Skip to content

[chore][MCP] Configure backend MCP service ingress domain #352

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
arnold-retool wants to merge 1 commit into
base: main
Choose a base branch
from
+40 −14
Open

[chore][MCP] Configure backend MCP service ingress domain #352

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions charts/retool/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,31 @@ env.BASE_DOMAIN. Secret-backed values cannot be resolved at template time.
{{- trimSuffix "/" (trimPrefix "http://" (trimPrefix "https://" (toString $domain))) -}}
{{- end }}

{{/*
MCP Service env var for the main Retool backend. Explicit backend env settings
take precedence over the chart-generated in-cluster Service URL.
*/}}
{{- define "retool.mcp.backendEnvVars" -}}
{{- if .Values.mcp.enabled }}
{{- $backendHasMcpServiceIngressDomain := hasKey (.Values.env | default dict) "MCP_SERVICE_INGRESS_DOMAIN" -}}
{{- range .Values.environmentSecrets }}

@lukefoster11 lukefoster11 Jul 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if we need to check all these different places for MCP_SERVICE_INGRESS_DOMAIN being defined. I think we can narrow these checks down to just .Values.env.
Also wondering if there's ever even a case where the MCP_SERVICE_INGRESS_DOMAIN shouldn't just be set to value: {{ printf "http://%s:%v" (include "retool.mcp.name" .) ($mcpService.externalPort | default 4010) | quote }}? Should we even allow overriding this default?

@arnold-retool arnold-retool Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Just .Values.env could make setup less straightforward for users with .environmentSecrets and .environmentVariables in their charts.
  • An override is generally useful in cases with custom networking. I can't imagine users taking advantage of this override to break things for themselves.

Thanks for the comment! Let me know if you feel strongly about either of these.

{{- if eq .name "MCP_SERVICE_INGRESS_DOMAIN" }}
{{- $backendHasMcpServiceIngressDomain = true }}
{{- end }}
{{- end }}
{{- range .Values.environmentVariables }}
{{- if eq .name "MCP_SERVICE_INGRESS_DOMAIN" }}
{{- $backendHasMcpServiceIngressDomain = true }}
{{- end }}
{{- end }}
{{- if not $backendHasMcpServiceIngressDomain }}
{{- $mcpService := .Values.mcp.service | default dict }}
- name: MCP_SERVICE_INGRESS_DOMAIN
value: {{ printf "http://%s:%v" (include "retool.mcp.name" .) ($mcpService.externalPort | default 4010) | quote }}
{{- end }}
{{- end }}
{{- end -}}

{{/*
Render an MCP-related Ingress path. By default paths route to the MCP service.
target: backendInternal routes to the backend API Service.
Expand Down
1 change: 1 addition & 0 deletions charts/retool/templates/deployment_backend.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@ spec:
- name: CODE_EXECUTOR_INGRESS_DOMAIN
value: http://{{ template "retool.codeExecutor.name" . }}
{{- end }}
{{- include "retool.mcp.backendEnvVars" . | nindent 10 }}
{{- include "retool.agentSandbox.backendEnvVars" . | nindent 10 }}
{{- if ($temporalConfig).sslEnabled }}
- name: WORKFLOW_TEMPORAL_TLS_ENABLED
Expand Down
14 changes: 7 additions & 7 deletions charts/retool/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -734,14 +734,14 @@ mcp:
# Retool 4.0.7 and later support a simplified ingress setup: route all public
# paths, including /mcp and /.well-known, to the main Retool Service on port
# 3000. The main backend must also be able to relay /mcp to the in-cluster MCP
# Service. Set its internal URL through the top-level env block:
# Service. When mcp.enabled is true, the chart configures the backend with
# MCP_SERVICE_INGRESS_DOMAIN=http://<fullname>-mcp:<service.externalPort>.
# You can override it through the top-level env, environmentSecrets, or
# environmentVariables settings.
#
# env:
# MCP_SERVICE_INGRESS_DOMAIN: http://<fullname>-mcp:4010
#
# With that backend setting, omit or disable the MCP-specific ingress or
# HTTPRoute rules below and keep only the normal "/" route to
# <fullname>:3000. Replace <fullname> with this chart release's full name.
# With that setting, omit or disable the MCP-specific ingress or HTTPRoute
# rules below and keep only the normal "/" route to <fullname>:3000. Replace
# <fullname> with this chart release's full name.
#
# Retool versions before 4.0.7 require the explicit MCP routes below,
# rendered before the main Retool route. External ingress must preserve this
Expand Down
14 changes: 7 additions & 7 deletions values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -734,14 +734,14 @@ mcp:
# Retool 4.0.7 and later support a simplified ingress setup: route all public
# paths, including /mcp and /.well-known, to the main Retool Service on port
# 3000. The main backend must also be able to relay /mcp to the in-cluster MCP
# Service. Set its internal URL through the top-level env block:
# Service. When mcp.enabled is true, the chart configures the backend with
# MCP_SERVICE_INGRESS_DOMAIN=http://<fullname>-mcp:<service.externalPort>.
# You can override it through the top-level env, environmentSecrets, or
# environmentVariables settings.
#
# env:
# MCP_SERVICE_INGRESS_DOMAIN: http://<fullname>-mcp:4010
#
# With that backend setting, omit or disable the MCP-specific ingress or
# HTTPRoute rules below and keep only the normal "/" route to
# <fullname>:3000. Replace <fullname> with this chart release's full name.
# With that setting, omit or disable the MCP-specific ingress or HTTPRoute
# rules below and keep only the normal "/" route to <fullname>:3000. Replace
# <fullname> with this chart release's full name.
#
# Retool versions before 4.0.7 require the explicit MCP routes below,
# rendered before the main Retool route. External ingress must preserve this
Expand Down
Loading