Skip to content

Commit ee534b3

Browse files
habh-11habh-11
committed
Add CES MCP Toolsets terraform configs.
Also fix the OpenAPI toolset tests where the service account comes from an environment variable instead of a hardcoded string.
1 parent d4c08d6 commit ee534b3

File tree

7 files changed

+1055
-0
lines changed

7 files changed

+1055
-0
lines changed

‎mmv1/products/ces/Toolset.yaml‎

Lines changed: 207 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ import_format:
2828
examples:
2929
- name: "ces_toolset_openapi_service_account_auth_config"
3030
primary_resource_id: "ces_toolset_openapi_service_account_auth_config" # yamllint disable rule:line-length
31+
test_env_vars:
32+
service_account: 'SERVICE_ACCT'
3133
vars:
3234
app_display_name: 'my-app'
3335
app_id: 'app-id'
@@ -61,6 +63,43 @@ examples:
6163
app_id: 'app-id'
6264
toolset_id: 'toolset1'
6365
location: 'us'
66+
- name: "ces_toolset_mcp_service_account_auth_config"
67+
primary_resource_id: "ces_toolset_mcp_service_account_auth_config"
68+
test_env_vars:
69+
service_account: 'SERVICE_ACCT'
70+
vars:
71+
app_display_name: 'my-app'
72+
app_id: 'app-id'
73+
toolset_id: 'toolset1'
74+
location: 'us'
75+
- name: "ces_toolset_mcp_oauth_config"
76+
primary_resource_id: "ces_toolset_mcp_oauth_config"
77+
vars:
78+
app_display_name: 'my-app'
79+
app_id: 'app-id'
80+
toolset_id: 'toolset1'
81+
location: 'us'
82+
- name: "ces_toolset_mcp_service_agent_id_token_auth_config"
83+
primary_resource_id: "ces_toolset_mcp_service_agent_id_token_auth_config"
84+
vars:
85+
app_display_name: 'my-app'
86+
app_id: 'app-id'
87+
toolset_id: 'toolset1'
88+
location: 'us'
89+
- name: "ces_toolset_mcp_api_key_config"
90+
primary_resource_id: "ces_toolset_mcp_api_key_config"
91+
vars:
92+
app_display_name: 'my-app'
93+
app_id: 'app-id'
94+
toolset_id: 'toolset1'
95+
location: 'us'
96+
- name: "ces_toolset_mcp_bearer_token_config"
97+
primary_resource_id: "ces_toolset_mcp_bearer_token_config"
98+
vars:
99+
app_display_name: 'my-app'
100+
app_id: 'app-id'
101+
toolset_id: 'toolset1'
102+
location: 'us'
64103
autogen_async: true
65104
autogen_status: VG9vbHNldA==
66105
parameters:
@@ -293,6 +332,174 @@ properties:
293332
and the schema has the $env_var placeholder,
294333
it will replace the placeholder in the schema.
295334
output: true
335+
- name: mcpToolset
336+
type: NestedObject
337+
description: |-
338+
A toolset that contains a list of tools that are offered by the MCP
339+
server.
340+
properties:
341+
- name: serverAddress
342+
type: String
343+
description: |-
344+
The address of the MCP server, for example, "https://example.com/mcp/". If
345+
the server is built with the MCP SDK, the url should be suffixed with
346+
"/mcp/". Only Streamable HTTP transport based servers are supported. See
347+
https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#streamable-http
348+
for more details.
349+
required: true
350+
- name: apiAuthentication
351+
type: NestedObject
352+
description: |-
353+
Authentication information required to access tools and execute a tool
354+
against the MCP server. For API key auth, the API key can only be sent in
355+
the request header; sending it via query parameters is not supported.
356+
properties:
357+
- name: apiKeyConfig
358+
type: NestedObject
359+
description: Configurations for authentication with API key.
360+
properties:
361+
- name: apiKeySecretVersion
362+
type: String
363+
description: |-
364+
The name of the SecretManager secret version resource storing the API key.
365+
Format: `projects/{project}/secrets/{secret}/versions/{version}`
366+
Note: You should grant `roles/secretmanager.secretAccessor` role to the CES
367+
service agent
368+
`service-@gcp-sa-ces.iam.gserviceaccount.com`.
369+
required: true
370+
- name: keyName
371+
type: String
372+
description: |-
373+
The parameter name or the header name of the API key.
374+
E.g., If the API request is "https://example.com/act?X-Api-Key=", "X-Api-Key" would be the parameter name.
375+
required: true
376+
- name: requestLocation
377+
type: String
378+
description: |-
379+
Key location in the request. For API key auth on MCP toolsets,
380+
the API key can only be sent in the request header.
381+
Possible values:
382+
