Skip to content

fix: set --allowed-hosts for bundled grafana-mcp deployment#2260

Open
muskiteer wants to merge 2 commits into
kagent-dev:mainfrom
muskiteer:fix-grafana-mcp-allowed-hosts
Open

fix: set --allowed-hosts for bundled grafana-mcp deployment#2260
muskiteer wants to merge 2 commits into
kagent-dev:mainfrom
muskiteer:fix-grafana-mcp-allowed-hosts

Conversation

@muskiteer

Copy link
Copy Markdown

Description

What does this PR do?
This PR fixes an out-of-the-box initialization failure for the bundled grafana-mcp deployment.

Why is it needed?
Currently, when kagent-grafana-mcp is enabled in the default Helm chart, it fails to initialize as a RemoteMCPServer because of a Forbidden error. This happens because recent versions of mcp-grafana validate the HTTP Host header for streamable-http transports as DNS rebinding protection (introduced in grafana/mcp-grafana#957). Without passing --allowed-hosts matching the internal Kubernetes service DNS name, requests from the Kagent controller are rejected.

How does this fix it?
This automatically resolves the Kubernetes Service DNS name natively generated by the chart (<fullname>.<namespace>:<port>) and appends it to the container's --allowed-hosts arguments in the deployment spec. This ensures the bundled integration works immediately without manual configuration.

Testing

How was this tested?

  1. Deployed a local Kind cluster (make create-kind-cluster).
  2. Installed kagent with the default chart values (make helm-install), which enabled grafana-mcp.
  3. Verified that the kagent-grafana-mcp RemoteMCPServer successfully transitions to Accepted: True instead of ReconcileFailed: Forbidden.

Fixes #2166

Fixes kagent-dev#2166

Signed-off-by: muskiteer <agarwal.vansh3110@gmail.com>
Signed-off-by: muskiteer <agarwal.vansh3110@gmail.com>
@muskiteer
muskiteer requested a review from a team as a code owner July 15, 2026 14:03
Copilot AI review requested due to automatic review settings July 15, 2026 14:03
@github-actions github-actions Bot added the bug Something isn't working label Jul 15, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes the bundled grafana-mcp Helm deployment so it can be initialized successfully as a RemoteMCPServer when using streamable-http, by automatically adding an --allowed-hosts value that matches the chart-generated Kubernetes Service DNS name.

Changes:

  • Add --allowed-hosts=<fullname>.<namespace>:<service.port> to the grafana-mcp container args in the Helm Deployment template.
  • Add a Helm unit test assertion verifying the rendered Deployment includes the expected --allowed-hosts argument.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
helm/tools/grafana-mcp/templates/deployment.yaml Automatically injects --allowed-hosts based on the chart’s generated Service hostname and port.
helm/tools/grafana-mcp/tests/deployment_test.yaml Adds coverage to ensure --allowed-hosts is present in the rendered container args.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] RemoteMCPServer initialization fails with Forbidden when using bundled kagent-grafana-mcp defaults

2 participants