Add AuthServerConfigRef CRD field, config model, and JwksAllowPrivateIP#4286
Merged
Add AuthServerConfigRef CRD field, config model, and JwksAllowPrivateIP#4286
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4286 +/- ##
==========================================
- Coverage 68.61% 68.56% -0.05%
==========================================
Files 478 478
Lines 48450 48466 +16
==========================================
- Hits 33243 33233 -10
- Misses 12367 12379 +12
- Partials 2840 2854 +14 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
jerm-dro
requested changes
Mar 20, 2026
2 tasks
cdf5325 to
d506e3a
Compare
Contributor
There was a problem hiding this comment.
Large PR Detected
This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.
How to unblock this PR:
Add a section to your PR description with the following format:
## Large PR Justification
[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformationAlternative:
Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.
See our Contributing Guidelines for more details.
This review will be automatically dismissed once you add the justification section.
Phase 1 of the vMCP embedded authorization server (#4140): - Move ExternalAuthConfigRef to mcpexternalauthconfig_types.go - Add AuthServerConfig *EmbeddedAuthServerConfig to VirtualMCPServerSpec for inline embedded auth server configuration (no separate CRD needed) - Add ConditionTypeAuthServerConfigValidated condition and reasons - Add validateAuthServerConfig() for issuer and upstream provider checks - Add RuntimeConfig with AuthServer field (runtime-only, not in CRD) - Add JwksAllowPrivateIP to OIDCConfig, OR with ProtectedResourceAllowPrivateIP - Regenerate deepcopy, CRD manifests, and CRD reference docs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
d506e3a to
7ca7fb4
Compare
Large PR justification has been provided. Thank you!
Contributor
|
✅ Large PR justification has been provided. The size review has been dismissed and this PR can now proceed with normal review. |
tgrunnagle
previously approved these changes
Mar 23, 2026
Remove extra blank line that caused gci import ordering lint failure. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
tgrunnagle
previously approved these changes
Mar 23, 2026
Update generated CRD YAML and reference docs to match updated AuthServerConfig description in VirtualMCPServer types. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
jerm-dro
approved these changes
Mar 23, 2026
tgrunnagle
approved these changes
Mar 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AuthServerConfigReffield toVirtualMCPServerSpecfor referencing anMCPExternalAuthConfigwith typeembeddedAuthServerAuthServerfield (*authserver.RunConfig) to the vMCP runtime config modelJwksAllowPrivateIPtoOIDCConfigfor loopback JWKS fetches when the embedded auth server's OIDC discovery endpoint is on a private addressExternalAuthConfigReftomcpexternalauthconfig_types.go(same package, pure code organization)Fixes #4140
Type of change
Test plan
Changes
cmd/thv-operator/api/v1alpha1/virtualmcpserver_types.goAuthServerConfigReffield with godoc, kubebuilder markers, and validationcmd/thv-operator/api/v1alpha1/virtualmcpserver_types_test.govalidateAuthServerConfig()cmd/thv-operator/api/v1alpha1/mcpexternalauthconfig_types.goExternalAuthConfigRefhere frommcpserver_types.gocmd/thv-operator/api/v1alpha1/mcpserver_types.goExternalAuthConfigRef(moved)pkg/vmcp/config/config.goRuntimeConfig.AuthServerandOIDCConfig.JwksAllowPrivateIPpkg/vmcp/auth/factory/incoming.goJwksAllowPrivateIPwithProtectedResourceAllowPrivateIPDoes this introduce a user-facing change?
No. This adds CRD fields and config types but does not wire them into any runtime code path yet.
Special notes for reviewers
JwksAllowPrivateIPis OR'd withProtectedResourceAllowPrivateIPin the auth factory so that either flag enables private-IP JWKS fetches. This is needed because the embedded auth server runs on a loopback address in-cluster.AuthServerConfigRefvalidation only checks structural correctness (non-empty name, correct type). Full semantic validation (e.g., referenced resource exists and is ready) will come in a follow-up controller reconciliation PR.Generated with Claude Code
Large PR Justification