The four shapes a production MCPG fleet lands on — single-node, single-instance with shared state, multi-replica HA via Redis or NATS, and air-gapped — with the config that distinguishes each.

Run an HA MCPG fleet on Kubernetes with the operator + Helm charts. NATS or Redis for shared state, plugin sets via CRD.

Deploy and run MCPG on Kubernetes with the operator and Helm chart — the eight mcpg.dev CRDs, the validating admission webhook, cert-manager TLS, metrics and probe endpoints, and the air-gap path.

How MCPG replicas share state. The cluster coordinator selection (single_node, redis, nats, consul, etcd), the real per-backend config keys, and the primitive-inheritance model that makes single-node work out of the box.

Serve multiple teams or customers from one MCPG gateway — tenant identity from claims, per-tenant tool allowlists, rate limits, and hard isolation via the operator's MCPGTenant CRD.

Run MCPG with no outbound internet — an in-cluster OCI mirror for plugins, an offline Sigstore trust root so signature verification still works, and IaC that distributes modules from your own registry.

Install the MCPG Kubernetes operator and manage a gateway fleet with the terraform-mcpg module suite — CRDs, trust, plugins, gateways, and multi-tenant fan-out as declarative infrastructure (works on Terraform and OpenTofu).

The native terraform-provider-mcpg — typed MCPG custom resources with plan-time validation that mirrors the operator's admission webhook, so bad input fails locally before it reaches the cluster.

Run the MCPG module suite and native provider on OpenTofu, with native client-side state and plan encryption plus OCI-registry distribution for air-gapped sites.

Install the MCPG operator and manage gateways with Pulumi — a typed CRD SDK, opinionated components, the config builder, and a CrossGuard policy pack that mirrors the operator's admission rules at preview.

Run the mcpg-cloud-relay broker inside your own trust boundary — listeners, authentication (static tokens or control-plane entitlements), TLS and DNS, rate limits, and how tunnelling gateways dial in.