From 998664ba51925c1a584fe4f11a0893cdfad41423 Mon Sep 17 00:00:00 2001 From: Ravi Kiran Date: Tue, 22 Sep 2026 20:53:45 +0530 Subject: [PATCH] Pin the MCP image to the public 0.2.1 release The private-registry sha was an interim default until openops-mcp had a public release. 0.2.1 is that release, and it carries the fix that lets the MCP server reach the API through its internal URL instead of the public issuer. Co-Authored-By: Claude Fable 5.1 --- README.md | 2 +- chart/values.yaml | 7 ++----- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index e09be38..c8da9f7 100644 --- a/README.md +++ b/README.md @@ -325,7 +325,7 @@ External agents such as Claude Code or Codex connect to OpenOps through the `ope Prerequisites: - `global.publicUrl` must be `https://...` (plain `http` is only accepted for `localhost`), so enable TLS first. - `OPS_OAUTH_RS_CLIENT_SECRET` must be declared under `openopsEnvSecrets` with a random value of at least 32 characters (`openssl rand -hex 32`). It is shared between the API and the MCP pod. When an external secret manager supplies the value, declare the key as `""`; with `externalSecrets.infraSecretName` set, the chart reads it from the infra secret (the Terraform-generated one on Azure), otherwise from the single remote secret. External Secrets fails the whole sync when a requested property is missing, which is why the chart does not declare this key by default. -- Pull access to the MCP image. Until the first public release the default `mcp.repository` is the private registry `openopsprivate.azurecr.io`; point `mcp.repository`/`mcp.tag` at an image your cluster can pull, or grant the cluster's node identity pull rights on that registry. +- The MCP image is pulled from the public registry (`openops.azurecr.io/openops-mcp`, pinned by `mcp.tag`), like Tables and Analytics; no pull credentials are needed. Point `mcp.repository`/`mcp.tag` elsewhere to run a different build. Minimal override: ```yaml diff --git a/chart/values.yaml b/chart/values.yaml index de5963b..76ef9f1 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -281,11 +281,8 @@ mcp: enabled: false name: openops-mcp image: openops-mcp - # Main-branch builds live in the private registry until the first public release; the - # public image will be openops.azurecr.io/openops-mcp:. Pulling from the private - # registry needs pull access on the cluster (imagePullSecrets or a registry role). - repository: "openopsprivate.azurecr.io" - tag: "8e7c930f" # Independently versioned (8-char commit sha or release version), not global.version + repository: "openops.azurecr.io" # Always the public registry for mcp + tag: "0.2.1" # Independently versioned (openops-mcp release), not global.version port: 3020 replicas: 2 # Stateless; any replica serves any request resources: