stacklok / toolhive / 32974088242

70%

Build Type

push

github

Committed by web-flow

Commit Message

Trust private CAs for upstream auth servers (#6428)

* Trust private CAs for upstream auth servers

An embedded auth server could not complete an authorization-code exchange
with an OAuth2 or OIDC provider whose certificate is signed by a private
CA, so an in-cluster IdP behind an internal PKI was unusable as an
upstream.

Add caBundleRef to the OIDC and OAuth2 upstream configs. The operator
projects the selected ConfigMap key as a read-only ca.crt per upstream and
passes its path to the provider and DCR clients, so one upstream's private
CA is not implicitly trusted for another or for unrelated traffic.

Such an upstream may present either a publicly trusted certificate or a
private one, so these clients need the system roots as well as the bundle.
Add WithSystemRootsPlusCABundle for that and leave WithCABundle pinning:
its other callers include the JWKS and introspection clients that validate
incoming tokens, where a bundle is often configured precisely to restrict
trust to a private issuer.

The bundle is mounted with subPath, which kubelet never refreshes, so a
rotated CA reaches a running pod only through a pod template change. Hash
the selected bytes into a pod template annotation and compare it during
drift detection on MCPServer, MCPRemoteProxy and VirtualMCPServer,
including when caBundleRef is removed.

Resolve and PEM-validate each reference during reconciliation. A missing
ConfigMap, absent key, or malformed certificate surfaces as a status
condition rather than a pod that starts without the trust roots its
upstream requires.

Fixes #6417

Signed-off-by: Jakub Hrozek <jakub@stacklok.com>

* Clarify embedded auth CA key requirement

Signed-off-by: Jakub Hrozek <jakub@stacklok.com>

* Regenerate OpenAPI docs for upstream CA fields

The new CAFilePath fields on the authserver upstream run-configs are part
of the generated API surface, so the committed spec no longer matched what
swag produces and the docgen check failed.

Regenerating also dr... (continued)

Coverage Stats

497 of 675 new or added lines in 23 files covered. (73.63%)

28 existing lines in 8 files now uncovered.

75899 of 109201 relevant lines covered (69.5%)

89.77 hits per line