From fdd8e894ba9f5d985c84f02cc32e751993d4ec40 Mon Sep 17 00:00:00 2001
From: xnoto <steven@makeitwork.cloud>
Date: Tue, 25 Aug 2026 21:55:01 -0600
Subject: [PATCH] feat(mcp): expose the gateway as mcp.makeitwork.cloud

Routes the cluster-apps tunnel to vmcp-gateway:4483. Safe to merge now:
the mcp CNAME and the Cloudflare Access application already exist
(tfroot-cloudflare#26 applied), so the operator only claims the managed
TXT record. Edge auth is the mcp-gateway Access app (service token for
agents, admins SSO for debug).
---
 workloads/mcp-gateway/kustomization.yaml  |  1 +
 workloads/mcp-gateway/tunnel-binding.yaml | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)
 create mode 100644 workloads/mcp-gateway/tunnel-binding.yaml

diff --git a/workloads/mcp-gateway/kustomization.yaml b/workloads/mcp-gateway/kustomization.yaml
index 5b82c29..f467b92 100644
--- a/workloads/mcp-gateway/kustomization.yaml
+++ b/workloads/mcp-gateway/kustomization.yaml
@@ -7,5 +7,6 @@ resources:
   - kubernetes-mcpserver.yaml
   - remote-proxies.yaml
   - vmcp.yaml
+  - tunnel-binding.yaml
 generators:
   - ksops-mcp-gateway-secrets.yaml
diff --git a/workloads/mcp-gateway/tunnel-binding.yaml b/workloads/mcp-gateway/tunnel-binding.yaml
new file mode 100644
index 0000000..b9a6791
--- /dev/null
+++ b/workloads/mcp-gateway/tunnel-binding.yaml
@@ -0,0 +1,16 @@
+---
+apiVersion: networking.cfargotunnel.com/v1alpha1
+kind: TunnelBinding
+metadata:
+  name: mcp-gateway
+  namespace: mcp
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+subjects:
+  - name: vmcp-gateway
+    spec:
+      fqdn: mcp.makeitwork.cloud
+      target: http://vmcp-gateway.mcp.svc:4483
+tunnelRef:
+  kind: ClusterTunnel
+  name: cluster-apps