stacklok / toolhive / 39427607957

73%

Build Type

push

github

Committed by web-flow

Commit Message

Expose DCR client cap and register rate limit in CRD (#6867)

* Expose DCR client cap and register rate in CRD

Operator-managed deployments, the main multi-replica Redis audience,
could not set the DCR client cap or the /oauth/register rate limit
added in #6863, so a Redis deployment already over the default cap had
no way to raise it before upgrading.

Implements changes for issue #6864:
- Add storage.maxDCRClients (minimum 0) and registrationRateLimit to
  the embedded auth server config. The rate limit reuses the CRD's
  RateLimitBucket (maxTokens, refillPeriod) rather than a float field.
- Convert both in BuildAuthServerRunConfig. A memory storage config is
  now emitted when it sets a cap; a non-positive refillPeriod is
  rejected as an invalid config.
- Regenerate CRDs, API docs and the swagger/SDK descriptions, and drop
  the "not yet settable through the operator" notes from the docs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Validate registration refill period at admission

A zero or negative refillPeriod was only caught at reconcile time. A
CEL rule on registrationRateLimit now rejects it when the resource is
created, and the Go check stays as a backstop for objects admitted
before the rule existed. The rule sits on the field rather than the
shared RateLimitBucket type, so MCPServer rate limits are unchanged.

Envtest cases cover the new admission rules for both fields.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Name CRD fields in registration rate errors

Addresses stacklok/toolhive#6867 review comments:
- LOW cmd/thv-operator/pkg/controllerutil/authserver.go (4319701380): describe the refillPeriod check as defense in depth
- LOW cmd/thv-operator/pkg/controllerutil/authserver.go (4319701407): check maxTokens and wrap RunConfig validation errors with the CRD field name
- LOW cmd/thv-operator/test-integration/mcp-external-auth/dcr_cap_validation_test.go (4319701411): cover VirtualMCPServer admission and vMC... (continued)

Coverage Stats

37 of 48 new or added lines in 2 files covered. (77.08%)

590 existing lines in 15 files now uncovered.

88028 of 123265 relevant lines covered (71.41%)

127.12 hits per line