Run MCPG the way you run everything else.
Native CRDs reconcile gateways, plugin sets, individual plugins, revocation lists, cluster state, tenant routes, air-gap mirrors, and tenants. The Helm chart deploys HA fleets with auto-scaling, PodDisruptionBudgets, and your choice of NATS or Redis for shared state.
# Operator
helm install mcpg-operator ./helm/charts/mcpg-operator
# A single gateway instance
helm install mcpg ./helm/charts/mcpg
# HA fleet with NATS for cluster state
helm install mcpg ./helm/charts/mcpg \
--set replicaCount=3 \
--set nats.enabled=true \
--set autoscaling.enabled=true \
--set podDisruptionBudget.enabled=trueEight custom resources.
A running gateway instance. Bindings, identity chains, plugin sets — all declarative. Reconciles to a Deployment + Service + ConfigMaps.
A named, content-hashed bundle of plugin references. Bind to gateways via pluginSetRef; updates roll out automatically.
A single plugin reference — OCI image, Ed25519 public key for signature verify, capability grants, secret materialization rules.
Signed list of revoked plugin artifact hashes. Operators block compromised plugins fleet-wide without redeploying.
Binds a gateway fleet to shared cluster state — NATS, Redis, etcd, or Consul — so instances coordinate sessions, limits, and tasks for HA.
Tenant-scoped routing into a shared gateway: fan per-tenant tool access into one endpoint for soft multi-tenancy.
An in-cluster OCI mirror for air-gapped installs — rehomes plugin references and rewrites pulls fail-closed against an offline trust root.
A declarative tenant boundary — owned namespaces, a plugin allowlist, and resource quotas, enforced by the controller and admission webhook.