fix: set --allowed-hosts for bundled grafana-mcp deployment

helm/tools/grafana-mcp/templates/_helpers.tpl

@@ -75,4 +75,19 @@ Join registry/repository for grafana-mcp image, skipping empty segments, then ap
 {{- $img := .Values.image -}}
 {{- $parts := compact (list $img.registry $img.repository) -}}
 {{- printf "%s:%s" (join "/" $parts) $img.tag -}}
+{{- end -}}
+
+{{- define "grafana-mcp.allowedHosts" -}}
+{{- if .Values.allowedHosts -}}
+{{- join "," .Values.allowedHosts -}}
+{{- else -}}
+{{- $fullname := include "grafana-mcp.fullname" . -}}
+{{- $ns := .Release.Namespace -}}
+{{- $port := .Values.service.port | int -}}
+{{- join "," (list (printf "%s:%d" $fullname $port)
+                   (printf "%s.%s:%d" $fullname $ns $port)
+                   (printf "%s.%s.svc:%d" $fullname $ns $port)
+                   (printf "%s.%s.svc.cluster.local:%d" $fullname $ns $port)
+                   (printf "localhost:%d" $port)) -}}
+{{- end -}}
 {{- end -}}

helm/tools/grafana-mcp/templates/deployment.yaml

@@ -40,6 +40,7 @@ spec:
           args:
             - --transport
             - streamable-http
+            - --allowed-hosts={{ include "grafana-mcp.allowedHosts" . }}
             {{- with .Values.args }}
             {{- toYaml . | nindent 12 }}
             {{- end }}

helm/tools/grafana-mcp/tests/deployment_test.yaml

@@ -119,4 +119,32 @@ tests:
           value: grafana:latest
       - notMatchRegex:
           path: spec.template.spec.containers[0].image
-          pattern: "^/"          # no leading slash
+          pattern: "^/"          # no leading slash
+
+  - it: should configure allowed-hosts with default DNS variants
+    template: deployment.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --allowed-hosts=RELEASE-NAME-grafana-mcp:8000,RELEASE-NAME-grafana-mcp.NAMESPACE:8000,RELEASE-NAME-grafana-mcp.NAMESPACE.svc:8000,RELEASE-NAME-grafana-mcp.NAMESPACE.svc.cluster.local:8000,localhost:8000
+
+  - it: should use custom allowedHosts when configured
+    template: deployment.yaml
+    set:
+      allowedHosts:
+        - "custom-host:8000"
+        - "*.kagent:8000"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --allowed-hosts=custom-host:8000,*.kagent:8000
+
+  - it: should allow wildcard allowedHosts
+    template: deployment.yaml
+    set:
+      allowedHosts:
+        - "*"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --allowed-hosts=*

helm/tools/grafana-mcp/values.yaml

@@ -50,6 +50,13 @@ resources:
     cpu: 500m
     memory: 512Mi
 
+# allowedHosts configures the --allowed-hosts argument for mcp-grafana's Host header
+# validation (required for streamable-http transport). When empty, defaults to the
+# standard Kubernetes Service DNS variants (<name>.<namespace>, <name>.<namespace>.svc,
+# <name>.<namespace>.svc.cluster.local, localhost). Override with a list of hosts or
+# set to ["*"] to allow all hosts.
+allowedHosts: []
+
 # Additional Arguments for the mcp server
 args: []