Add CRD type and converter for upstream_inject strategy#4391
Merged
tgrunnagle merged 1 commit intomainfrom Mar 30, 2026
Merged
Conversation
jerm-dro
previously approved these changes
Mar 26, 2026
3 tasks
fc12658 to
9f25687
Compare
12e1fc2 to
a4b2892
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #4391 +/- ##
==========================================
+ Coverage 69.48% 69.55% +0.07%
==========================================
Files 486 487 +1
Lines 50017 50043 +26
==========================================
+ Hits 34753 34807 +54
+ Misses 12578 12553 -25
+ Partials 2686 2683 -3 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
9f25687 to
c904405
Compare
a4b2892 to
e49c89e
Compare
e49c89e to
d17a27e
Compare
8156719 to
dacf7fb
Compare
d17a27e to
2bdc632
Compare
tgrunnagle
previously approved these changes
Mar 27, 2026
dacf7fb to
99c8e33
Compare
2bdc632 to
8eebdd8
Compare
The base branch was changed.
Contributor
There was a problem hiding this comment.
Large PR Detected
This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.
How to unblock this PR:
Add a section to your PR description with the following format:
## Large PR Justification
[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformationAlternative:
Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.
See our Contributing Guidelines for more details.
This review will be automatically dismissed once you add the justification section.
Bridge the Kubernetes operator API to the vMCP runtime config for the upstream_inject outgoing auth strategy. This is Phase 4 of RFC-0054. CRD changes: add ExternalAuthTypeUpstreamInject constant, UpstreamInjectSpec struct, CEL validation rules, and SubjectProviderName on TokenExchangeConfig. Converter changes: add UpstreamInjectConverter, wire SubjectProviderName in TokenExchangeConverter, and register in the converter registry. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
8eebdd8 to
1d21cae
Compare
Contributor
|
✅ PR size has been reduced below the XL threshold. The size review has been dismissed and this PR can now proceed with normal review. Thank you for splitting this up! |
PR size has been reduced below the XL threshold. Thank you for splitting this up!
jerm-dro
approved these changes
Mar 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
upstream_injectstrategy (added in Implement upstream_inject strategy and SubjectProviderName #4390)needs CRD types and converters so the operator can wire it from the Kubernetes
API to the vMCP runtime config.
ExternalAuthTypeUpstreamInjectconstant,UpstreamInjectSpecstruct withCEL validation, and
SubjectProviderNameonTokenExchangeConfigin the CRD types.UpstreamInjectConverterand wiresSubjectProviderNameinTokenExchangeConverter, both registered in the converter registry.Fixes #4146
Type of change
Test plan
task test)task lint-fix)Changes
cmd/thv-operator/api/v1alpha1/mcpexternalauthconfig_types.goExternalAuthTypeUpstreamInject,UpstreamInjectSpecwith CEL rules,SubjectProviderNameon token exchangecmd/thv-operator/api/v1alpha1/mcpexternalauthconfig_types_test.gocmd/thv-operator/api/v1alpha1/zz_generated.deepcopy.gocmd/thv-operator/controllers/virtualmcpserver_deployment.gocmd/thv-operator/pkg/controllerutil/tokenexchange.gopkg/vmcp/auth/converters/upstream_inject.goUpstreamInjectConverter— CRD spec to runtime configpkg/vmcp/auth/converters/upstream_inject_test.gopkg/vmcp/auth/converters/token_exchange.goSubjectProviderNamethrough token exchange converterpkg/vmcp/auth/converters/token_exchange_test.godeploy/charts/*/crds/*.yamldocs/operator/crd-api.mdSpecial notes for reviewers
🤖 Generated with Claude Code