stacklok / toolhive / 32428953208

70%

Build Type

push

github

Committed by web-flow

Commit Message

Allow opt-in private endpoints for remote URLs (#6195)

ValidateRemoteURL unconditionally rejected private and in-cluster
endpoints, blocking the legitimate case of a vMCP reaching a
co-located in-cluster backend in-mesh, where routing through the
mesh preserves Istio/SPIFFE workload identity for the backend's
authorization policy.

Add an allowPrivateEndpoint field to MCPServerEntry and
MCPRemoteProxy that relaxes only the private-network checks:
RFC 1918 ranges, IPv6 unique-local addresses, and hostnames
ending in cluster.local. Loopback, link-local, cloud-metadata,
localhost, and kubernetes.default endpoints stay blocked
regardless of the flag, and behavior with the flag unset is
unchanged.

Signed-off-by: Prem Kumar Sompura <prem_sompura@hotmail.com>

Coverage Stats

29 of 30 new or added lines in 3 files covered. (96.67%)

6 existing lines in 4 files now uncovered.

74351 of 107366 relevant lines covered (69.25%)

87.76 hits per line