stacklok / toolhive / 34125130794
71%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 912
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 70.11% (-0.06%) from 70.172%
34125130794

push

github

web-flow 
Document SPIFFE association declarations (#6501)

* Expose SPIFFE client-auth registration through the operator CRDs

The runtime already supports declaring SPIFFE trust domains and
associating SPIFFE principals with OAuth clients, but only through a
hand-authored auth-server RunConfig file; there was no way to declare
it through the MCPExternalAuthConfig/VirtualMCPServer CRDs.

Add SPIFFETrustDomainConfig and SPIFFEClientConfig CRD types (mirroring
the runtime shape field-for-field), CEL admission validation for the
paired-configuration, duplicate-name, and trust-domain/principal
cross-reference invariants, and Go-level bridging into
authserver.ValidateSPIFFETrust for the checks CEL cannot express.
Audiences, scopes, and resource-indicator items now carry length and
shape constraints at admission time, matching the convention already
used for AllowedResources and TrustedIssuerConfig elsewhere in this
file, instead of deferring all of it to reconcile time.

Refs #6199

Signed-off-by: Jakub Hrozek <jakub@stacklok.com>

* Document SPIFFE association declarations

The runtime and CRD-exposure layers for SPIFFE client-auth have no
architecture documentation, leaving the design (trust domains,
principal-to-client association, the still-enforced validation gate)
undiscoverable outside the code itself.

Add docs/arch/18-spiffe-association-declarations.md describing the
model, and cross-link it from the operator and auth-server storage
architecture docs and the docs/arch index. State the terminal current
behavior (RunConfig.Validate() rejects any non-empty configuration
pending real SVID verification) prominently rather than presenting the
YAML example as deployable, and correct several claims that had
drifted from the current implementation: resources now reach
request-time enforcement, CIMD does persist durable client state (via
UpsertDCRIssuedClient, which refuses to clobber a configured client),
and a changed or removed association does not take effect af... (continued)

78964 of 112628 relevant lines covered (70.11%)

93.18 hits per line

Coverage Regressions

Lines Coverage ∆ File
49
59.0
 -5.1% pkg/workloads/manager.go
6
19.87
 -3.97% pkg/client/manager.go
6
72.34
 -6.38% pkg/secrets/keyring/keyctl_linux.go
3
0.0
 -100.0% pkg/workloads/sysproc_unix.go
2
56.52
 -4.35% pkg/transport/session/sse_session.go
2
50.66
 -0.53% pkg/transport/stdio.go
1
94.82
 0.0% pkg/authserver/storage/memory.go
1
96.77
 -3.23% pkg/foreach/foreach.go
1
78.26
 -0.29% pkg/transport/proxy/httpsse/http_proxy.go
1
81.07
 -0.12% pkg/vmcp/composer/workflow_engine.go
Jobs
ID Job ID Ran Files Coverage
1 34125130794.1 912
70.11
 GitHub Action Run
Source Files on build 34125130794