feat: add metrics security support, refactor health probe configuration, and enforce MCP health interval validation

Signed-off-by: Ankit Kr. Chowdhury <rakesh856100@gmail.com>

Author: gitcommitankit

README.md

@@ -202,6 +202,11 @@ metadata:
 spec:
   image: ghcr.io/my-org/search-agent:v2.0.0
   tenantRef: team-search
+  replicas:
+    min: 1
+    max: 4
+    metric: queueDepth
+    target: 25
   rollout:
     strategy: Canary
     steps:

charts/agentrax/templates/deployment.yaml

@@ -40,8 +40,11 @@ spec:
             {{- if .Values.manager.leaderElect }}
             - --leader-elect
             {{- end }}
-            - --health-probe-bind-address={{ .Values.manager.healthProbeBindAddress | default ":8081" }}
+            - --health-probe-bind-address=:{{ .Values.manager.healthProbeBindPort | default 8081 }}
             - --metrics-bind-address={{ .Values.manager.metricsBindAddress | default "0" }}
+            {{- if hasKey .Values.manager "metricsSecure" }}
+            - --metrics-secure={{ .Values.manager.metricsSecure }}
+            {{- end }}
             - --registry-bind-address={{ .Values.registry.bindAddress | default ":9090" }}
             - --gpu-resource-name={{ .Values.manager.gpuResourceName | default "nvidia.com/gpu" }}
             {{- if .Values.prometheus.url }}

charts/agentrax/values.yaml

@@ -66,9 +66,9 @@ manager:
   leaderElect: false
   # -- Bind address for metrics. Use ":8443" for HTTPS, ":8080" for HTTP, "0" to disable.
   metricsBindAddress: "0"
-  # -- Bind address for health/readiness probes.
-  healthProbeBindAddress: ":8081"
-  # -- Bind port for health/readiness probes (referenced by liveness/readiness probes).
+  # -- Serve metrics securely over HTTPS. Set to false for HTTP.
+  metricsSecure: true
+  # -- Bind port for health/readiness probes (used for container port, probes, and manager bind address).
   healthProbeBindPort: 8081
   # -- GPU resource name used for quota calculation.
   gpuResourceName: "nvidia.com/gpu"

cmd/main.go

@@ -235,6 +235,14 @@ func main() {
 		}
 	}
 
+	if mcpHealthInterval >= registryTTL {
+		setupLog.Info("AGENTRAX_MCP_HEALTH_INTERVAL must be strictly less than AGENTRAX_REGISTRY_TTL",
+			"configuredInterval", mcpHealthInterval,
+			"registryTTL", registryTTL,
+			"adjustedInterval", registryTTL/2)
+		mcpHealthInterval = registryTTL / 2
+	}
+
 	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 		Scheme:                 scheme,
 		Metrics:                metricsServerOptions,