stacklok / toolhive / 31213390770

70%

Build Type

push

github

Committed by web-flow

Commit Message

Validate MCPOIDCConfig inline issuer and JWKS URLs (#5936)

* Validate MCPOIDCConfig inline issuer and JWKS URLs

The MCPOIDCConfig reconciler only checked type/config consistency, so
inline configs with malformed or plain-HTTP issuer and JWKS URLs were
accepted and failed later in the OIDC verification path. Wire the
existing validation.ValidateOIDCIssuerURL and validation.ValidateJWKSURL
helpers into the controller's validation step. The checks run at the
controller layer because pkg/validation imports the v1beta1 package, so
the types package cannot call it without an import cycle.

Add insecureAllowHTTP: true to deploy/keycloak/mcpserver-with-auth.yaml,
whose plain-HTTP issuer would otherwise fail the new check.

Signed-off-by: Roshan <rosh.s568@gmail.com>

* Allow insecureAllowHTTP to cover the JWKS URL

ValidateJWKSURL rejected any non-HTTPS URL with no escape hatch while
ValidateOIDCIssuerURL accepts HTTP behind insecureAllowHTTP, so the same
dev environment that justifies an HTTP issuer could not use an explicit
HTTP JWKS URL, and the keycloak example manifest failed the validation
this PR adds. Thread allowInsecure through ValidateJWKSURL, driven by
the same spec.inline.insecureAllowHTTP field as the issuer check.

Also assert the reconcile test on the offending URL echoed into the
condition message instead of the validator's error wording.

Regenerated: operator CRDs and docs/operator/crd-api.md for the updated
field doc.

Signed-off-by: Roshan <rosh.s568@gmail.com>

* Opt integration fixtures into insecureAllowHTTP

The mcp-remote-proxy integration fixtures build inline MCPOIDCConfigs
with an HTTP issuer and no insecureAllowHTTP, so the new URL validation
flips them to Valid=False and the referencing MCPRemoteProxy specs time
out. Add the opt-in to the two fixture helpers.

Signed-off-by: Roshan <rosh.s568@gmail.com>

* Opt MCPServer AuthServerRef fixtures into insecureAllowHTTP

Signed-off-by: Roshan <rosh.s568@gmail.com>

* Correct JWKS s... (continued)

Coverage Stats

21 of 21 new or added lines in 2 files covered. (100.0%)

11 existing lines in 3 files now uncovered.

83913 of 119558 relevant lines covered (70.19%)

98.6 hits per line