Kubernetes

Run MCPG the way you run everything else.

Native CRDs reconcile gateways, plugin sets, individual plugins, and revocation lists. The Helm chart deploys HA fleets with auto-scaling, PodDisruptionBudgets, and your choice of NATS or Redis for shared state.

bash

# Operator
helm install mcpg-operator ./helm/charts/mcpg-operator

# A single gateway instance
helm install mcpg ./helm/charts/mcpg

# HA fleet with NATS for cluster state
helm install mcpg ./helm/charts/mcpg \
  --set replicaCount=3 \
  --set nats.enabled=true \
  --set autoscaling.enabled=true \
  --set podDisruptionBudget.enabled=true

CRDs

Four custom resources.

MCPGGateway

A running gateway instance. Bindings, identity chains, plugin sets — all declarative. Reconciles to a Deployment + Service + ConfigMaps.

MCPGPluginSet

A named, content-hashed bundle of plugin references. Bind to gateways via pluginSetRef; updates roll out automatically.

MCPGPlugin

A single plugin reference — OCI image, Ed25519 public key for signature verify, capability grants, secret materialization rules.

MCPGRevocationList

Signed list of revoked plugin artifact hashes. Operators block compromised plugins fleet-wide without redeploying.

Production-ready

The features SREs actually need.

Replica count + HPA

PodDisruptionBudget

Health + readiness probes

Rolling updates, no-drop

NATS or Redis for shared state

PostgreSQL or SQLite (CP)

NetworkPolicy templates

PriorityClass templates

ServiceMonitor (Prometheus Operator)

Kubernetes install guide