stacklok / toolhive / 26297024851

push

github

Mirror MCPExternalAuthConfig Valid=False onto consumer CR conditions (#5354)

* Mirror MCPExternalAuthConfig Valid=False onto consumer CR conditions

Closes the Status Condition Parity gap noted in #5347. Before this
change, an obo-typed MCPExternalAuthConfig surfaced
Valid=False/EnterpriseRequired only on the referenced resource. The
consumer CR (MCPServer, MCPRemoteProxy, VirtualMCPServer) showed only
the generic dispatch failure, leaving users to inspect the referenced
config to understand why their workload would not deploy.

Each consumer reconciler now inspects the referenced config's Valid
condition. When it is False, the reconciler mirrors the source's reason
and message onto its own ExternalAuthConfigValidated condition (or
per-backend DiscoveredAuthConfig/BackendAuthConfig condition for vMCP).

This must merge before #5329 lights up apiserver-level admission of
obo-typed configs so production users see the failure on the resource
they applied. The envtest integration test for this propagation is
deferred to #5329 to avoid adding a setup-envtest dependency here; once
#5329 admits "obo" at the CRD layer, the test no longer needs a
CRD-enum bypass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Address code review feedback on consumer-CR mirror

Two changes from the code review on the previous commit:

1. (correctness) MCPServer.handleExternalAuthConfig now clears any
   stale ExternalAuthConfigValidated=False the mirror previously wrote
   when the referenced source has healed (Valid=True or absent).
   Without this, the False condition outlived its cause: the user fixed
   their spec but the mirror stayed sticky because MCPServer has no
   downstream True setter on this condition. Adds a regression-guard
   test case.

2. (parity) The mirror probe, typed error, and reason-extraction
   helper now live in a shared external_auth_mirror.go file instead
   of being duplicated across the three consumer reconcilers. All
  ... (continued)

101 of 109 new or added lines in 4 files covered. (92.66%)

65145 of 98983 relevant lines covered (65.81%)

63.0 hits per line