stacklok / toolhive / 28310930043

67%

Build Type

push

github

Committed by web-flow

Commit Message

Expose InsecureAllowHTTP on EmbeddedAuthServerConfig for VirtualMCPServer (#5671)

* Expose InsecureAllowHTTP on EmbeddedAuthServerConfig for VirtualMCPServer

Implements changes for issue #5668:
- Add InsecureAllowHTTP bool to EmbeddedAuthServerConfig CRD field so
  deployers can explicitly opt in to http:// issuers for in-cluster
  Kubernetes deployments on trusted pod networks
- Add admission-time validation in validateAuthServerConfig that sets
  AuthServerConfigValidated=False when an http:// non-localhost issuer
  is used without InsecureAllowHTTP, surfacing the error via operator
  conditions instead of a pod startup crash
- Add InsecureAllowHTTP to authserver.RunConfig and authserver.Config;
  update validateIssuerURL to accept and respect the flag
- Wire InsecureAllowHTTP from the CRD field through BuildAuthServerRunConfig
  and the embedded authserver runner into Config.Validate()
- Regenerate deepcopy, CRD YAML manifests, and CRD API docs

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* Address review feedback for InsecureAllowHTTP

- Add InsecureAllowHTTP test cases to TestBuildAuthServerRunConfig to
  verify the CRD field propagates to RunConfig
- Add comment explaining why the url.Parse error guard in
  validateAuthServerConfig is safe (CRD regex pre-validates at admission)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* Regenerate server API docs after InsecureAllowHTTP changes

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* Fix doc scoping, guard correctness, and error idioms

Addresses stacklok/toolhive#5671 review comments:
- MEDIUM mcpexternalauthconfig_types.go (3487247015): Scope InsecureAllowHTTP
  admission check description to VirtualMCPServer; note MCPServer/MCPRemoteProxy
  defer to pod-startup Config.Validate(), matching the precedent set by
  the primaryUpstreamProvider comment above it. Regenerate CRD YAML and docs.
- LOW mcpexternalauthconfig_... (continued)

Coverage Stats

51 of 55 new or added lines in 5 files covered. (92.73%)

7 existing lines in 4 files now uncovered.

69816 of 103510 relevant lines covered (67.45%)

65.12 hits per line