MCP Helm chart: Add support for Traefik ingress

[kkhristenko51]

MCP Helm chart: Add support for Traefik ingress

Adds Traefik ingress-controller support to the rosetta-mcp-server Helm chart by introducing Traefik-specific values, Middleware CRD generation (rate limiting), and updated deployment documentation, alongside a chart version bump.

Changes

• Add ingress.traefik.* values (external middleware chain + optional rate limiting) and document Traefik usage in example overlays.
• Render a Traefik Middleware CRD (rate limit) and wire it into the Ingress via traefik.ingress.kubernetes.io/router.middlewares.
• Update chart version and deployment guide to reflect the new ingress-controller options.
• Add unit tests and a separate CI step to run them
• Enable health/readiness/liveness probes and update default app version in the chart to a release that supports /healthz

[Copilot]

Pull request overview

Adds Traefik ingress-controller support to the rosetta-mcp-server Helm chart by introducing Traefik-specific values, optional Middleware CRD generation (rate limiting), and updated deployment documentation, alongside a chart version bump.

Changes:

• Add ingress.traefik.* values (external middleware chain + optional rate limiting) and document Traefik usage in example overlays.
• Render a Traefik Middleware CRD (rate limit) when enabled and wire it into the Ingress via traefik.ingress.kubernetes.io/router.middlewares.
• Update chart version and deployment guide to reflect the new ingress-controller options.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/helm-charts/rosetta-mcp-server/values.yaml	Adds Traefik-specific configuration keys under ingress.traefik.
src/helm-charts/rosetta-mcp-server/values-prod.example.yaml	Adds commented Traefik configuration example for production overlay.
src/helm-charts/rosetta-mcp-server/values-dev.example.yaml	Adds commented Traefik configuration example for dev overlay.
src/helm-charts/rosetta-mcp-server/templates/traefik-middlewares.yaml	Introduces conditional rendering of a Traefik rate-limit Middleware CRD.
src/helm-charts/rosetta-mcp-server/templates/ingress.yaml	Adds Traefik middleware annotation wiring logic to the Ingress template.
src/helm-charts/rosetta-mcp-server/Chart.yaml	Bumps chart version to 0.4.0.
DEPLOYMENT_GUIDE.md	Documents nginx vs Traefik ingress configuration and new chart template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

[github-actions]

Rosetta Triage Review

Summary: This PR adds Traefik ingress controller support to the rosetta-mcp-server Helm chart by introducing Traefik-specific values, optional rate-limit Middleware CRD generation, and updated documentation in DEPLOYMENT_GUIDE.md. The change is backward-compatible — nginx remains the default, and the chart version is bumped from 0.3.0 to 0.4.0.

Findings:

• traefik-middlewares.yaml sets annotations: kubernetes.io/ingress.class: {{ .Values.ingress.className }} on the Traefik Middleware CRD. This annotation is only meaningful on Ingress resources; it has no effect on Middleware objects and may cause confusion — it can be safely removed.
• No Helm chart tests (e.g., templates/tests/ or helm template snapshot tests) are included to cover the new conditional rendering paths (middleware annotation assembly, CRD generation toggle). Adding at least a basic helm template CI step for both className: nginx and className: traefik scenarios would prevent future regressions.

Suggestions:

• Remove the kubernetes.io/ingress.class annotation from traefik-middlewares.yaml — it is a no-op on Traefik Middleware CRDs.
• Consider a lightweight CI step running helm template with Traefik values to validate the conditional middleware annotation and CRD rendering.

Automated triage by Rosetta agent

[isolomatov-gd]

Please review comments => secure by default, limited by default

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.

[kkhristenko51]

/rosetta validate security compliance of changes in this PR

[isolomatov-gd]

/rosetta validate security compliance of changes in this PR

[github-actions]

Rosetta Security Compliance Review

Requested by @isolomatov-gd via /rosetta validate security compliance of changes in this PR

Scope: PR #120 — MCP Helm chart: Add support for Traefik ingress (13 files, +516/-58)

---

✅ Security Positives

CI secret scoping — correct
DOCKERHUB_OAT and DOCKERHUB_LOGIN secrets are consumed only in the publish job, which is gated to github.event_name == 'push' && github.ref_name == 'main'. PR builds run only the validate job, which has no secret access. This is the correct pattern.

Rate limiting enabled by default
The Traefik Middleware CRD sets average: 100, burst: 200, period: 1s out of the box. DoS protection is now on by default instead of requiring operator opt-in — a meaningful security improvement.