HEADER
383+
required: true
384+
- name: oauthConfig
385+
type: NestedObject
386+
description: Configurations for authentication with OAuth.
387+
properties:
388+
- name: clientId
389+
type: String
390+
description: The client ID from the OAuth provider.
391+
required: true
392+
- name: clientSecretVersion
393+
type: String
394+
description: |-
395+
The name of the SecretManager secret version resource storing the
396+
client secret.
397+
Format: `projects/{project}/secrets/{secret}/versions/{version}`
398+
399+
Note: You should grant `roles/secretmanager.secretAccessor` role to the CES
400+
service agent
401+
`service-@gcp-sa-ces.iam.gserviceaccount.com`.
402+
required: true
403+
- name: oauthGrantType
404+
type: String
405+
description: |-
406+
OAuth grant types.
407+
Possible values:
408+
CLIENT_CREDENTIAL
409+
required: true
410+
- name: scopes
411+
type: Array
412+
description: The OAuth scopes to grant.
413+
item_type:
414+
type: String
415+
- name: tokenEndpoint
416+
type: String
417+
description: The token endpoint in the OAuth provider to exchange for an
418+
access token.
419+
required: true
420+
- name: serviceAccountAuthConfig
421+
type: NestedObject
422+
description: Configurations for authentication using a custom service
423+
account.
424+
properties:
425+
- name: serviceAccount
426+
type: String
427+
description: |-
428+
The email address of the service account used for authenticatation. CES
429+
uses this service account to exchange an access token and the access token
430+
is then sent in the `Authorization` header of the request.
431+
432+
The service account must have the
433+
`roles/iam.serviceAccountTokenCreator` role granted to the
434+
CES service agent
435+
`service-@gcp-sa-ces.iam.gserviceaccount.com`.
436+
required: true
437+
- name: serviceAgentIdTokenAuthConfig
438+
type: NestedObject
439+
description: |-
440+
Configurations for authentication with [ID
441+
token](https://cloud.google.com/docs/authentication/token-types#id) generated
442+
from service agent.
443+
allow_empty_object: true
444+
send_empty_value: true
445+
properties: []
446+
- name: bearerTokenConfig
447+
type: NestedObject
448+
description: Configurations for authentication with a bearer token.
449+
properties:
450+
- name: token
451+
type: String
452+
- name: serviceDirectoryConfig
453+
type: NestedObject
454+
description: |-
455+
Service Directory configuration for VPC-SC, used to resolve service names
456+
within a perimeter.
457+
properties:
458+
- name: service
459+
type: String
460+
description: |-
461+
The name of [Service
462+
Directory](https://cloud.google.com/service-directory) service.
463+
Format:
464+
`projects/{project}/locations/{location}/namespaces/{namespace}/services/{service}`.
465+
Location of the service directory must be the same as the location of the
466+
app.
467+
required: true
468+
- name: tlsConfig
469+
type: NestedObject
470+
description: |-
471+
The TLS configuration. Includes the custom server certificates that the
472+
client should trust.
473+
properties:
474+
- name: caCerts
475+
type: Array
476+
description: |-
477+
Specifies a list of allowed custom CA certificates for HTTPS
478+
verification.
479+
required: true
480+
item_type:
481+
type: NestedObject
482+
properties:
483+
- name: cert
484+
type: String
485+
description: |-
486+
The allowed custom CA certificates (in DER format) for
487+
HTTPS verification. This overrides the default SSL trust store. If this
488+
is empty or unspecified, CES will use Google's default trust
489+
store to verify certificates. N.B. Make sure the HTTPS server
490+
certificates are signed with "subject alt name". For instance a
491+
certificate can be self-signed using the following command,
492+
openssl x509 -req -days 200 -in example.com.csr \
493+
-signkey example.com.key \
494+
-out example.com.crt \
495+
-extfile <(printf "\nsubjectAltName='DNS:www.example.com'")
496+
required: true
497+
- name: displayName
498+
type: String
499+
description: |-
500+
The name of the allowed custom CA certificates. This
501+
can be used to disambiguate the custom CA certificates.
502+
required: true
296503
- name: updateTime
297504
type: String
298505
description: Timestamp when the toolset was last updated.

