stacklok / toolhive / 24207493571

push

github

Add vMCP MCPServerEntry dynamic mode reconciler (#4710)

* Add vMCP MCPServerEntry dynamic mode reconciler

Enable vMCP dynamic mode to watch MCPServerEntry resources at runtime,
automatically adding/removing them as backends without restart.

- Add CABundleData []byte to Backend and BackendTarget for dynamic mode
  CA bundle support (fetched from K8s ConfigMaps, not volume-mounted)
- Extend newBackendTransport to accept CA cert bytes alongside file path,
  with data taking precedence over path
- Set Backend.Type = BackendTypeEntry in mcpServerEntryToBackend()
- Add fetchCABundleData() to read CA PEM from ConfigMap via CABundleRef
- Extend fetchBackendResource() to try MCPServerEntry as third type
- Add MCPServerEntry watch with groupRef filtering in SetupWithManager()
- Add MCPServerEntry to ExternalAuthConfig change handler
- Add ConfigMap watch for CA bundle changes affecting entry backends

Closes #4659

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Address review feedback on dynamic mode reconciler

- F1: Make CA bundle fetch failure fatal — return nil to exclude backend
  when explicitly configured caBundleRef can't be loaded (matches auth
  config failure pattern, prevents silent TLS trust degradation)
- F2: Add field index for ConfigMap→MCPServerEntry lookup via
  SetupIndexes() — replaces full List+filter with indexed cache query
- F3: Restore source context in CA parse error messages (file path or
  "inline data") for operator debuggability
- F4: Add table-driven tests for fetchCABundleData covering all 5 code
  paths (nil ref, not found, key missing, default key, explicit key)
- F5: Extract MapAuthConfigToEntries() as exported method with 4 test
  cases covering group/auth config matching and filtering
- F6: Update architecture docs (09-operator, 10-virtual-mcp) to document
  MCPServerEntry discovery, ConfigMap watching, and field-indexed lookup

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
... (continued)

78 of 136 new or added lines in 4 files covered. (57.35%)

56546 of 86898 relevant lines covered (65.07%)

61.5 hits per line