stacklok / toolhive / 32852900413

71%

Build Type

push

github

Committed by web-flow

Commit Message

Allow loopback delegate clients (#6426)

* Allow loopback delegate clients

The CEL rule on EmbeddedAuthServerConfig rejected every http:// issuer
whenever delegateClients were configured. That blocked the supported local
and Kind token-exchange path, where the embedded auth server issues on
http://127.0.0.1 and the operator has already opted in through
insecureAllowConfidentialOverLoopbackHTTP.

Replace the categorical rule with one that admits an http:// issuer only
when that opt-in is explicitly set, and leave the loopback-host check to
the shared Go validator. CEL has no URL parser, so it cannot separate
http://127.0.0.1 from http://auth.example.com without a regex that risks
admitting a non-loopback host.

Tighten ValidateConfidentialClientTransport to carry that weight. It
previously short-circuited to nil as soon as the loopback opt-in was set,
and returned nil for a plain-HTTP non-loopback issuer, deferring both to
validateIssuerURL at pod startup. It now parses the issuer once and
rejects a non-loopback plain-HTTP issuer whether or not the opt-in is set,
so the misconfiguration surfaces as a reconcile error instead of a
crashloop. Nothing that previously reconciled cleanly is newly rejected.

Drop the envtest that asserted the removed CEL message, since the same
combination is now rejected at reconcile rather than at admission.

Fixes #6423

* Address delegate client review feedback

* Regenerate API docs for delegate clients

* Sanitize issuer validation errors

Coverage Stats

31 of 31 new or added lines in 2 files covered. (100.0%)

12 existing lines in 4 files now uncovered.

74876 of 107929 relevant lines covered (69.38%)

87.96 hits per line