Lab Status MCP example — validated on 2026-10-21

This is custom lab software, not a VMware product component.
Prerequisites: the browser chat app from the previous article, its pais-chat
namespace, TLS Secret, trusted CA, private Harbor pull Secret, and an application
VKS kubeconfig. Do not apply the example to Supervisor or the PAIS runtime cluster.
Replace lab.example.com hostnames in deployment.yaml and nginx.conf.
The server deliberately fixes namespace pais-chat and only exposes status fields.
The shared X-MCP-Key is a static service credential, not MCP OAuth authorization.
HTTPS ends at the existing NGINX proxy; ClusterIP traffic is HTTP inside VKS.
Limit network reachability accordingly. Readiness only checks the HTTP process.

1. Select application VKS context; kubectl get pods -n pais-chat.
2. docker login harbor.lab.example.com using the existing uploader account.
3. docker build -t harbor.lab.example.com/ai-apps/lab-status-mcp:1.0.1 .
4. docker push harbor.lab.example.com/ai-apps/lab-status-mcp:1.0.1
5. Pin deployment.yaml to the pushed digest (do not use the lab's digest).
6. Generate and store a random key; create Secret lab-status-mcp-key, key token.
7. kubectl apply -f deployment.yaml
8. kubectl rollout status deployment/lab-status-mcp -n pais-chat
9. Back up existing chat Deployment and NGINX configuration. Merge the /mcp
   location from nginx.conf into the current configuration, preserving other routes.
10. kubectl create configmap pais-chat-nginx-mcp -n pais-chat --from-file=nginx.conf
11. kubectl patch deployment pais-chat -n pais-chat --type strategic --patch-file chat-patch.json
12. kubectl rollout status deployment/pais-chat -n pais-chat
13. Register https://chat.lab.example.com/mcp in PAIS, Streamable HTTP, Full Verification.
    Add Credential Header X-MCP-Key with the same key. Do not post the key publicly.
14. Approve only get_chat_workload_status. Attach it to the existing Llama agent.
15. Ask: Call get_chat_workload_status with scope="chat" now. Report observedAt
    and ready replicas for pais-chat. Match the timestamp to MCP pod tool_called logs.

Rollback: remove the tool from the agent first; unapprove it. Restore the previous
chat Deployment/configuration; remove the MCP resources only after confirming no
consumers remain. Do not delete the existing chat namespace or shared TLS/pull Secrets.
Rotation: replace the Kubernetes token Secret and PAIS credential header together,
then restart MCP because this implementation reads its key at process startup.