‎mmv1/templates/terraform/examples/ces_toolset_mcp_api_key_config.tf.tmpl‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
resource "google_ces_app" "ces_app_for_toolset" {
2+
app_id = "{{index $.Vars "app_id"}}"
3+
location = "us"
4+
description = "App used as parent for CES Toolset example"
5+
display_name = "{{index $.Vars "app_display_name"}}"
6+
7+
language_settings {
8+
default_language_code = "en-US"
9+
supported_language_codes = ["es-ES", "fr-FR"]
10+
enable_multilingual_support = true
11+
fallback_action = "escalate"
12+
}
13+
time_zone_settings {
14+
time_zone = "America/Los_Angeles"
15+
}
16+
}
17+
18+
resource "google_ces_toolset" "ces_toolset_mcp_api_key_config" {
19+
toolset_id = "{{index $.Vars "toolset_id"}}"
20+
location = "us"
21+
app = google_ces_app.ces_app_for_toolset.app_id
22+
display_name = "Basic toolset display name"
23+
description = "Test description"
24+
execution_type = "SYNCHRONOUS"
25+
26+
mcp_toolset {
27+
server_address = "https://api.example.com/mcp/"
28+
tls_config {
29+
ca_certs {
30+
display_name="example"
31+
cert="ZXhhbXBsZQ=="
32+
}
33+
}
34+
service_directory_config {
35+
service = "projects/example/locations/us/namespaces/namespace/services/service"
36+
}
37+
api_authentication {
38+
api_key_config {
39+
key_name = "ExampleKey"
40+
api_key_secret_version = "projects/fake-project/secrets/fake-secret/versions/version-1"
41+
request_location = "HEADER"
42+
}
43+
}
44+
}
45+
}

‎mmv1/templates/terraform/examples/ces_toolset_mcp_bearer_token_config.tf.tmpl‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
resource "google_ces_app" "ces_app_for_toolset" {
2+
app_id = "{{index $.Vars "app_id"}}"
3+
location = "us"
4+
description = "App used as parent for CES Toolset example"
5+
display_name = "{{index $.Vars "app_display_name"}}"
6+
7+
language_settings {
8+
default_language_code = "en-US"
9+
supported_language_codes = ["es-ES", "fr-FR"]
10+
enable_multilingual_support = true
11+
fallback_action = "escalate"
12+
}
13+
time_zone_settings {
14+
time_zone = "America/Los_Angeles"
15+
}
16+
}
17+
18+
resource "google_ces_toolset" "ces_toolset_mcp_bearer_token_config" {
19+
toolset_id = "{{index $.Vars "toolset_id"}}"
20+
location = "us"
21+
app = google_ces_app.ces_app_for_toolset.app_id
22+
display_name = "Basic toolset display name"
23+
24+
mcp_toolset {
25+
server_address = "https://api.example.com/mcp/"
26+
tls_config {
27+
ca_certs {
28+
display_name="example"
29+
cert="ZXhhbXBsZQ=="
30+
}
31+
}
32+
service_directory_config {
33+
service = "projects/example/locations/us/namespaces/namespace/services/service"
34+
}
35+
api_authentication {
36+
bearer_token_config {
37+
token = "$context.variables.my_ces_toolset_auth_token"
38+
}
39+
}
40+
}
41+
}

‎mmv1/templates/terraform/examples/ces_toolset_mcp_oauth_config.tf.tmpl‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
resource "google_ces_app" "ces_app_for_toolset" {
2+
app_id = "{{index $.Vars "app_id"}}"
3+
location = "us"
4+
description = "App used as parent for CES Toolset example"
5+
display_name = "{{index $.Vars "app_display_name"}}"
6+
7+
language_settings {
8+
default_language_code = "en-US"
9+
supported_language_codes = ["es-ES", "fr-FR"]
10+
enable_multilingual_support = true
11+
fallback_action = "escalate"
12+
}
13+
time_zone_settings {
14+
time_zone = "America/Los_Angeles"
15+
}
16+
}
17+
18+
resource "google_ces_toolset" "ces_toolset_mcp_oauth_config" {
19+
toolset_id = "{{index $.Vars "toolset_id"}}"
20+
location = "us"
21+
app = google_ces_app.ces_app_for_toolset.app_id
22+
display_name = "Basic toolset display name"
23+
24+
mcp_toolset {
25+
server_address = "https://api.example.com/mcp/"
26+
tls_config {
27+
ca_certs {
28+
display_name="example"
29+
cert="ZXhhbXBsZQ=="
30+
}
31+
}
32+
service_directory_config {
33+
service = "projects/example/locations/us/namespaces/namespace/services/service"
34+
}
35+
api_authentication {
36+
oauth_config {
37+
oauth_grant_type = "CLIENT_CREDENTIAL"
38+
client_id = "example_client_id"
39+
client_secret_version = "projects/fake-project/secrets/fake-secret/versions/version1"
40+
token_endpoint = "123"
41+
scopes = ["scope1"]
42+
}
43+
}
44+
}
45+
}

0 commit comments

Comments
 (0)