# Teams MCP - Deployment

1 min read

## Prerequisites
Before deploying the Teams MCP Server, ensure you have:

- Kubernetes cluster (1.25+)
- Helm 3.x installed
- PostgreSQL 14+ database
- RabbitMQ 3.12+ instance
- Kong Gateway with public access configured
- Microsoft Entra ID app registration ( [Authentication Guide](https://docs.unique.ai/it-operators/integrations-connectors/teams-mcp/teams-mcp-operator-manual/teams-mcp-authentication))
- Public DNS hostname for webhook callbacks

## Helm Chart
The Teams MCP Server is deployed using a Helm chart that wraps the `backend-service` chart.

### Add Helm Repository

```bash
helm registry login ghcr.io/unique-ag/helm-charts
```

### Install

```bash
helm install teams-mcp oci://ghcr.io/unique-ag/helm-charts/teams-mcp \
  --namespace teams-mcp \
  --create-namespace \
  --values values.yaml
```

### Upgrade

```bash
helm upgrade teams-mcp oci://ghcr.io/unique-ag/helm-charts/teams-mcp \
  --namespace teams-mcp \
  --values values.yaml
```

## Required Secrets
Create the following Kubernetes secrets before deployment:

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: teams-mcp-secrets
  namespace: teams-mcp
type: Opaque
stringData:
  DATABASE_URL: "postgresql://user:password@host:5432/teams_mcp"
  AMQP_URL: "amqp://user:password@rabbitmq:5672/teams-mcp"
  MICROSOFT_CLIENT_SECRET: "<from-entra-app-registration>"
  MICROSOFT_WEBHOOK_SECRET: "<128-char-random-string>"
  AUTH_HMAC_SECRET: "<64-char-hex-string>"
  ENCRYPTION_KEY: "<64-char-hex-string>"
```

### Generating Secrets

```bash
# Generate MICROSOFT_WEBHOOK_SECRET (128 characters)
openssl rand -hex 64

# Generate AUTH_HMAC_SECRET (64 characters hex = 256 bits)
openssl rand -hex 32

# Generate ENCRYPTION_KEY (64 characters hex = 256 bits)
openssl rand -hex 32
```

## Minimal Values Configuration

```yaml
server:
  envVars:
    - secretRef:
        name: teams-mcp-secrets

mcpConfig:
  app:
    selfUrl: https://teams.mcp.example.com

microsoft:
    clientId: "12345678-1234-1234-1234-123456789012"

unique:
    apiBaseUrl: http://api-gateway.unique:8080
    ingestionServiceBaseUrl: http://node-ingestion.unique:8091
```

**Note:** Ingress is disabled by default. Traffic routing is handled by Kong Gateway via HTTPRoute or KongIngress resources configured separately.

## Database Migration
Database migrations run automatically on deployment via a Helm hook:

```yaml
server:
  hooks:
    migration:
      enabled: true
      command: |
        pnpm run db:migrate
```

To run migrations manually:

```bash
kubectl exec -it deploy/teams-mcp -- pnpm run db:migrate
```

## Health Checks
The service exposes health endpoints:

| Endpoint | Purpose |
| --- | --- |
| `/health` | Kubernetes liveness probe |
| `/ready` | Kubernetes readiness probe |

## Monitoring
### Prometheus Metrics
Metrics are exposed on port `51346` at `/metrics`.

```yaml
server:
  ports:
    metrics: 51346
  env:
    OTEL_EXPORTER_PROMETHEUS_HOST: "0.0.0.0"
    OTEL_EXPORTER_PROMETHEUS_PORT: "51346"
    OTEL_METRICS_EXPORTER: "prometheus"
```

### Grafana Dashboard
A Grafana dashboard is automatically created when enabled:

```yaml
grafana:
  dashboard:
    enabled: true
    folder: mcp-servers
```

### Prometheus Alerts
Default alerts are included for GraphQL and Unique API errors:

```yaml
alerts:
  enabled: true
  defaultAlerts:
    graphql:
      enabled: true
    uniqueApi:
      enabled: true
```

## Network Policies
Network policies are enabled by default to restrict ingress traffic:

```yaml
server:
  networkPolicy:
    enabled: true
    policyTypes:
      - Ingress
```

## Terraform Modules
Terraform modules are available for:

- **Entra Application**: `deploy/terraform/azure/teams-mcp-entra-application/`
- **Secrets Management**: `deploy/terraform/azure/teams-mcp-secrets/`

See [Authentication Guide](https://docs.unique.ai/it-operators/integrations-connectors/teams-mcp/teams-mcp-operator-manual/teams-mcp-authentication) for Terraform usage.

## Troubleshooting
See [FAQ](https://docs.unique.ai/it-operators/integrations-connectors/teams-mcp/teams-mcp-faq) for common questions and deployment issues.