MCP Helm chart: Add support for Traefik ingress

DEPLOYMENT_GUIDE.md

@@ -248,7 +248,52 @@ helm install rosetta-mcp ./src/helm-charts/rosetta-mcp-server \
 1. **Image** — `image.repository` defaults to `griddynamics/rosetta-mcp`; set `image.tag` or rely on the chart defaulting the tag to [`appVersion`](src/helm-charts/rosetta-mcp-server/Chart.yaml) in the Deployment template.
 2. **Rosetta backend** — Set `env.vars` so `ROSETTA_SERVER_URL` resolves to Rosetta Server (in-cluster DNS or ingress URL).
 3. **API key** — Supply `ROSETTA_API_KEY` via `env.secrets` (`secretKeyRef`). Create the Kubernetes Secret first or use `eso` to sync it.
-4. **Ingress** — Set `ingress.host` and annotations. Defaults use an NGINX-style controller and placeholder host `rosetta-mcp.local`.
+4. **Ingress** — Set `ingress.host`. The chart supports both **nginx** (default) and **Traefik** ingress controllers.
+
+   **nginx** (default):
+
+   ```yaml
+   ingress:
+     className: nginx
+     host: rosetta.example.com
+     annotations:
+       kubernetes.io/ingress.class: nginx
+   ```
+
+   **Traefik** — set `className: traefik` and configure middlewares under `ingress.traefik`:
+
+   ```yaml
+   ingress:
+     className: traefik
+     host: rosetta.example.com
+     annotations: {}
+     traefik:
+       rateLimit:
+         average: 20
+         burst: 200
+         period: "1s"
+   ```
+
+   When `rateLimit.average` is set, the chart creates a Traefik `Middleware` CRD
+   (`<release>-rate-limit`) in the release namespace and wires it into the Ingress
+   annotation automatically.
+
+   To reference additional external middlewares (e.g. a platform-wide chain managed
+   outside this chart), list them in `ingress.traefik.middlewares`:
+
+   ```yaml
+   ingress:
+     traefik:
+       middlewares:
+         - "traefik-my-chain@kubernetescrd"
+       rateLimit:
+         average: 20
+         burst: 200
+         period: "1s"
+   ```
+
+   External middlewares are rendered first in the annotation, followed by the
+   per-release rate limit.
 5. **TLS (production)** — Enable encrypted client traffic before production use. Uncomment and complete the [`ingress.tls`](src/helm-charts/rosetta-mcp-server/values.yaml) block in your overlay so Ingress terminates HTTPS with a TLS `Secret` (or terminate TLS upstream and align hostnames). HTTP-only defaults are unsuitable for production; OAuth and user trust depend on HTTPS.
 
 Full environment-variable semantics for OAuth, Redis, analytics, and modes are the same as the application runtime; see [rosetta-mcp-server — Configuration](src/rosetta-mcp-server/README.md#configuration).
@@ -273,6 +318,7 @@ helm upgrade --install rosetta-mcp ./src/helm-charts/rosetta-mcp-server \
 | [`templates/deployment.yaml`](src/helm-charts/rosetta-mcp-server/templates/deployment.yaml) | Deployment, env, resources |
 | [`templates/service.yaml`](src/helm-charts/rosetta-mcp-server/templates/service.yaml) | ClusterIP and session affinity |
 | [`templates/ingress.yaml`](src/helm-charts/rosetta-mcp-server/templates/ingress.yaml) | Optional Ingress |
+| [`templates/traefik-middlewares.yaml`](src/helm-charts/rosetta-mcp-server/templates/traefik-middlewares.yaml) | Traefik Middleware CRDs (when `className: traefik`) |
 | [`templates/hpa.yaml`](src/helm-charts/rosetta-mcp-server/templates/hpa.yaml) | Optional HPA |
 | [`templates/external-secret.yaml`](src/helm-charts/rosetta-mcp-server/templates/external-secret.yaml) | Optional ExternalSecret (`eso.*`) |
 | [`templates/serviceaccount.yaml`](src/helm-charts/rosetta-mcp-server/templates/serviceaccount.yaml) | ServiceAccount |
@@ -317,6 +363,11 @@ Base keys in [`src/helm-charts/rosetta-mcp-server/values.yaml`](src/helm-charts/
 | `replicaCount` | `1` | Static replicas when HPA disabled |
 | `autoscaling.enabled` | `false` | HPA toggle |
 | `ingress.enabled` | `true` | Ingress resource |
+| `ingress.className` | `nginx` | Ingress controller (`nginx` or `traefik`) |
+| `ingress.traefik.middlewares` | `[]` | External Traefik middleware references |
+| `ingress.traefik.rateLimit.average` | (unset) | Rate limit — requests per period |
+| `ingress.traefik.rateLimit.burst` | (unset) | Rate limit — max burst size |
+| `ingress.traefik.rateLimit.period` | (unset) | Rate limit — period (e.g. `"1s"`) |
 | `ingress.tls` | Commented in base [`values.yaml`](src/helm-charts/rosetta-mcp-server/values.yaml); enable for production | HTTPS termination at Ingress |
 | `service.sessionAffinity` | `ClientIP` | Pod stickiness |
 | `eso.enabled` | `false` | External Secrets Operator sync |

