stacklok / toolhive / 34117058800

70%

Build Type

push

github

Committed by web-flow

Commit Message

Expose SPIFFE client-auth registration through the operator CRDs (#6500)

The runtime already supports declaring SPIFFE trust domains and
associating SPIFFE principals with OAuth clients, but only through a
hand-authored auth-server RunConfig file; there was no way to declare
it through the MCPExternalAuthConfig/VirtualMCPServer CRDs.

Add SPIFFETrustDomainConfig and SPIFFEClientConfig CRD types (mirroring
the runtime shape field-for-field), CEL admission validation for the
paired-configuration, duplicate-name, and trust-domain/principal
cross-reference invariants, and Go-level bridging into
authserver.ValidateSPIFFETrust for the checks CEL cannot express.
Audiences, scopes, and resource-indicator items now carry length and
shape constraints at admission time, matching the convention already
used for AllowedResources and TrustedIssuerConfig elsewhere in this
file, instead of deferring all of it to reconcile time.

Refs #6199

Signed-off-by: Jakub Hrozek <jakub@stacklok.com>

Coverage Stats

113 of 204 new or added lines in 4 files covered. (55.39%)

12 existing lines in 5 files now uncovered.

79033 of 112628 relevant lines covered (70.17%)

92.93 hits per line