snow-flow 1.1.75 → 1.1.76

package/k8s/ingress.yaml

@@ -0,0 +1,361 @@
+# Ingress configuration for ServiceNow MCP services
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mcp-ingress
+  namespace: servicenow-mcp
+  labels:
+    app.kubernetes.io/name: servicenow-mcp
+    app.kubernetes.io/component: ingress
+  annotations:
+    # nginx ingress controller annotations
+    kubernetes.io/ingress.class: "nginx"
+    nginx.ingress.kubernetes.io/rewrite-target: /$2
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      proxy_set_header Accept-Encoding "";
+      sub_filter '</head>' '<style>body { font-family: Arial, sans-serif; }</style></head>';
+      sub_filter_once on;
+    
+    # SSL and security
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    
+    # Rate limiting
+    nginx.ingress.kubernetes.io/limit-connections: "20"
+    nginx.ingress.kubernetes.io/limit-rps: "10"
+    
+    # Timeouts and buffering
+    nginx.ingress.kubernetes.io/proxy-connect-timeout: "5"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
+    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+    
+    # Custom headers
+    nginx.ingress.kubernetes.io/server-snippet: |
+      add_header X-Frame-Options DENY;
+      add_header X-Content-Type-Options nosniff;
+      add_header X-XSS-Protection "1; mode=block";
+      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
+
+spec:
+  tls:
+  - hosts:
+    - mcp.servicenow.local
+    - monitoring.servicenow.local
+    secretName: mcp-tls-secret
+
+  rules:
+  # Main MCP services endpoint
+  - host: mcp.servicenow.local
+    http:
+      paths:
+      # Health check endpoint
+      - path: /health
+        pathType: Exact
+        backend:
+          service:
+            name: nginx-lb
+            port:
+              number: 80
+      
+      # Individual MCP service paths
+      - path: /deployment-mcp(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: deployment-mcp
+            port:
+              number: 3001
+              
+      - path: /flow-composer-mcp(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: flow-composer-mcp
+            port:
+              number: 3002
+              
+      - path: /intelligent-mcp(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: intelligent-mcp
+            port:
+              number: 3003
+              
+      - path: /update-set-mcp(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: update-set-mcp
+            port:
+              number: 3004
+              
+      - path: /graph-memory-mcp(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: graph-memory-mcp
+            port:
+              number: 3005
+              
+      - path: /operations-mcp(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: operations-mcp
+            port:
+              number: 3006
+              
+      - path: /platform-development-mcp(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: platform-development-mcp
+            port:
+              number: 3007
+              
+      - path: /integration-mcp(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: integration-mcp
+            port:
+              number: 3008
+              
+      - path: /automation-mcp(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: automation-mcp
+            port:
+              number: 3009
+              
+      - path: /security-compliance-mcp(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: security-compliance-mcp
+            port:
+              number: 3010
+              
+      - path: /reporting-analytics-mcp(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: reporting-analytics-mcp
+            port:
+              number: 3011
+      
+      # Default path - load balancer status
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: nginx-lb
+            port:
+              number: 80
+
+  # Monitoring endpoints
+  - host: monitoring.servicenow.local
+    http:
+      paths:
+      # Grafana
+      - path: /grafana(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: grafana
+            port:
+              number: 3000
+      
+      # Prometheus
+      - path: /prometheus(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: prometheus
+            port:
+              number: 9090
+      
+      # AlertManager
+      - path: /alertmanager(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: alertmanager
+            port:
+              number: 9093
+      
+      # Consul UI
+      - path: /consul(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: consul
+            port:
+              number: 8500
+      
+      # Neo4j Browser
+      - path: /neo4j(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: neo4j
+            port:
+              number: 7474
+
+---
+# Alternative ingress for direct service access (development/debugging)
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mcp-direct-ingress
+  namespace: servicenow-mcp
+  labels:
+    app.kubernetes.io/name: servicenow-mcp
+    app.kubernetes.io/component: ingress-direct
+  annotations:
+    kubernetes.io/ingress.class: "nginx"
+    nginx.ingress.kubernetes.io/rewrite-target: /$2
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      add_header X-Debug-Direct-Access "true";
+    nginx.ingress.kubernetes.io/limit-connections: "5"
+    nginx.ingress.kubernetes.io/limit-rps: "5"
+
+spec:
+  tls:
+  - hosts:
+    - direct.mcp.servicenow.local
+    secretName: mcp-direct-tls-secret
+
+  rules:
+  - host: direct.mcp.servicenow.local
+    http:
+      paths:
+      # Direct access to individual services (for debugging)
+      - path: /deployment(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: deployment-mcp
+            port:
+              number: 3001
+              
+      - path: /flow-composer(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: flow-composer-mcp
+            port:
+              number: 3002
+              
+      - path: /intelligent(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: intelligent-mcp
+            port:
+              number: 3003
+              
+      - path: /update-set(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: update-set-mcp
+            port:
+              number: 3004
+              
+      - path: /graph-memory(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: graph-memory-mcp
+            port:
+              number: 3005
+              
+      - path: /operations(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: operations-mcp
+            port:
+              number: 3006
+              
+      - path: /platform-development(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: platform-development-mcp
+            port:
+              number: 3007
+              
+      - path: /integration(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: integration-mcp
+            port:
+              number: 3008
+              
+      - path: /automation(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: automation-mcp
+            port:
+              number: 3009
+              
+      - path: /security-compliance(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: security-compliance-mcp
+            port:
+              number: 3010
+              
+      - path: /reporting-analytics(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: reporting-analytics-mcp
+            port:
+              number: 3011
+
+---
+# TLS Certificate (using cert-manager)
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: mcp-tls-cert
+  namespace: servicenow-mcp
+  labels:
+    app.kubernetes.io/name: servicenow-mcp
+    app.kubernetes.io/component: security
+spec:
+  secretName: mcp-tls-secret
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+  - mcp.servicenow.local
+  - monitoring.servicenow.local
+
+---
+# Direct access TLS Certificate
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: mcp-direct-tls-cert
+  namespace: servicenow-mcp
+  labels:
+    app.kubernetes.io/name: servicenow-mcp
+    app.kubernetes.io/component: security
+spec:
+  secretName: mcp-direct-tls-secret
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+  - direct.mcp.servicenow.local