src/helm-charts/rosetta-mcp-server/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: rosetta-mcp-helm-chart
 description: Helm chart for Rosetta MCP server - the consulting layer between IDEs and Rosetta knowledge base (RAGFlow)
 type: application
-version: 0.3.0
+version: 0.4.0
 appVersion: "2.0.0"
 keywords:
   - rosetta

src/helm-charts/rosetta-mcp-server/templates/ingress.yaml

@@ -6,10 +6,22 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "rosetta-mcp.labels" . | nindent 4 }}
-  {{- with .Values.ingress.annotations }}
   annotations:
+    {{- if eq (.Values.ingress.className | default "") "traefik" }}
+    {{- $middlewares := list }}
+    {{- range (.Values.ingress.traefik.middlewares | default list) }}
+    {{- $middlewares = append $middlewares . }}
+    {{- end }}
+    {{- if and .Values.ingress.traefik .Values.ingress.traefik.rateLimit .Values.ingress.traefik.rateLimit.average }}
+    {{- $middlewares = append $middlewares (printf "%s-%s-rate-limit@kubernetescrd" $.Release.Namespace (include "rosetta-mcp.fullname" $)) }}
+    {{- end }}
+    {{- if $middlewares }}
+    traefik.ingress.kubernetes.io/router.middlewares: {{ join "," $middlewares }}
+    {{- end }}
+    {{- end }}
+    {{- with .Values.ingress.annotations }}
     {{- toYaml . | nindent 4 }}
-  {{- end }}
+    {{- end }}
 spec:
   {{- if .Values.ingress.className }}
   ingressClassName: {{ .Values.ingress.className | quote }}

src/helm-charts/rosetta-mcp-server/templates/traefik-middlewares.yaml

@@ -0,0 +1,25 @@
+{{- if and .Values.ingress.enabled (eq (.Values.ingress.className | default "") "traefik") }}
+
+{{- if and .Values.ingress.traefik .Values.ingress.traefik.rateLimit .Values.ingress.traefik.rateLimit.average }}
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ include "rosetta-mcp.fullname" . }}-rate-limit
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    kubernetes.io/ingress.class: {{ .Values.ingress.className }}
+  labels:
+    {{- include "rosetta-mcp.labels" . | nindent 4 }}
+spec:
+  rateLimit:
+    average: {{ .Values.ingress.traefik.rateLimit.average }}
+    {{- with .Values.ingress.traefik.rateLimit.burst }}
+    burst: {{ . }}
+    {{- end }}
+    {{- with .Values.ingress.traefik.rateLimit.period }}
+    period: {{ . | quote }}
+    {{- end }}
+{{- end }}
+
+{{- end }}

src/helm-charts/rosetta-mcp-server/values-dev.example.yaml

@@ -7,6 +7,14 @@ image:
 
 ingress:
   host: rosetta-dev.example.com
+  # Traefik example (uncomment to switch from nginx):
+  # className: traefik
+  # annotations: {}
+  # traefik:
+  #   rateLimit:
+  #     average: 20
+  #     burst: 200
+  #     period: "1s"
 
 env:
   enabled: true

src/helm-charts/rosetta-mcp-server/values-prod.example.yaml

@@ -6,6 +6,14 @@ image:
 
 ingress:
   host: rosetta.example.com
+  # Traefik example (uncomment to switch from nginx):
+  # className: traefik
+  # annotations: {}
+  # traefik:
+  #   rateLimit:
+  #     average: 20
+  #     burst: 200
+  #     period: "1s"
 
 env:
   enabled: true

src/helm-charts/rosetta-mcp-server/values.yaml

@@ -99,6 +99,17 @@ ingress:
     kubernetes.io/ingress.class: nginx
   paths:
     - /
+  # Traefik-specific settings (only used when className is "traefik").
+  # When using Traefik, remove the nginx annotations above and set className to "traefik".
+  traefik:
+    # External middleware references (fully-qualified, e.g. "namespace-name@kubernetescrd").
+    # Rendered first in the middleware chain annotation.
+    middlewares: []
+    # Per-release rate limiting — creates a Traefik Middleware CRD in the release namespace.
+    # rateLimit:
+    #   average: 100
+    #   burst: 200
+    #   period: "1s"
   # Production: enable TLS below (or terminate TLS upstream). Defaults leave MCP on HTTP at the Ingress until configured.
   # tls:
   #   - secretName: rosetta-mcp-tls