stacklok / toolhive / 23913750753

65%

Build Type

push

github

Committed by web-flow

Commit Message

Wire MCPOIDCConfig into VirtualMCPServer controller (#4493)

VirtualMCPServer can now reference a shared MCPOIDCConfig resource via
incomingAuth.oidcConfigRef, matching the pattern already established for
MCPServer. The legacy inline oidcConfig field is deprecated and will be
removed in v1beta1.

Key changes:
- Add oidcConfigRef field to IncomingAuthConfig with CEL mutual-exclusivity
  validation against the deprecated oidcConfig field
- Converter resolves OIDC config from MCPOIDCConfig references using
  ResolveFromConfigRef, including client secret and CA bundle handling
- VirtualMCPServer controller validates the referenced MCPOIDCConfig,
  tracks config hash changes, and watches for MCPOIDCConfig updates
- MCPOIDCConfig controller now tracks VirtualMCPServer references in
  ReferencingWorkloads and blocks deletion while referenced
- Deployment builder propagates errors from MCPOIDCConfig fetch failures
  rather than silently producing misconfigured deployments

Closes #4253
Closes #4248

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

37 of 302 new or added lines in 5 files covered. (12.25%)

4 existing lines in 2 files now uncovered.

54271 of 83028 relevant lines covered (65.36%)

62.99 hits per line