ANDed.
| Field | Type | Description |
|---|---|---|
keyrequired | string | key is the label key that the selector applies to. |
operatorrequired | string | operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. |
values | string[] | values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. |
spec.resourceOverrides.proxyDeployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution.podAffinityTerm.namespaceSelector
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
| Field | Type | Description |
|---|---|---|
matchExpressions | object[] | matchExpressions is a list of label selector requirements. The requirements are ANDed. |
matchLabels | map<string, string> | matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. |
spec.resourceOverrides.proxyDeployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution.podAffinityTerm.namespaceSelector.matchExpressions[]
matchExpressions is a list of label selector requirements. The requirements are ANDed.
| Field | Type | Description |
|---|---|---|
keyrequired | string | key is the label key that the selector applies to. |
operatorrequired | string | operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. |
values | string[] | values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. |
spec.resourceOverrides.proxyDeployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[]
If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
| Field | Type | Description |
|---|---|---|
labelSelector | object | A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. |
matchLabelKeys | string[] | MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. |
mismatchLabelKeys | string[] | MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. |
namespaceSelector | object | A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. |
namespaces | string[] | namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". |
topologyKeyrequired | string | This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. |
spec.resourceOverrides.proxyDeployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution.labelSelector
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
| Field | Type | Description |
|---|---|---|
matchExpressions | object[] | matchExpressions is a list of label selector requirements. The requirements are ANDed. |
matchLabels | map<string, string> | matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. |
spec.resourceOverrides.proxyDeployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution.labelSelector.matchExpressions[]
matchExpressions is a list of label selector requirements. The requirements are ANDed.
| Field | Type | Description |
|---|---|---|
keyrequired | string | key is the label key that the selector applies to. |
operatorrequired | string | operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. |
values | string[] | values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. |
spec.resourceOverrides.proxyDeployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution.namespaceSelector
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
| Field | Type | Description |
|---|---|---|
matchExpressions | object[] | matchExpressions is a list of label selector requirements. The requirements are ANDed. |
matchLabels | map<string, string> | matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. |
spec.resourceOverrides.proxyDeployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution.namespaceSelector.matchExpressions[]
matchExpressions is a list of label selector requirements. The requirements are ANDed.
| Field | Type | Description |
|---|---|---|
keyrequired | string | key is the label key that the selector applies to. |
operatorrequired | string | operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. |
values | string[] | values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. |
spec.resourceOverrides.proxyDeployment.affinity.podAntiAffinity
Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
| Field | Type | Description |
|---|---|---|
preferredDuringSchedulingIgnoredDuringExecution | object[] | The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and subtracting "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. |
requiredDuringSchedulingIgnoredDuringExecution | object[] | If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. |
spec.resourceOverrides.proxyDeployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[]
The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and subtracting "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
| Field | Type | Description |
|---|---|---|
podAffinityTermrequired | object | Required. A pod affinity term, associated with the corresponding weight. |
weightrequired | integer | weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format int32 |
spec.resourceOverrides.proxyDeployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution.podAffinityTerm
Required. A pod affinity term, associated with the corresponding weight.
| Field | Type | Description |
|---|---|---|
labelSelector | object | A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. |
matchLabelKeys | string[] | MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. |
mismatchLabelKeys | string[] | MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. |
namespaceSelector | object | A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. |
namespaces | string[] | namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". |
topologyKeyrequired | string | This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. |
spec.resourceOverrides.proxyDeployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution.podAffinityTerm.labelSelector
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
| Field | Type | Description |
|---|---|---|
matchExpressions | object[] | matchExpressions is a list of label selector requirements. The requirements are ANDed. |
matchLabels | map<string, string> | matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. |
spec.resourceOverrides.proxyDeployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution.podAffinityTerm.labelSelector.matchExpressions[]
matchExpressions is a list of label selector requirements. The requirements are ANDed.
| Field | Type | Description |
|---|---|---|
keyrequired | string | key is the label key that the selector applies to. |
operatorrequired | string | operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. |
values | string[] | values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. |
spec.resourceOverrides.proxyDeployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution.podAffinityTerm.namespaceSelector
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
| Field | Type | Description |
|---|---|---|
matchExpressions | object[] | matchExpressions is a list of label selector requirements. The requirements are ANDed. |
matchLabels | map<string, string> | matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. |
spec.resourceOverrides.proxyDeployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution.podAffinityTerm.namespaceSelector.matchExpressions[]
matchExpressions is a list of label selector requirements. The requirements are ANDed.
