[FragmentedPacket]

Moves charts/infrahub-mcp to infrahub-mcp v1.2.1, adds values for the server settings the chart did not set, and re-pins the chart in infrahub and infrahub-enterprise.

infrahub-mcp chart (0.1.0 → 0.2.0)

• appVersion: v1.1.6 → v1.2.1. The image registry.opsmill.io/opsmill/infrahub-mcp:v1.2.1 exists.
• New values for the variables that v1.2.1 reads and the chart did not set. The list comes from src/infrahub_mcp/config.py, server.py and the configuration reference:
  • infrahub.username and infrahub.password (INFRAHUB_USERNAME, INFRAHUB_PASSWORD), with the same value / existingSecret pattern as apiToken
  • mcp.host (MCP_HOST)
  • mcp.tokenPassthroughHeader (INFRAHUB_MCP_TOKEN_PASSTHROUGH_HEADER)
  • mcp.authScopesWrite (INFRAHUB_MCP_AUTH_SCOPES_WRITE)
  • mcp.oidc.* (the six INFRAHUB_MCP_OIDC_* variables; the client secret can come from an existing Secret)
  • mcp.schemaExpandPeers (INFRAHUB_MCP_SCHEMA_EXPAND_PEERS)
• MCP_PORT is now set from service.targetPort. Before, changing targetPort changed the container port but not the port the server listens on.
• No value was removed. The description of mcp.rateLimit.burst is corrected: 0 means twice rps, not "disabled".
• Not added, because extraEnv covers them:
  • INFRAHUB_MCP_ENV_FILE: the pod has no .env file.
  • Infrahub SDK variables such as INFRAHUB_TIMEOUT, INFRAHUB_TLS_* and INFRAHUB_PROXY.
• README.md.gotmpl has a production example: authMode: token-passthrough, readOnly: true, the in-cluster server URL and an ingress on /mcp. It sets no shared API token: in token-passthrough mode the server calls Infrahub with each client's token and never reads INFRAHUB_API_TOKEN (server.py, configuration reference). An unused token in the pod would give every client its access if authMode were set back to none.
• README.md is regenerated with helm-docs 1.14.2.

Re-pin in infrahub (4.35.0 → 4.36.0) and infrahub-enterprise (4.23.0 → 4.24.0)

• infrahub pins infrahub-mcp 0.2.0; infrahub-enterprise pins infrahub 4.36.0. This follows the last re-pin, 70d0746 (infrahub-backup 1.4.0).
• Each chart has a news fragment, and the dependency rows of both READMEs are updated.

CI fails on infrahub and infrahub-enterprise until 0.2.0 is published

helm dependency update cannot find infrahub-mcp 0.2.0 or infrahub 4.36.0 in the registry, so the lint and end-to-end jobs of those two charts fail on this pull request. The pins stay in this pull request on purpose. With their dependencies pointed at the local charts, both charts pass helm lint.

Tests

• make lint passes for infrahub-mcp, infrahub-backup and infrahub-observability.
• helm template of the README production example renders the expected env vars, Secret reference and ingress.
• uv run pytest -v -m mcp tests/e2e did not run locally: the vcluster CLI is not installed on the machine used. The e2e-mcp CI job runs it.

Related pull requests

Merge order: #110, then #111, then opsmill/infrahub-mcp#221.

• feat(infrahub-mcp): update to infrahub-mcp v1.2.1 and expose its settings #110: chart update to infrahub-mcp v1.2.1
• ci: open pull requests for infrahub-mcp releases and re-pin the chart #111: receiving workflow, re-pin job and settings check
• ci: notify infrahub-helm when a release is published infrahub-mcp#221: sends the infrahub-mcp-released event after a release

🤖 Generated with Claude Code