Red Hat Connectivity Link

MCP install references

You can use the following API and route reference information for MCP gateway installation tasks.

The MCPGatewayExtension custom resource API reference

You can use the following API reference information for each MCP gateway MCPGatewayExtension custom resource (CR).

Table 17. MCPGatewayExtension
Field	Type	Required	Description
`spec`	MCPGatewayExtensionSpec	Yes	The specification for MCPGatewayExtension custom resource
`status`	MCPGatewayExtensionStatus	No	The status for the custom resource

Table 18. MCPGatewayExtensionSpec
Field	Type	Required	Description
`targetRef`	MCPGatewayExtensionTargetReference	Yes	The Gateway listener to extend with MCP protocol support
`publicHost`	String	No	Overrides the public host derived from the listener hostname. Use when the listener has a wildcard and you need a specific host
`privateHost`	String	No	Overrides the internal host used for hair-pinning requests back through the gateway. Defaults to `<gateway>-istio.<ns>.svc.cluster.local:<port>`, with an `https://` scheme prefix when the targeted Gateway listener uses the HTTPS protocol. The supplied value is honoured verbatim, so an operator can include a scheme, for example, `https://my-gw:443`, or pin to a different port.
`backendPingIntervalSeconds`	Integer	No	How often (in seconds) the broker pings upstream MCP servers. Min: 10, Max: 7200, Default: 60
`trustedHeadersKey`	TrustedHeadersKey	No	Configures trusted-header key pair for JWT-based tool filtering. When set, the public key secret is injected into the broker deployment with the `TRUSTED_HEADER_PUBLIC_KEY` environment variable.
`httpRouteManagement`	String	No	Controls whether the operator manages the gateway `HTTPRoute` CR. The default value is `Enabled`: creates and manages the `HTTPRoute` CR. `Disabled`: does not create an `HTTPRoute` CR. Disabling does not delete a route that was created before.
`sessionStore`	SessionStore	No	References a secret for Redis-based session storage. When not set, in-memory session storage is used.
`urlElicitation`	String	No	Controls URL-based token elicitation. `Enabled`: creates a separate `/tokens` HTTPRoute and passes `--enable-url-elicitation` to the broker. `Disabled` (default): no `/tokens` route is created.

Table 19. MCPGatewayExtensionTargetReference
Field	Type	Required	Description
`group`	String	Yes	Group of the target resource. Default: `gateway.networking.k8s.io`
`kind`	String	Yes	Kind of the target resource. Default: `Gateway`
`name`	String	Yes	Name of the target Gateway
`namespace`	String	No	Namespace of the target Gateway. Defaults to the MCPGatewayExtension namespace. Cross-namespace references require a ReferenceGrant
`sectionName`	String	Yes	Name of a listener on the target Gateway. The controller reads the listener’s port and hostname to configure the MCP Gateway instance

Table 20. TrustedHeadersKey
Field	Type	Required	Description
`secretName`	String	Yes	Name of the secret containing the PEM-encoded public key used by the broker to verify trusted-header JWTs. The secret must have a data entry with key `key`. When `generate` is `Enabled`, the operator creates this secret
`generate`	String	No	Controls whether the operator generates an ECDSA P-256 key pair. `Enabled`: creates `<secretName>` (public key) and `<secretName>-private` (private key) with owner references. `Disabled` (default): the secret must already exist. Changing this field requires deleting the existing secrets first to ensure the keys are a matching pair

Table 21. SessionStore
Field	Type	Required	Description
`secretName`	String	Yes	Name of the secret containing a `CACHE_CONNECTION_STRING` data entry. The value should be a Redis connection string such as `redis://<user>:<pass>@<host>:<port>/<db>`. The secret must exist in the same namespace as the `MCPGatewayExtension` CR and must have the label `mcp.kuadrant.io/secret: "true"`. Injected as `CACHE_CONNECTION_STRING` environment variable into the MCP broker-router component deployment.

Table 22. MCPGatewayExtensionStatus
Field	Type	Required	Description
`conditions`	Kubernetes meta/v1.Condition	Yes	List of conditions that define the status of the resource

Table 23. Conditions
Type	Description
`Ready`	Indicates whether the `MCPGatewayExtension` is fully configured as follows: the broker-router deployment is running, the EnvoyFilter is applied, and trusted headers, if configured, are valid.

Table 24. Condition reasons
Reason	Description
`ValidMCPGatewayExtension`	The `MCPGatewayExtension` is valid and ready.
`InvalidMCPGatewayExtension`	Invalid configuration detected.
`ReferenceGrantRequired`	A `ReferenceGrant` is missing for a cross-namespace `Gateway` reference.
`DeploymentNotReady`	The broker-router deployment is not ready.
`SecretNotFound`	A referenced secret is missing, specifically the trusted headers or session store.
`SecretInvalid`	A referenced secret lacks the required data entry: `key` for trusted headers, `CACHE_CONNECTION_STRING` for session store.

Automatically created HTTPRoute example

Applying the MCPGatewayExtension custom resources (CR) generates an automatic HTTPRoute CR. The following is an example of the route.

Example automatically generated HTTPRoute CR

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: mcp-gateway-route
  namespace: mcp-gateway-namespace
spec:
  parentRefs:
  - name: mcp-gateway
    namespace: gateway-namespace
    sectionName: mcp
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /mcp
    backendRefs:
    - name: mcp-gateway
      port: 8080

The value of the spec.parentRefs.name: parameter matches your Gateway CR name.
The value of the spec.parentRefs.namespace: parameter matches your Gateway namespace.
The value of the spec.parentRefs.sectionName: parameter matches the spec.listeners[*].name value of your Gateway object listener.
The value of the spec.rules.backendRefs.name: is the Kubernetes service for your MCP gateway.
The value of the spec.rules.backendRefs.port: is the port that the MCP gateway is listening on.