stacklok / toolhive / 38220785501

71%

Build Type

push

github

Committed by web-flow

Commit Message

Add operator support for Redis session storage TLS (#6767)

* Move Redis TLS test fixture to testkit

Shared test fixtures live under test/testkit. Move the redistls
helper added for Redis session storage TLS there and update its
importers; the fixture itself is unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Giuseppe Scuglia <peppescg@gmail.com>

* Warn when Redis session storage lacks TLS

Session storage now supports TLS, but omitting it keeps the previous
plaintext connection so existing deployments are unaffected. Make
that choice visible: when a Redis password is configured, the proxy
runner and vMCP session stores log one startup WARN if TLS is not
set or certificate verification is disabled. The connection is still
allowed and the password is never logged.

The message also notes that the operator-wide default Redis
(TOOLHIVE_DEFAULT_REDIS_ADDR) cannot enable TLS yet. The rate
limiter always shares these settings, so it does not warn again.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Giuseppe Scuglia <peppescg@gmail.com>

* Add session storage TLS to the operator

#6731 lets the proxy runner and vMCP connect to Redis session
storage over TLS, but only through hand-written RunConfig or vMCP
YAML. Operator-managed workloads had no way to request it.

Add spec.sessionStorage.tls to MCPServer, MCPRemoteProxy and
VirtualMCPServer. It reuses the existing RedisTLSConfig type from
the embedded auth server's Redis storage:

- An empty object verifies the server certificate against the
  system roots.
- caCertSecretRef mounts a private CA from a Secret at
  /etc/toolhive/session-redis-tls/ca.crt, read-only and via
  subPath, as for the auth server's Redis CA.
- insecureSkipVerify disables verification, for testing only.

The operator writes these settings into the RunConfig
(scaling_config.session_redis.tls) and the vMCP config
(sessionStorage.tls). On VirtualMCPSer... (continued)

Coverage Stats

182 of 198 new or added lines in 16 files covered. (91.92%)

10 existing lines in 4 files now uncovered.

85813 of 120587 relevant lines covered (71.16%)

126.53 hits per line