stacklok / toolhive / 17494736118

60%

Build Type

push

github

Committed by web-flow

Commit Message

Allow setting annotations on the proxy runner pods, use them to set up Vault integration (#1736)

* Extend the CRD with a way to set proxyrunner's pod template spec annotations

Adds a new CRD field `PodTemplateMetadataOverrides`. This field allows
to set metadata (labels, annotations) on the pod template of the proxy
runner workload - this is different from us being able to set the
metadata on the MCP server itself through the pod template field in the
MCPServer CRD as well as the existing metadata overrides which only work
for the deployment itself.

* Point to --env-file-dir=/vault/secrets if vault annotation is detected

If the user sets annotatiosnf for Hashicorp vault, in particular the
`vault.hashicorp.com/agent-inject` annotation, we expect the agent
injector to create an env file with Vault secrets at `/vault/secrets/`
In this case, we point the proxy runner at that directory so that it can
populate environment variables for the MCP server from that directory.

* Vault test setup script and test workload

Adds a setup script that presumes that a kind cluster with thv operator
is running.

Adds an example workload that reads the Vault secrets provisioned by our
task targets with Vault as github MCP server secret

---------

Co-authored-by: Don Browne <dmjb@users.noreply.github.com>

Run Details

17 of 26 new or added lines in 2 files covered. (65.38%)

23 existing lines in 2 files now uncovered.

10695 of 28437 relevant lines covered (37.61%)

16.56 hits per line