Health probes now mandatory
Liveness, readiness, and startup probes are uncommented and enabled by default. The readiness probe uses GET /healthz (application-level check), which is more secure than TCP-socket probing.

Minimal CI permissions
Both validate and publish jobs declare permissions: contents: read. No write permissions granted.

Container and pod security context verified by tests
deployment_test.yaml explicitly asserts:

• allowPrivilegeEscalation: false
• capabilities.drop: [ALL]
• runAsNonRoot: true / runAsUser: 1000

CRD name normalization
regexReplaceAll "-{2,}" ... "-" prevents double-dash injection via release names. Covered by a dedicated test case.

Middleware annotation conflict prevention
The omit call on ingress.traefik.middlewares annotation ensures user-supplied annotations cannot accidentally override the rendered Traefik middleware chain.

---

⚠️ Minor Findings (non-blocking)

1. Helm plugin installed by version tag, not commit SHA
Support linux-amd64
No version found
Downloading https://github.com/helm-unittest/helm-unittest/releases/download/v0.6.3/helm-unittest-linux-amd64-0.6.3.tgz to location /tmp/_dist/
found: ./_dist/helm-unittest-linux-amd64-0.6.3.tgz
Validating Checksum.
Preparing to install into /home/runner/.local/share/helm/plugins/helm-unittest.git
helm-unittest installed into /home/runner/.local/share/helm/plugins/helm-unittest.git
Running chart unittest written in YAML.

This renders your charts locally (without tiller) and
validates the rendered output with the tests defined in
test suite files. Simplest test suite file looks like
below:

---

CHART_PATH/tests/deployment_test.yaml

suite: test my deployment
templates:

• deployment.yaml
  tests:
• it: should be a Deployment
  asserts:
  • isKind:
    of: Deployment

---

Put the test files in "tests" directory under your chart
with suffix "_test.yaml", and run:

$ helm unittest my-chart

Or specify the suite files glob path pattern:

$ helm unittest -f 'my-tests/*.yaml' my-chart

Check https://github.com/helm-unittest/helm-unittest for more
details about how to write tests.

Usage:
unittest [flags] CHART [...]

Flags:
--chart-tests-path string chart-tests-path the folder location relative to the chart where a helm chart to render test suites is located
--color enforce printing colored output even stdout is not a tty. Set to false to disable color
-d, --debugPlugin enable verbose output
-q, --failfast direct quit testing, when a test is failed
-f, --file stringArray glob paths of test files location, default to tests/*_test.yaml
-h, --help help for unittest
-o, --output-file string output-file the file where testresults are written in JUnit format, defaults no output is written to file
-t, --output-type string output-type the file-format where testresults are written in, accepted types are (JUnit, NUnit, XUnit, Sonar) (default "XUnit")
--strict strict parse the testsuites
-u, --update-snapshot update the snapshot cached if needed, make sure you review the change before update
-v, --values stringArray absolute or glob paths of values files location to override helmchart values
-s, --with-subchart charts include tests of the subcharts within charts folder (default true)
Installed plugin: unittest
Version tags are mutable. For supply-chain hardening, pin to the commit SHA instead:

Risk is low for a test-only dependency, but worth noting for organizations with strict supply-chain policies.

2. Default className changed from nginx to traefik (silent breaking change)
Existing deployments running helm upgrade without an explicit ingress.className override will shift to Traefik. If the cluster has no Traefik CRDs installed, the Middleware CRD creation will fail. Recommend adding a breaking-change label and noting this prominently in the PR/release notes.

3. Readiness probe requires /healthz (gated to appVersion 2.0.25+)
The appVersion bump to 2.0.25 implies /healthz is available in that release. Users on older image tags without this endpoint will see readiness probe failures. The values-dev/prod examples hardcode tag: "2.0.25" so new installs are safe; upgrade paths from < 2.0.25 should be documented.

---

Summary

Area	Status
CI secret exposure	✅ Scoped correctly
DoS protection	✅ Rate limiting on by default
Health monitoring	✅ Probes enabled by default
CI permissions	✅ Read-only
Container security context	✅ Hardened, test-verified
Supply chain (plugin install)	⚠️ Mutable tag, consider SHA pin
Breaking default change	⚠️ Add breaking-change label
Upgrade path from old appVersion	⚠️ Document probe prerequisite

Verdict: COMPLIANT with minor recommendations. No security regressions detected. The PR improves the security posture of the Helm chart through default rate limiting, mandatory health probes, and verified container hardening.

Automated security compliance review by Rosetta agent