🤖 feat: expand MCP control-plane and aggregated MCP operations

deploy/rbac.yaml

@@ -84,9 +84,12 @@ rules:
     verbs: ["get", "list", "watch"]
   - apiGroups: ["aggregation.coder.com"]
     resources: ["coderworkspaces", "codertemplates"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
     verbs: ["get", "list", "watch"]
   - apiGroups: [""]
-    resources: ["pods", "pods/log", "events", "namespaces"]
+    resources: ["services", "pods", "pods/log", "events", "namespaces"]
     verbs: ["get", "list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1

docs/how-to/mcp-server.md

@@ -6,11 +6,12 @@ The MCP server runs in HTTP mode (`--app=mcp-http`).
 
 ## 1. Overview
 
-The MCP server provides tools for inspecting Kubernetes resources managed by `coder-k8s`, including:
+The MCP server provides tools for inspecting and updating Kubernetes resources managed by `coder-k8s`, including:
 
 - `CoderControlPlane` resources
-- `CoderWorkspace` resources
-- `CoderTemplate` resources
+- Control-plane Deployment, Service, and Pod status
+- `CoderWorkspace` resources (including `spec.running` updates)
+- `CoderTemplate` resources (including `spec.running` updates)
 - Namespace events
 - Pod logs
 
@@ -38,12 +39,22 @@ http://127.0.0.1:8090/mcp
 
 ## 3. Available tools
 
-The server exposes MCP tools for:
-
-- Reading `CoderControlPlane` resources and status
-- Listing `CoderWorkspace` and `CoderTemplate` resources
-- Listing namespace events for troubleshooting
-- Reading pod logs for debugging
+The server exposes the following MCP tools:
+
+- `list_control_planes`
+- `get_control_plane_status`
+- `list_control_plane_pods`
+- `get_control_plane_deployment_status`
+- `get_service_status`
+- `list_workspaces`
+- `get_workspace`
+- `set_workspace_running`
+- `list_templates`
+- `get_template`
+- `set_template_running`
+- `get_events`
+- `get_pod_logs`
+- `check_health`
 
 ## 4. Health checks
 

internal/aggregated/storage/helpers.go

@@ -0,0 +1,43 @@
+package storage
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	genericapirequest "k8s.io/apiserver/pkg/endpoints/request"
+)
+
+func resolveWriteNamespace(ctx context.Context, objectNamespace string) (string, error) {
+	requestNamespace := genericapirequest.NamespaceValue(ctx)
+	if requestNamespace == "" && objectNamespace == "" {
+		return "", apierrors.NewBadRequest("namespace is required")
+	}
+	if requestNamespace == "" {
+		return objectNamespace, nil
+	}
+	if objectNamespace == "" {
+		return requestNamespace, nil
+	}
+	if requestNamespace != objectNamespace {
+		return "", apierrors.NewBadRequest(fmt.Sprintf("request namespace %q does not match object namespace %q", requestNamespace, objectNamespace))
+	}
+	return requestNamespace, nil
+}
+
+func incrementResourceVersion(resourceVersion string) (string, error) {
+	if resourceVersion == "" {
+		return "1", nil
+	}
+
+	version, err := strconv.ParseInt(resourceVersion, 10, 64)
+	if err != nil {
+		return "", fmt.Errorf("assertion failed: invalid resourceVersion %q: %w", resourceVersion, err)
+	}
+	if version < 0 {
+		return "", fmt.Errorf("assertion failed: resourceVersion must not be negative: %d", version)
+	}
+
+	return strconv.FormatInt(version+1, 10), nil
+}