| Field | Type | Description |
|---|---|---|
keyrequired | string | key is the label key that the selector applies to. |
operatorrequired | string | operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. |
values | string[] | values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. |
spec.resourceOverrides.proxyDeployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[]
If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
| Field | Type | Description |
|---|---|---|
labelSelector | object | A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. |
matchLabelKeys | string[] | MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. |
mismatchLabelKeys | string[] | MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. |
namespaceSelector | object | A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. |
namespaces | string[] | namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". |
topologyKeyrequired | string | This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. |
spec.resourceOverrides.proxyDeployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution.labelSelector
A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.
| Field | Type | Description |
|---|---|---|
matchExpressions | object[] | matchExpressions is a list of label selector requirements. The requirements are ANDed. |
matchLabels | map<string, string> | matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. |
spec.resourceOverrides.proxyDeployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution.labelSelector.matchExpressions[]
matchExpressions is a list of label selector requirements. The requirements are ANDed.
| Field | Type | Description |
|---|---|---|
keyrequired | string | key is the label key that the selector applies to. |
operatorrequired | string | operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. |
values | string[] | values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. |
spec.resourceOverrides.proxyDeployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution.namespaceSelector
A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
| Field | Type | Description |
|---|---|---|
matchExpressions | object[] | matchExpressions is a list of label selector requirements. The requirements are ANDed. |
matchLabels | map<string, string> | matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. |
spec.resourceOverrides.proxyDeployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution.namespaceSelector.matchExpressions[]
matchExpressions is a list of label selector requirements. The requirements are ANDed.
| Field | Type | Description |
|---|---|---|
keyrequired | string | key is the label key that the selector applies to. |
operatorrequired | string | operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. |
values | string[] | values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. |
spec.resourceOverrides.proxyDeployment.env[]
Env are environment variables to set in the proxy container (thv run process) These affect the toolhive proxy itself, not the MCP server it manages Use TOOLHIVE_DEBUG=true to enable debug logging in the proxy
| Field | Type | Description |
|---|---|---|
namerequired | string | Name of the environment variable |
valuerequired | string | Value of the environment variable |
spec.resourceOverrides.proxyDeployment.imagePullSecrets[]
ImagePullSecrets allows specifying image pull secrets for the proxy runner These are applied to both the Deployment and the ServiceAccount
| Field | Type | Description |
|---|---|---|
name | string | Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names default "" |
spec.resourceOverrides.proxyDeployment.podTemplateMetadataOverrides
ResourceMetadataOverrides defines metadata overrides for a resource
| Field | Type | Description |
|---|---|---|
annotations | map<string, string> | Annotations to add or override on the resource |
labels | map<string, string> | Labels to add or override on the resource |
spec.resourceOverrides.proxyDeployment.tolerations[]
Tolerations allow the proxy pod to schedule onto tainted nodes, such as a dedicated pre-warmed pool. On MCPRemoteProxy, spec.podTemplateSpec also reaches the proxy pod, and this list is atomic: a podTemplateSpec that sets tolerations replaces this field rather than adding to it.
| Field | Type | Description |
|---|---|---|
effect | string | Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. |
key | string | Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. |
operator | string | Operator represents a key's relationship to the value. Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). |
tolerationSeconds | integer | TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. format int64 |
value | string | Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. |
spec.resourceOverrides.proxyService
ProxyService defines overrides for the Proxy Service resource (points to the proxy deployment)
| Field | Type | Description |
|---|---|---|
annotations | map<string, string> | Annotations to add or override on the resource |
labels | map<string, string> | Labels to add or override on the resource |
spec.resources
Resources defines the resource requirements for the proxy container
| Field | Type | Description |
|---|---|---|
limits | object | Limits describes the maximum amount of compute resources allowed |
requests | object | Requests describes the minimum amount of compute resources required |
spec.resources.limits
Limits describes the maximum amount of compute resources allowed
| Field | Type | Description |
|---|---|---|
cpu | string | CPU is the CPU limit in cores (e.g., "500m" for 0.5 cores) |
memory | string | Memory is the memory limit in bytes (e.g., "64Mi" for 64 megabytes) |
spec.resources.requests
Requests describes the minimum amount of compute resources required
| Field | Type | Description |
|---|---|---|
cpu | string | CPU is the CPU limit in cores (e.g., "500m" for 0.5 cores) |
memory | string | Memory is the memory limit in bytes (e.g., "64Mi" for 64 megabytes) |
spec.sessionStorage
SessionStorage configures session storage for stateful horizontal scaling. When nil, no session storage is configured and the proxy falls back to pod-local in-memory session state — incompatible with multi-replica deployments behind load balancers that don't preserve client-IP affinity (e.g. AWS ALB across multiple AZs). The transparent proxy validates `Mcp-Session-Id` against this store on every non-initialize request (see pkg/transport/proxy/transparent/ transparent_proxy.go) and rewrites client-facing session IDs to backend session IDs using session metadata. Both lookups require shared state across replicas. When using the Redis provider, also set sessionAffinity to "None" so the Service routes requests round-robin and all replicas rely on the shared session store rather than pod-local state. Mirrors MCPServer.spec.sessionStorage and VirtualMCPServer.spec.sessionStorage.
