feat(toolhive): add truenas-mcp in read-only mode - #4671
Draft
Tanguille wants to merge 3 commits into
Draft
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueWarning Your free Security trial is over. An organization admin can activate billing to continue. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@@ (root level) @@
# toolhive.stacklok.dev/v1beta1/MCPServer/ai/truenas
! + one document added:
+ apiVersion: toolhive.stacklok.dev/v1beta1
+ kind: MCPServer
+ metadata:
+ name: truenas
+ namespace: ai
+ labels:
+ app.kubernetes.io/name: toolhive
+ kustomize.toolkit.fluxcd.io/name: toolhive
+ kustomize.toolkit.fluxcd.io/namespace: ai
+ spec:
+ resources:
+ limits:
+ cpu: 200m
+ memory: 128Mi
+ requests:
+ cpu: 10m
+ memory: 32Mi
+ image: "ghcr.io/tanguille/truenas-mcp:v0.0.6"
+ transport: stdio
+ groupRef:
+ name: all
+ permissionProfile:
+ name: network
+ type: builtin
+ env:
+ - name: TRUENAS_URL
+ value: "https://truenas...PLACEHOLDER_SECRET_DOMAIN.."
+ secrets:
+ - name: truenas-mcp
+ key: TRUENAS_API_KEY
+ targetEnvName: TRUENAS_API_KEY
+ podTemplateSpec:
+ spec:
+ containers:
+ - name: mcp
+ resources:
+ limits:
+ cpu: 200m
+ memory: 128Mi
+ requests:
+ cpu: 10m
+ memory: 32Mi
|
Add the hongkongkiwi/truenas-master-mcp server (v0.1.11, digest-pinned) to the ToolHive optimizer as an MCPServer: - streamable-http on :3000, proxyPort 8080, group 'all' - --readonly: modification tools disabled at the tool layer - API key from a dedicated truenas-mcp SOPS secret (placeholder, to be encrypted with a minimal read-only key from System -> Operators -> API Keys) - permissionProfile builtin/network for LAN egress (same pattern as talos-mcp) - reached via the existing internal TLSRoute truenas.tanguille.site, so TLS verification stays ON (verified: Let's Encrypt *.tanguille.site, HTTP 404/401 from the TrueNAS API without a key)
Rework PR for the TrueNAS 26 switch: truenas-master-mcp (third-party,
stale since 2026-01, pure REST) 404s on 26 where the REST API is gone.
The official truenas/truenas-mcp speaks the JSON-RPC WebSocket API 26
serves (wss + auth.login_with_api_key) and is maintained by iXsystems.
- docker/truenas-mcp/Dockerfile: thin glibc wrapper around the official
v0.0.6 static Go release binary (sha256-verified from checksums.txt);
upstream ships no container image
- .github/workflows/truenas-mcp-image.yaml: build+publish
ghcr.io/tanguille/truenas-mcp on docker/truenas-mcp changes; the
VERSION ARG is the single Renovate bump point so tag and fetched
release cannot drift
- config/truenas.yaml: transport stdio (the official binary has no HTTP
server mode), no mcpPort/proxyPort/httpGet probes; TRUENAS_URL is the
public Let's Encrypt name (truenas.${SECRET_DOMAIN}) so TLS stays
verified (the in-cluster name is not in the cert SAN); read-only
posture now rests on the minimal API key because the official binary
has no --readonly flag; dedicated truenas-mcp SOPS secret unchanged
Image is tag-pinned (v0.0.6) until the first CI build publishes it; the
digest pin lands in a follow-up commit after the first successful build.
Tanguille
force-pushed
the
feat/truenas-mcp
branch
from
August 26, 2026 20:49
07d3378 to
8df8aa9
Compare
The fetch stage renamed the download to truenas-mcp.tar.gz, but checksums.txt records the asset under its release name (truenas-mcp-linux-amd64.tar.gz). sha256sum -c matches on the recorded filename, so the renamed tarball made it "no file was verified" (exit 1) even with --ignore-missing, and the build failed before the COPY. Download to the exact name checksums.txt references. Add a CI step that prints the published manifest-list digest so the MCPServer manifest can pin tag@sha256: instead of a mutable tag.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the hongkongkiwi/truenas-master-mcp server (v0.1.11, digest-pinned) to the ToolHive optimizer as a read-only MCPServer for live TrueNAS inspection (pools, SMART, datasets, apps, VMs, tasks).
Changes
Verification
Note
Kept as a DRAFT until a real (minimal, read-only) TrueNAS API key is encrypted into the SOPS secret. The server runs --readonly regardless, so the key is double-locked.