fix: set --allowed-hosts for bundled grafana-mcp deployment

[muskiteer]

Description

What does this PR do?
This PR fixes an out-of-the-box initialization failure for the bundled grafana-mcp deployment.

Why is it needed?
Currently, when kagent-grafana-mcp is enabled in the default Helm chart, it fails to initialize as a RemoteMCPServer because of a Forbidden error. This happens because recent versions of mcp-grafana validate the HTTP Host header for streamable-http transports as DNS rebinding protection (introduced in grafana/mcp-grafana#957). Without passing --allowed-hosts matching the internal Kubernetes service DNS name, requests from the Kagent controller are rejected.

How does this fix it?
This automatically resolves the Kubernetes Service DNS name natively generated by the chart (<fullname>.<namespace>:<port>) and appends it to the container's --allowed-hosts arguments in the deployment spec. This ensures the bundled integration works immediately without manual configuration.

Testing

How was this tested?

1. Deployed a local Kind cluster (make create-kind-cluster).
2. Installed kagent with the default chart values (make helm-install), which enabled grafana-mcp.
3. Verified that the kagent-grafana-mcp RemoteMCPServer successfully transitions to Accepted: True instead of ReconcileFailed: Forbidden.

Fixes #2166

[Copilot]

Pull request overview

This PR fixes the bundled grafana-mcp Helm deployment so it can be initialized successfully as a RemoteMCPServer when using streamable-http, by automatically adding an --allowed-hosts value that matches the chart-generated Kubernetes Service DNS name.

Changes:

• Add --allowed-hosts=<fullname>.<namespace>:<service.port> to the grafana-mcp container args in the Helm Deployment template.
• Add a Helm unit test assertion verifying the rendered Deployment includes the expected --allowed-hosts argument.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
helm/tools/grafana-mcp/templates/deployment.yaml	Automatically injects --allowed-hosts based on the chart’s generated Service hostname and port.
helm/tools/grafana-mcp/tests/deployment_test.yaml	Adds coverage to ensure --allowed-hosts is present in the rendered container args.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[muskiteer]

I've made allowedHosts configurable and added sensible defaults for the Kubernetes Service DNS variants while still allowing users to override them (including ["*"]). I've also added tests covering the default and custom configurations.

Happy to receive any further feedback @mesutoezdil @onematchfox

[mesutoezdil]

and branch is out-of-date