[Gap]: Document in-cluster connector discovery network prerequisites and recovery
维护者通常 1 天内回复
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 78/100
- Issue 类型
- 文档
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- helm, kubernetes
调研方向
先从 docs/connector-gateway/connectors.mdx 以及平台配置和部署页面开始，然后对比 API schema 中 allow_private_ips 的描述。记录 Helm allowlist 值、Service CIDR 发现、connector 状态检查、重新保存后的恢复，以及目录组授权。完成的标准是：无需依赖特定于 kind 的 CIDR，发现到提供服务的路径和故障排查顺序都清晰明确。
由索引模型根据 Issue 内容生成。
描述
What needs documentation?
The Manage connectors page says discovery picks up MCP servers running in the cluster and that activating a connector performs an endpoint check. It does not explain the operator-side network prerequisite that makes those discovered in-cluster endpoints pass the check.
Document the complete discovery-to-serving path:
- Discovery returns an in-cluster Service endpoint and recommends
allow_private_ips: truefor that candidate. allow_private_ipsalone does not authorize Enterprise Manager's verification dial to arbitrary private addresses.- The platform operator must configure
enterprise-manager.directory.connectorVerification.allowedPrivateRangeswith the cluster ranges that discovered endpoints may use. - For Kubernetes Service endpoints, the value must include the cluster's actual Service CIDR. Operators should derive it from the target cluster rather than copy a kind-specific default.
- Without the allowlist, connector creation can succeed while the connector is persisted in
failure; onlyavailableconnectors are served. - After fixing the allowlist, an existing failed connector must be updated/re-saved to trigger verification again. A Helm upgrade alone does not re-check persisted rows.
- A newly available connector still needs directory-group grants before non-admin users can see it.
Include a values example and a verification/troubleshooting sequence that checks connector status after admission.
Context and references
The platform's operator-allowlist design was implemented by:
https://github.com/stacklok/stacklok-enterprise-platform/issues/3644
The current public API schema documents that the discovery result's allow_private_ips value is only a recommendation, but it does not lead operators to the Helm allowlist or explain why a successful create remains unserved.
Relevant source pages:
docs/connector-gateway/connectors.mdxdocs/platform/enterprise-platform/configure-connector-gateway.mdxdocs/platform/enterprise-platform/deployment.mdxstatic/api-specs/enterprise-manager-api.json
Use case
As a platform operator importing MCP servers discovered in Kubernetes, I need to authorize the correct private cluster range and know how to recover failed verification, so that discovered connectors become available without weakening the SSRF boundary or hardcoding a distribution-specific CIDR.
- 主要语言
- JavaScript
- 星标
- 4
- 派生
- 4
- 平均合并
- 22 小时 31 分钟
- 30 天内合并 PR
- 70
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
stacklok/docs-website 的其他 Issue
-
documentation enhancement needs-triage
难度 2/5 1-3 小时 新手友好度 82/100
stacklok/docs-website#1258 ·
维护者通常 1 天内回复
-
documentation enhancement needs-triage
难度 1/5 1 小时以内 新手友好度 85/100
stacklok/docs-website#1241 ·
维护者通常 1 天内回复
-
bug documentation needs-triage
难度 2/5 1-3 小时 新手友好度 72/100
stacklok/docs-website#1149 · 2 条评论 ·
维护者通常 1 天内回复
-
needs-triage
难度 2/5 1-3 小时 新手友好度 68/100
stacklok/docs-website#1143 ·
维护者通常 1 天内回复
-
needs-triage
难度 2/5 1-3 小时 新手友好度 72/100
stacklok/docs-website#564 · 1 条评论 ·
维护者通常 1 天内回复
查看 stacklok/docs-website 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 84/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 72/100
thedevs-network/kutt#1059 ·
-
good first issue help wanted
难度 2/5 1-3 小时 新手友好度 72/100
-
难度 1/5 1 小时以内 新手友好度 82/100
维护者通常 1 天内回复
-
0. Needs triage 35-feedback bug
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复