// Module included in the following assemblies:
//
// * ai_applications/mcp_server/mcp-server-overview.adoc

:_mod-docs-content-type: PROCEDURE
[id="ai-app-mcp-server-revoke-cr-access_{context}"]
= Revoke access to Custom Resources

[role="_abstract"]
To install the Model Context Protocol (MCP) server for Red Hat {product-title} feature, revoke access to specific Custom Resource (CR) level resources to enhance security. It is highly recommended that you limit access to Secrets, ConfigMaps, and RBAC resources (RoleBindings, ClusterRoles).

.Prerequisites

* Access to OpenShift console with admin rights.
* The MCP server Helm chart is installed.
* MCP-compatible client connected.
* MCP gateway is installed and verified.
* The MCP gateway is configured.
* RBAC is configured.

.Procedure

. Configure denied resources to limit access to sensitive CRs.
+
Use the following example file to revoke access to Secrets, ConfigMaps, and RBAC resources:
+
.Example
[source,toml]
----
# Deny access to Secrets
[[denied_resources]]
group = ""
version = "v1"
kind = "Secret"

# Deny access to ConfigMaps
[[denied_resources]]
group = ""
version = "v1"
kind = "ConfigMap"

# Deny access to RBAC resources for additional security
[[denied_resources]]
group = "rbac.authorization.k8s.io"
version = "v1"
kind = "Role"

[[denied_resources]]
group = "rbac.authorization.k8s.io"
version = "v1"
kind = "RoleBinding"

[[denied_resources]]
group = "rbac.authorization.k8s.io"
version = "v1"
kind = "ClusterRole"

[[denied_resources]]
group = "rbac.authorization.k8s.io"
version = "v1"
kind = "ClusterRoleBinding"
----

. Apply this configuration by doing one of the following:
+
* Save the configuration to a file (for example, `deny-resources.toml`) and pass it using a Helm values file:
+
[source,terminal]
----
$ helm upgrade openshift-mcp-server openshift-helm-charts/redhat-openshift-mcp-server \
    -n openshift-mcp-server \
    --set-file config.deniedResources=deny-resources.toml
----
+
* Or use `--set-json` to pass the configuration inline:
+
[source,terminal]
----
$ helm upgrade openshift-mcp-server openshift-helm-charts/redhat-openshift-mcp-server \
    -n openshift-mcp-server \
    --set-json 'config.deniedResources=[{"group":"","version":"v1","kind":"Secret"},{"group":"","version":"v1","kind":"ConfigMap"}]'
----

