Add AuthServerConfigRef CRD field, config model, and JwksAllowPrivateIP#4286
Add AuthServerConfigRef CRD field, config model, and JwksAllowPrivateIP#4286
Conversation
- Move ExternalAuthConfigRef to mcpexternalauthconfig_types.go (same package, pure code organization) - Add AuthServerConfigRef field to VirtualMCPServerSpec for referencing an MCPExternalAuthConfig with type embeddedAuthServer - Add AuthServerConfigValidated condition type and reason constants - Add validateAuthServerConfig() structural validation - Add AuthServer field (*authserver.RunConfig) to vmcp config.Config - Add JwksAllowPrivateIP to OIDCConfig, OR with ProtectedResourceAllowPrivateIP in the auth factory for loopback JWKS fetches - Regenerate deepcopy, CRD manifests, and CRD reference docs Fixes: #4140
jhrozek
requested review from
ChrisJBurns,
JAORMX,
amirejaz,
jerm-dro and
yrobla
as code owners
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4286 +/- ##
==========================================
+ Coverage 68.54% 69.05% +0.51%
==========================================
Files 471 471
Lines 47732 47675 -57
==========================================
+ Hits 32717 32924 +207
+ Misses 12247 12187 -60
+ Partials 2768 2564 -204 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| // AuthServerConfigRef references an MCPExternalAuthConfig resource that configures | ||
| // an embedded OAuth authorization server. When set, the vMCP server acts as | ||
| // an OIDC issuer, drives users through upstream IDPs, and issues ToolHive JWTs. | ||
| // The referenced MCPExternalAuthConfig must have type "embeddedAuthServer" and exist | ||
| // in the same namespace. | ||
| // +optional |
There was a problem hiding this comment.
Nit: explain how this relates to the auth config available in config. "If set, then the embedded auth server will be used for inbound auth and config.inbound (or whatever the field is)."
There was a problem hiding this comment.
will do (and will keep the comment unresolved until I do)
| // RuntimeConfig extends Config with runtime-only fields that are populated | ||
| // post-deserialization by the converter (Kubernetes) or CLI loader. | ||
| // These fields are never part of the CRD schema. | ||
| type RuntimeConfig struct { | ||
| Config | ||
|
|
||
| // AuthServer configures an embedded OAuth authorization server. | ||
| // When set, the vMCP server acts as an OIDC issuer, drives users through upstream IDPs, | ||
| // accumulates tokens, and issues ToolHive JWTs. When nil, behavior is unchanged. | ||
| // Populated by the converter from AuthServerConfigRef or by the CLI loader. | ||
| AuthServer *AuthServerConfig | ||
| } |
There was a problem hiding this comment.
Blocker: Can we inline AuthServer into Config? This follows the pattern with other config fields that may be overwritten by "refs." It's nice to have this inline in the config because operators who don't want to bother with the external CRD may define the configuration directly on the vMCP. Also, it simplifies the plumbing of config for developers. The operator just reads the ref'ed CRD and writes it into the config, which already exists on the spec and plumbs through predictably.
2 participants
Summary
AuthServerConfigReffield toVirtualMCPServerSpecfor referencing anMCPExternalAuthConfigwith typeembeddedAuthServerAuthServerfield (*authserver.RunConfig) to the vMCP runtime config modelJwksAllowPrivateIPtoOIDCConfigfor loopback JWKS fetches when the embedded auth server's OIDC discovery endpoint is on a private addressExternalAuthConfigReftomcpexternalauthconfig_types.go(same package, pure code organization)Fixes #4140
Type of change
Test plan
Changes
cmd/thv-operator/api/v1alpha1/virtualmcpserver_types.goAuthServerConfigReffield with godoc, kubebuilder markers, and validationcmd/thv-operator/api/v1alpha1/virtualmcpserver_types_test.govalidateAuthServerConfig()cmd/thv-operator/api/v1alpha1/mcpexternalauthconfig_types.goExternalAuthConfigRefhere frommcpserver_types.gocmd/thv-operator/api/v1alpha1/mcpserver_types.goExternalAuthConfigRef(moved)pkg/vmcp/config/config.goRuntimeConfig.AuthServerandOIDCConfig.JwksAllowPrivateIPpkg/vmcp/auth/factory/incoming.goJwksAllowPrivateIPwithProtectedResourceAllowPrivateIPDoes this introduce a user-facing change?
No. This adds CRD fields and config types but does not wire them into any runtime code path yet.
Special notes for reviewers
JwksAllowPrivateIPis OR'd withProtectedResourceAllowPrivateIPin the auth factory so that either flag enables private-IP JWKS fetches. This is needed because the embedded auth server runs on a loopback address in-cluster.AuthServerConfigRefvalidation only checks structural correctness (non-empty name, correct type). Full semantic validation (e.g., referenced resource exists and is ready) will come in a follow-up controller reconciliation PR.Generated with Claude Code