stacklok / toolhive / 23803174445

65%

Build Type

push

github

Committed by web-flow

Commit Message

Add MCPOIDCConfig CRD types and MCPServer reference field (#4461)

* Add MCPOIDCConfig CRD types and generated manifests

Platform engineers managing multiple MCP servers with the same identity
provider currently must duplicate OIDC configuration across every
MCPServer resource. This introduces the MCPOIDCConfig CRD that allows
defining shared OIDC configuration once.

The CRD supports three configuration variants (kubernetesServiceAccount,
configMapRef, inline) validated via CEL rules with a type discriminator
field following the established MCPExternalAuthConfig pattern. Audience
and scopes are intentionally excluded from the shared config and will be
specified per-server via MCPOIDCConfigReference when workload CRDs add
reference fields (#4253).

Ref #4248

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Remove configMapRef variant from MCPOIDCConfig

A ConfigMap reference inside a dedicated CRD is unnecessary indirection.
The purpose of MCPOIDCConfig is to be the centralized config — pointing
it at a ConfigMap just adds a hop without value. The two remaining
variants (kubernetesServiceAccount and inline) cover all use cases.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

3 of 141 new or added lines in 2 files covered. (2.13%)

54 existing lines in 2 files now uncovered.

53022 of 80980 relevant lines covered (65.48%)

64.97 hits per line