stacklok / toolhive / 42632968875

73%

Build Type

push

github

Committed by web-flow

Commit Message

Expose auth server TLS listener port in operator (#7065)

* Expose auth server TLS listener port in operator

The runner and vMCP serve the embedded auth server's TLS listener on
port 8443, but the operator never exposed it, so nothing in the
cluster could reach it. When tlsListener is set, add an https-auth
container port and Service port for MCPServer, MCPRemoteProxy and
VirtualMCPServer. The existing http port is unchanged, so upgrading
does not rewrite Services or roll pods.

Drift detection compared only the first port, so a second port would
never have reached existing workloads. Check every port the operator
owns instead. Service ports are matched by name and container ports
by number and protocol, so a port renamed through a vMCP
podTemplateSpec is not reported as drift. Ports added by others are
not drift, and a leftover https-auth port is removed when the
listener is turned off. Service updates still replace the whole port
list, as before.

Part of #6205

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Narrow container port leftover detection

Review asked for a precise rule for leftover container ports. A port
is now a leftover only if it equals a port the operator can render
(name, number and protocol) and is not wanted. A user port that only
shares the https-auth name, for example on 9443 in a vMCP
podTemplateSpec, no longer causes a Deployment update on every
reconcile.

Document that extra Service and container ports are not drift but
are dropped when the operator updates the list, and that the
repeated TLS listener lookups are deliberate. Add tests for an auth
config lookup that fails with an error other than NotFound. Make the
envtest "writes nothing" specs make a spec change that leaves the
ports alone and wait for that reconcile before checking that nothing
is written again.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Cover TLS listener lookup failures in tests

Add a MCPServer Reconcile case and a remote proxy builder case for a... (continued)

Coverage Stats

160 of 160 new or added lines in 7 files covered. (100.0%)

16 existing lines in 5 files now uncovered.

93915 of 129053 relevant lines covered (72.77%)

850.67 hits per line