package/k8s/integration-mcp.yaml

@@ -0,0 +1,232 @@
+# ServiceNow Integration MCP Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: integration-mcp
+  namespace: servicenow-mcp
+  labels:
+    app.kubernetes.io/name: integration-mcp
+    app.kubernetes.io/instance: integration-mcp
+    app.kubernetes.io/version: "1.0.0"
+    app.kubernetes.io/component: mcp-service
+    app.kubernetes.io/part-of: servicenow-mcp
+    app.kubernetes.io/managed-by: kubectl
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: integration-mcp
+      app.kubernetes.io/instance: integration-mcp
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: integration-mcp
+        app.kubernetes.io/instance: integration-mcp
+        app.kubernetes.io/version: "1.0.0"
+        app.kubernetes.io/component: mcp-service
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "3008"
+        prometheus.io/path: "/metrics"
+    spec:
+      serviceAccountName: mcp-service-account
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001
+        runAsGroup: 1001
+        fsGroup: 1001
+      containers:
+      - name: integration-mcp
+        image: servicenow-mcp/integration-mcp:latest
+        imagePullPolicy: IfNotPresent
+        ports:
+        - name: http
+          containerPort: 3008
+          protocol: TCP
+        env:
+        - name: SERVICE_NAME
+          value: "integration-mcp"
+        - name: SERVER_PORT
+          value: "3008"
+        - name: SERVICE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: HOSTNAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        envFrom:
+        - configMapRef:
+            name: mcp-config
+        - secretRef:
+            name: servicenow-credentials
+        - secretRef:
+            name: neo4j-credentials
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: http
+          initialDelaySeconds: 30
+          periodSeconds: 30
+          timeoutSeconds: 10
+          failureThreshold: 3
+          successThreshold: 1
+        readinessProbe:
+          httpGet:
+            path: /ready
+            port: http
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+          successThreshold: 1
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        volumeMounts:
+        - name: tmp
+          mountPath: /tmp
+        - name: logs
+          mountPath: /app/logs
+      volumes:
+      - name: tmp
+        emptyDir: {}
+      - name: logs
+        emptyDir: {}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - integration-mcp
+              topologyKey: kubernetes.io/hostname
+      terminationGracePeriodSeconds: 30
+---
+# ServiceNow Integration MCP Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: integration-mcp
+  namespace: servicenow-mcp
+  labels:
+    app.kubernetes.io/name: integration-mcp
+    app.kubernetes.io/instance: integration-mcp
+    app.kubernetes.io/version: "1.0.0"
+    app.kubernetes.io/component: mcp-service
+    app.kubernetes.io/part-of: servicenow-mcp
+  annotations:
+    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
+spec:
+  type: ClusterIP
+  ports:
+  - port: 3008
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    app.kubernetes.io/name: integration-mcp
+    app.kubernetes.io/instance: integration-mcp
+---
+# ServiceNow Integration MCP Horizontal Pod Autoscaler
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: integration-mcp-hpa
+  namespace: servicenow-mcp
+  labels:
+    app.kubernetes.io/name: integration-mcp
+    app.kubernetes.io/instance: integration-mcp
+    app.kubernetes.io/component: autoscaler
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: integration-mcp
+  minReplicas: 2
+  maxReplicas: 6
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: 70
+  - type: Resource
+    resource:
+      name: memory
+      target:
+        type: Utilization
+        averageUtilization: 80
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 60
+      policies:
+      - type: Percent
+        value: 50
+        periodSeconds: 60
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+      - type: Percent
+        value: 25
+        periodSeconds: 60
+---
+# ServiceNow Integration MCP ServiceMonitor for Prometheus
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: integration-mcp
+  namespace: servicenow-mcp
+  labels:
+    app.kubernetes.io/name: integration-mcp
+    app.kubernetes.io/instance: integration-mcp
+    app.kubernetes.io/component: monitoring
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: integration-mcp
+      app.kubernetes.io/instance: integration-mcp
+  endpoints:
+  - port: http
+    interval: 30s
+    path: /metrics
+    scrapeTimeout: 10s
+---
+# ServiceNow Integration MCP Pod Disruption Budget
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: integration-mcp-pdb
+  namespace: servicenow-mcp
+  labels:
+    app.kubernetes.io/name: integration-mcp
+    app.kubernetes.io/instance: integration-mcp
+    app.kubernetes.io/component: availability
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: integration-mcp
+      app.kubernetes.io/instance: integration-mcp
+---