vmcp-operator

Kubernetes operator for managing multiple isolated vmcp gateway instances.

One singleton operator watches an explicit namespace allowlist and reconciles independent {namespace}/{VmcpGateway} stacks (Deployment, Service, PVC, atomic artifact ConfigMap, credentials, public/admin HTTPRoutes) plus attached VmcpMcpServer upstreams (ContainerImage or RemoteHttp).

Stack

• Python 3.15 free-threaded controller (PYTHON_LAZY_IMPORTS=normal)
• Pure Rust vmcp-op-core + thin PyO3 vmcp-op-pyo3 (abi3t-py315)
• Helm chart installs CRDs/RBAC/operator/dashboard only (never vmcp workloads)
• Vendored Grid.js 6.2.0 + Tabler 1.4.0 dashboard assets
• TDD gates: Python ≥98%, Rust core ≥93%

Layout

charts/vmcp-operator/   Helm install surface
python/vmcp_operator/   HEX controller + dashboard static
crates/                 vmcp-op-core, vmcp-op-pyo3
deploy/samples/         example CRs
deploy/profiles/        resurche / code / other bundles
scripts/                compatibility spike helpers
docs/                   gate notes

Quick checks

uv sync --extra dev
uv run maturin develop
make test-py test-rs helm-lint

Release image (GHCR)

Same release workflow shape as hewimetall/vmcp:

# Tag push → build Dockerfile target `runtime` → ghcr.io/hewimetall/vmcp_operator:<semver>
git tag v0.1.0
git push origin v0.1.0

GHCR packages for this repo are not anonymously pullable — crane ls / docker pull without credentials returns DENIED (not “not found”). Authenticate first:

echo "$GHCR_TOKEN" | docker login ghcr.io -u USERNAME --password-stdin
# cluster: imagePullSecrets for ghcr.io/hewimetall/vmcp_operator

Local build:

docker build --target runtime -t ghcr.io/hewimetall/vmcp_operator:local .

Chart default image: ghcr.io/hewimetall/vmcp_operator.

uv.lock pins cryptography>=50 (via [tool.uv] override-dependencies) so free-threaded CPython 3.15t image builds do not need UV_OVERRIDE.

Phase −1 compatibility results: docs/phase-minus-one.md.

Gateway contract (vmcp ≥1.3 recommended: G25 catalog + optional GCF; ≥1.2 AuthFacade / hop trust / forward_identity): docs/compatibility.md.

Operator control plane above vmcp (MCP add/remove/update + NL CRUD, peer Gateways via VmcpProxy / vmcp-proxy): docs/control-plane.md.

C4 delta for issue #4 (status / finalizers / ownership) — import into architect-c4 workspace ws-vmcp-operator: docs/architecture-issue4.md.

0.0.2 adoption (adminRoute same-host path, CRD/image skew, observedGeneration): docs/issue-8-adoption.md.