Skip to content

Commit f224922

Browse files
remove mcps listener configuration in favour of adding to installation doc
Signed-off-by: Patryk Stefanski <pstefans@redhat.com>
1 parent 3c5b0f5 commit f224922

2 files changed

Lines changed: 3 additions & 34 deletions

File tree

modules/proc-configure-mcp-gateway-authentication.adoc

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -127,9 +127,7 @@ spec:
127127
+
128128
[source,terminal,subs="+quotes"]
129129
----
130-
$ oc apply -f - <<EOF
131-
<AuthPolicy CR from the previous step>
132-
EOF
130+
$ oc apply -f _<mcp_jwt_auth_policy.yaml>_
133131
----
134132

135133
.Verification

modules/proc-mcp-gateway-authorization.adoc

Lines changed: 2 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -13,40 +13,13 @@ The following example demonstrates using a Kuadrant `AuthPolicy` custom resource
1313

1414
* You installed {mcpg}.
1515
* You installed {prodname}.
16-
* You configured a `Gateway` object with an `mcp` listener.
16+
* You configured a `Gateway` object with an `mcp` listener and an `mcps` listener. The `mcps` listener is required for internal `tools/call` routing and authorization.
1717
* You completed authentication procedures, including creating an `AuthPolicy` CR on the `mcp` listener.
1818
* You configured your identity provider to include `group` and `role` claims in JSON Web Tokens (JWT).
1919
* The identity provider client IDs match the namespaced `MCPServerRegistration` name in the format `_<namespace>_/_<mcpserverregistration_name>_`.
2020
2121
.Procedure
2222

23-
. Add an `mcps` listener to the `Gateway` object for internal `tools/call` routing by using the following command as an example:
24-
+
25-
[source,json,subs="+quotes"]
26-
----
27-
$ oc patch gateway _<mcp_gateway>_ -n _<gateway_system>_ --type json -p '[
28-
{
29-
"op": "add",
30-
"path": "/spec/listeners/-",
31-
"value": {
32-
"name": "mcps",
33-
"port": 8080,
34-
"protocol": "HTTP",
35-
"hostname": "*.mcp-internal.example.com",
36-
"allowedRoutes": {
37-
"namespaces": {
38-
"from": "All"
39-
}
40-
}
41-
}
42-
}
43-
]'
44-
----
45-
+
46-
* Replace `_<mcp_gateway>_` with the name of your MCP gateway.
47-
* Replace `_<gateway_system>_` with the namespace of your `Gateway` object.
48-
* Replace `*.mcp-internal.example.com` with a wildcard hostname for your environment.
49-
5023
. Ensure that your identity provider includes the required `group` and `role` claims in the issued JWTs. In the following example, {keycloak} is used:
5124
+
5225
.Example issued OAuth token claims:
@@ -135,9 +108,7 @@ spec:
135108
+
136109
[source,terminal,subs="+quotes"]
137110
----
138-
$ oc apply -f - <<EOF
139-
<AuthPolicy CR from the previous step>
140-
EOF
111+
$ oc apply -f _<mcp_tool_auth_policy.yaml>_
141112
----
142113

143114
.Verification

0 commit comments

Comments
 (0)