Add virtualmcpservers to default Helm RBAC values

[danbarr]

This fixes an issue with v0.2.4 of the Helm chart, where the mcp-optimizer pod would fail to start up since virtualmcpservers was missing from the default values.yaml

2026-01-27 19:13:43 [error    ] HTTP error listing VirtualMCPServers: 403 [mcp_optimizer.toolhive.k8s_client] response_text='{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"virtualmcpservers.toolhive.stacklok.dev is forbidden: User \\"system:serviceaccount:toolhive-system:mcp-optimizer\\" cannot list resource \\"virtualmcpservers\\" in API group \\"toolhive.stacklok.dev\\" at the cluster scope","reason":"Forbidden","details":{"group":"toolhive.stacklok.dev","kind":"virtualmcpservers"},"code":403}\n' status_code=403

Signed-off-by: Dan Barr 6922515+danbarr@users.noreply.github.com

[claude]

PR Review

Summary: Critical bug fix that adds missing RBAC permissions for virtualmcpservers. The fix correctly addresses the 403 error preventing pod startup.

✅ Positives

• Properly fixes the RBAC permission issue across all key configuration files
• Updates documentation to reflect both MCPServer and VirtualMCPServer requirements
• Consistent changes across Helm values and docs

⚠️ Issue Found

Missing update in example file (examples/mcp-servers/mcpserver_mcp-optimizer.yaml:16):
The RBAC rules still only include "mcpservers":

resources: ["mcpservers"]  # Should be ["mcpservers", "virtualmcpservers"]

This example file is used as a reference and will fail with the same 403 error if users follow it.

Recommendation

Update examples/mcp-servers/mcpserver_mcp-optimizer.yaml line 16 to match the other fixes:

resources: ["mcpservers", "virtualmcpservers"]

Verdict: Approve with requested fix to the example file.