privilege-mcpgw-agent-k8s

Install the agentless-mcpgw Helm chart into the ping-devops-curtismuir namespace with a secrets file containing the proxyToken from the Privilege console and OIDC client settings. Verify success by finding LinkStatus:Active in the gateway logs.

This error means the MCP server was registered with a /mcp URL instead of /sse. The gateway's discovery client uses the SSE transport and waits for an endpoint event that streamable-HTTP never sends, so re-register the backend with the /sse path and restart the gateway.

Add an entry to extraContainers in a values file with its own port, run helm package to keep the .tgz in sync, dry-run the upgrade to verify the render, then upgrade and register it in the console pointing at http://localhost:<port>/sse.

The gateway's DCR registry is in memory, so every restart forgets all dynamically registered clients. The client must re-register; the demo BFF handles this automatically, but other clients must be deleted and re-added manually.

Access Denied for means the user is synced into Privilege but no policy on that specific Agentic App covers them, since policies are per-app and time-boxed. User not found in system instead means the user is not synced via the PingOne group membership policy.

The packaged .tgz went stale after template edits, so the upgrade re-rendered the Deployment without extraContainers and imagePullSecrets even though helm get values still showed them. Repackage the chart after every template edit and verify with a dry-run grep before upgrading.