| Field | Type | Description |
|---|---|---|
address | string | Address is the Redis server address (required when provider is redis) minLength 1 |
db | integer | DB is the Redis database number default 0 · format int32 · min 0 |
keyPrefix | string | KeyPrefix is an optional prefix for all Redis keys used by ToolHive |
passwordRef | object | PasswordRef is a reference to a Secret key containing the Redis password |
providerrequired | string | Provider is the session storage backend type enum: memory | redis |
spec.sessionStorage.passwordRef
PasswordRef is a reference to a Secret key containing the Redis password
| Field | Type | Description |
|---|---|---|
keyrequired | string | Key is the key within the secret |
namerequired | string | Name is the name of the secret |
spec.telemetryConfigRef
TelemetryConfigRef references an MCPTelemetryConfig resource for shared telemetry configuration. The referenced MCPTelemetryConfig must exist in the same namespace as this MCPRemoteProxy. Cross-namespace references are not supported for security and isolation reasons.
| Field | Type | Description |
|---|---|---|
namerequired | string | Name is the name of the MCPTelemetryConfig resource minLength 1 |
serviceName | string | ServiceName overrides the telemetry service name for this specific server. This MUST be unique per server for proper observability (e.g., distinguishing traces and metrics from different servers sharing the same collector). If empty, defaults to the server name with "thv-" prefix at runtime. |
spec.toolConfigRef
ToolConfigRef references a MCPToolConfig resource for tool filtering and renaming. The referenced MCPToolConfig must exist in the same namespace as this MCPRemoteProxy. Cross-namespace references are not supported for security and isolation reasons. If specified, this allows filtering and overriding tools from the remote MCP server.
| Field | Type | Description |
|---|---|---|
namerequired | string | Name is the name of the MCPToolConfig resource in the same namespace |
status
MCPRemoteProxyStatus defines the observed state of MCPRemoteProxy
| Field | Type | Description |
|---|---|---|
authServerConfigHash | string | AuthServerConfigHash is the hash of the referenced authServerRef spec, used to detect configuration changes and trigger reconciliation. |
authzConfigHash | string | AuthzConfigHash is the hash of the referenced MCPAuthzConfig spec for change detection |
conditions | object[] | Conditions represent the latest available observations of the MCPRemoteProxy's state |
externalAuthConfigHash | string | ExternalAuthConfigHash is the hash of the referenced MCPExternalAuthConfig spec |
externalUrl | string | ExternalURL is the external URL where the proxy can be accessed (if exposed externally) |
message | string | Message provides additional information about the current phase |
observedGeneration | integer | ObservedGeneration reflects the generation of the most recently observed MCPRemoteProxy format int64 |
oidcConfigHash | string | OIDCConfigHash is the hash of the referenced MCPOIDCConfig spec for change detection |
phase | string | Phase is the current phase of the MCPRemoteProxy enum: Pending | Ready | Failed | Terminating |
telemetryConfigHash | string | TelemetryConfigHash stores the hash of the referenced MCPTelemetryConfig for change detection |
toolConfigHash | string | ToolConfigHash stores the hash of the referenced ToolConfig for change detection |
url | string | URL is the internal cluster URL where the proxy can be accessed |
status.conditions[]
Conditions represent the latest available observations of the MCPRemoteProxy's state
| Field | Type | Description |
|---|---|---|
lastTransitionTimerequired | string | lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format date-time |
messagerequired | string | message is a human readable message indicating details about the transition. This may be an empty string. maxLength 32768 |
observedGeneration | integer | observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format int64 · min 0 |
reasonrequired | string | reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. pattern ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ · minLength 1 · maxLength 1024 |
statusrequired | string | status of the condition, one of True, False, Unknown. enum: True | False | Unknown |
typerequired | string | type of condition in CamelCase or in foo.example.com/CamelCase. pattern ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ · maxLength 316 |
Related resources
References:
- MCPAuthzConfig - via
spec.authzConfigRef - MCPExternalAuthConfig - via
spec.authServerRef,spec.externalAuthConfigRef - MCPGroup - via
spec.groupRef - MCPOIDCConfig - via
spec.oidcConfigRef - MCPTelemetryConfig - via
spec.telemetryConfigRef - MCPToolConfig - via
spec.toolConfigRef