From ae1f196f8b9f37d7053e4a7eda615b11a90ad48a Mon Sep 17 00:00:00 2001 From: muskiteer Date: Wed, 15 Jul 2026 19:22:02 +0530 Subject: [PATCH 1/4] fix: set --allowed-hosts for bundled grafana-mcp deployment Fixes #2166 Signed-off-by: muskiteer --- helm/tools/grafana-mcp/templates/deployment.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/helm/tools/grafana-mcp/templates/deployment.yaml b/helm/tools/grafana-mcp/templates/deployment.yaml index bf3be83f3..046ca7544 100644 --- a/helm/tools/grafana-mcp/templates/deployment.yaml +++ b/helm/tools/grafana-mcp/templates/deployment.yaml @@ -40,6 +40,7 @@ spec: args: - --transport - streamable-http + - --allowed-hosts={{ include "grafana-mcp.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }} {{- with .Values.args }} {{- toYaml . | nindent 12 }} {{- end }} From c14933fe0d8c2b7b2beaa46391705324fab4c3ff Mon Sep 17 00:00:00 2001 From: muskiteer Date: Wed, 15 Jul 2026 19:32:12 +0530 Subject: [PATCH 2/4] Added tests as well Signed-off-by: muskiteer --- helm/tools/grafana-mcp/tests/deployment_test.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/helm/tools/grafana-mcp/tests/deployment_test.yaml b/helm/tools/grafana-mcp/tests/deployment_test.yaml index d1ed1c4ad..2dcda4d75 100644 --- a/helm/tools/grafana-mcp/tests/deployment_test.yaml +++ b/helm/tools/grafana-mcp/tests/deployment_test.yaml @@ -119,4 +119,11 @@ tests: value: grafana:latest - notMatchRegex: path: spec.template.spec.containers[0].image - pattern: "^/" # no leading slash \ No newline at end of file + pattern: "^/" # no leading slash + + - it: should configure allowed-hosts automatically + template: deployment.yaml + asserts: + - contains: + path: spec.template.spec.containers[0].args + content: --allowed-hosts=RELEASE-NAME-grafana-mcp.NAMESPACE:8000 \ No newline at end of file From f303d1aa77f0b7a07db652228810260a9aceecda Mon Sep 17 00:00:00 2001 From: muskiteer Date: Wed, 22 Jul 2026 19:14:19 +0530 Subject: [PATCH 3/4] Add configurable allowedHosts for Grafana MCP Signed-off-by: muskiteer --- helm/tools/grafana-mcp/templates/_helpers.tpl | 14 +++++++++++ .../grafana-mcp/templates/deployment.yaml | 2 +- .../grafana-mcp/tests/deployment_test.yaml | 25 +++++++++++++++++-- helm/tools/grafana-mcp/values.yaml | 7 ++++++ 4 files changed, 45 insertions(+), 3 deletions(-) diff --git a/helm/tools/grafana-mcp/templates/_helpers.tpl b/helm/tools/grafana-mcp/templates/_helpers.tpl index bd074a815..6c88783d9 100644 --- a/helm/tools/grafana-mcp/templates/_helpers.tpl +++ b/helm/tools/grafana-mcp/templates/_helpers.tpl @@ -75,4 +75,18 @@ Join registry/repository for grafana-mcp image, skipping empty segments, then ap {{- $img := .Values.image -}} {{- $parts := compact (list $img.registry $img.repository) -}} {{- printf "%s:%s" (join "/" $parts) $img.tag -}} +{{- end -}} + +{{- define "grafana-mcp.allowedHosts" -}} +{{- if .Values.allowedHosts -}} +{{- join "," .Values.allowedHosts -}} +{{- else -}} +{{- $fullname := include "grafana-mcp.fullname" . -}} +{{- $ns := .Release.Namespace -}} +{{- $port := .Values.service.port | int -}} +{{- join "," (list (printf "%s.%s:%d" $fullname $ns $port) + (printf "%s.%s.svc:%d" $fullname $ns $port) + (printf "%s.%s.svc.cluster.local:%d" $fullname $ns $port) + (printf "localhost:%d" $port)) -}} +{{- end -}} {{- end -}} \ No newline at end of file diff --git a/helm/tools/grafana-mcp/templates/deployment.yaml b/helm/tools/grafana-mcp/templates/deployment.yaml index 046ca7544..03497ebe6 100644 --- a/helm/tools/grafana-mcp/templates/deployment.yaml +++ b/helm/tools/grafana-mcp/templates/deployment.yaml @@ -40,7 +40,7 @@ spec: args: - --transport - streamable-http - - --allowed-hosts={{ include "grafana-mcp.