stacklok / toolhive / 39840999664

73%

Build Type

push

github

Committed by web-flow

Commit Message

Mount workload auth secrets in inline mode (#6905)

buildOutgoingAuthConfig embeds the strategy a workload references
through spec.externalAuthConfigRef into the vMCP config in both
outgoing auth source modes, but buildOutgoingAuthEnvVars mounted the
secret that strategy names only when source was "discovered". With
source: inline the ConfigMap therefore asked the vMCP for an env var
the Deployment did not carry, and the pod exited at startup with
"environment variable TOOLHIVE_HEADER_INJECTION_VALUE_<CONFIG> not
set or empty". Reported for an MCPServerEntry, the mismatch applies
to MCPServer and MCPRemoteProxy refs, and to every strategy whose
runtime config reads a secret env var.

Discover workload secrets in both modes, and skip backends that carry
an inline override so the two paths stay aligned: the override's
strategy is what reaches the config, so only its secret belongs on
the Deployment. The skip is per workload rather than per config, so a
config another, non-overridden workload references is still mounted.

Document what outgoingAuth.source does and does not select, since the
API reference described the two modes without saying that workload
references are read in both.

Refs: #6837

Signed-off-by: hellouz818 <hellouz818@gmail.com>

Coverage Stats

4 of 4 new or added lines in 1 file covered. (100.0%)

50 existing lines in 3 files now uncovered.

88678 of 123952 relevant lines covered (71.54%)

126.8 hits per line