Repository navigation
docs(examples): add Traefik Hub Gateway with the Traefik MCP server as a sidecar - #2007
Merged
Merged
Conversation
mloiseleur
reviewed
Sep 22, 2026
mloiseleur
reviewed
Sep 22, 2026
mloiseleur
reviewed
Sep 22, 2026
emilevauge
changed the title
mloiseleur
reviewed
Sep 22, 2026
mloiseleur
reviewed
Sep 22, 2026
mloiseleur
reviewed
Sep 22, 2026
mloiseleur
reviewed
Sep 22, 2026
mloiseleur
reviewed
Sep 22, 2026
mloiseleur
reviewed
Sep 22, 2026
mloiseleur
added
bot/no-merge
area/documentation
mloiseleur
approved these changes
Oct 15, 2026
Verify tokens with a shared secret instead of an external JWKS, route on mcp.docker.localhost with the default certificate, mint the test token with openssl, and drop the -traefik.api-url flag, whose default already is http://localhost:8080.
Keep the sidecar, hub-token reuse, API and the extra Service. Point to the Hub MCP Gateway docs for JWT and per-tool policies.
mloiseleur
force-pushed
the
docs/mcp-server-sidecar
branch
from
October 15, 2026 15:16
70e3df2 to
26de68e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds an example to
EXAMPLES.mdshowing how to run the Traefik MCP server (traefik/mcp-serveron Docker Hub and GHCR) as a sidecar of the Traefik pod withdeployment.additionalContainers, and how to publish it through the Traefik Hub MCP Gateway (hub.mcpgateway.enabled) with a JWT middleware for authentication and an MCP middleware for per-tool authorization.The example covers the Helm values, the extra
Servicefor port 8090, the two middlewares, theIngressRoute, a quick check, and a warning on why the sidecar must carry no readiness or liveness probe.Motivation
The MCP server gives an AI agent a live, read-only view of a running Traefik or Traefik Hub gateway. The sidecar behind the MCP Gateway is the deployment model that lets agents reach it without a kubeconfig, with declarative, per-tool authorization. The chart already has everything needed (
additionalContainers,hub.token,hub.mcpgateway), so an example is all that is missing.Verified on kind (Kubernetes v1.36.1) with chart 41.4.0, Traefik Hub v3.21 and
traefik/mcp-server:v0.0.1, using exactly the values and manifests of the example: the sidecar accepts the licence from the chart'shub-tokenvolume and reads the live routers over loopback; through the gateway, no token gets 401 withWWW-Authenticate, a foreign group getsForbidden,traefik-supportlists every tool butlist_certificates, andtraefik-operatorscan see and call it.More
make testand all the tests passed (documentation only;markdownlintonEXAMPLES.mdpasses with the repo config)