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }} + - --allowed-hosts={{ include "grafana-mcp.allowedHosts" . }} {{- with .Values.args }} {{- toYaml . | nindent 12 }} {{- end }} diff --git a/helm/tools/grafana-mcp/tests/deployment_test.yaml b/helm/tools/grafana-mcp/tests/deployment_test.yaml index 2dcda4d75..8a6da843a 100644 --- a/helm/tools/grafana-mcp/tests/deployment_test.yaml +++ b/helm/tools/grafana-mcp/tests/deployment_test.yaml @@ -121,9 +121,30 @@ tests: path: spec.template.spec.containers[0].image pattern: "^/" # no leading slash - - it: should configure allowed-hosts automatically + - it: should configure allowed-hosts with default DNS variants template: deployment.yaml asserts: - contains: path: spec.template.spec.containers[0].args - content: --allowed-hosts=RELEASE-NAME-grafana-mcp.NAMESPACE:8000 \ No newline at end of file + content: --allowed-hosts=RELEASE-NAME-grafana-mcp.NAMESPACE:8000,RELEASE-NAME-grafana-mcp.NAMESPACE.svc:8000,RELEASE-NAME-grafana-mcp.NAMESPACE.svc.cluster.local:8000,localhost:8000 + + - it: should use custom allowedHosts when configured + template: deployment.yaml + set: + allowedHosts: + - "custom-host:8000" + - "*.kagent:8000" + asserts: + - contains: + path: spec.template.spec.containers[0].args + content: --allowed-hosts=custom-host:8000,*.kagent:8000 + + - it: should allow wildcard allowedHosts + template: deployment.yaml + set: + allowedHosts: + - "*" + asserts: + - contains: + path: spec.template.spec.containers[0].args + content: --allowed-hosts=* diff --git a/helm/tools/grafana-mcp/values.yaml b/helm/tools/grafana-mcp/values.yaml index 01f0f1f50..07cbac57a 100644 --- a/helm/tools/grafana-mcp/values.yaml +++ b/helm/tools/grafana-mcp/values.yaml @@ -50,6 +50,13 @@ resources: cpu: 500m memory: 512Mi +# allowedHosts configures the --allowed-hosts argument for mcp-grafana's Host header +# validation (required for streamable-http transport). When empty, defaults to the +# standard Kubernetes Service DNS variants (., ..svc, +# ..svc.cluster.local, localhost). Override with a list of hosts or +# set to ["*"] to allow all hosts. +allowedHosts: [] + # Additional Arguments for the mcp server args: [] From 32a0e2f5ae7d395a0670bf92fb67885bbc01f732 Mon Sep 17 00:00:00 2001 From: muskiteer Date: Wed, 22 Jul 2026 22:20:08 +0530 Subject: [PATCH 4/4] Added plain svc name Signed-off-by: muskiteer --- helm/tools/grafana-mcp/templates/_helpers.tpl | 3 ++- helm/tools/grafana-mcp/tests/deployment_test.yaml | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/helm/tools/grafana-mcp/templates/_helpers.tpl b/helm/tools/grafana-mcp/templates/_helpers.tpl index 6c88783d9..1aa1864a6 100644 --- a/helm/tools/grafana-mcp/templates/_helpers.tpl +++ b/helm/tools/grafana-mcp/templates/_helpers.tpl @@ -84,7 +84,8 @@ Join registry/repository for grafana-mcp image, skipping empty segments, then ap {{- $fullname := include "grafana-mcp.fullname" . -}} {{- $ns := .Release.Namespace -}} {{- $port := .Values.service.port | int -}} -{{- join "," (list (printf "%s.%s:%d" $fullname $ns $port) +{{- join "," (list (printf "%s:%d" $fullname $port) + (printf "%s.%s:%d" $fullname $ns $port) (printf "%s.%s.svc:%d" $fullname $ns $port) (printf "%s.%s.svc.cluster.local:%d" $fullname $ns $port) (printf "localhost:%d" $port)) -}} diff --git a/helm/tools/grafana-mcp/tests/deployment_test.yaml b/helm/tools/grafana-mcp/tests/deployment_test.yaml index 8a6da843a..be7f0b4f3 100644 --- a/helm/tools/grafana-mcp/tests/deployment_test.yaml +++ b/helm/tools/grafana-mcp/tests/deployment_test.yaml @@ -126,7 +126,7 @@ tests: asserts: - contains: path: spec.template.spec.containers[0].args - content: --allowed-hosts=RELEASE-NAME-grafana-mcp.NAMESPACE:8000,RELEASE-NAME-grafana-mcp.NAMESPACE.svc:8000,RELEASE-NAME-grafana-mcp.NAMESPACE.svc.cluster.local:8000,localhost:8000 + content: --allowed-hosts=RELEASE-NAME-grafana-mcp:8000,RELEASE-NAME-grafana-mcp.NAMESPACE:8000,RELEASE-NAME-grafana-mcp.NAMESPACE.svc:8000,RELEASE-NAME-grafana-mcp.NAMESPACE.svc.cluster.local:8000,localhost:8000 - it: should use custom allowedHosts when configured template: deployment.yaml