stacklok / toolhive
71%

DEFAULT BRANCH: main
Repo Added
Files 955
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: SELECT
CHANGE BRANCH
x

coverage: 71.338% (-0.01%) from 71.349%
38864104745

push

github

web-flow 
Grant pods/attach only for stdio transport (#6841)

* Grant pods/attach only for stdio transport

The proxy-runner Role created for every MCPServer carried
pods/attach (create, get) regardless of transport. Only stdio
uses it: the runner reaches a stdio MCP server by attaching to
its pod through Client.AttachToWorkload, which is called only
from pkg/transport/stdio.go. A streamable-http or sse server
talks to its pod over the network and never attaches.

Security auditors flag pods/attach as equivalent to pod exec,
so clusters with strict policies saw a finding on every
MCPServer deployment for a permission that could not be used.

Split the rule out of defaultRBACRules into stdioRBACRules and
choose between them in rbacRulesForTransport. An absent
transport is treated as stdio, matching the CRD default, so an
object stored before that default existed keeps working.

Already-deployed servers are corrected without operator action:
EnsureRBACResources replaces Rules wholesale, so the next
reconcile rewrites the Role.

Closes #6230

Signed-off-by: hellouz818 <hellouz818@gmail.com>

* Split proxy-runner Role fixtures by transport

The chainsaw operator E2E suites asserted one shared
proxyrunner-role.yaml for the stdio, sse, streamable-http and
stdio-streamable-http scenarios. That stopped holding once
pods/attach became transport-dependent: chainsaw matches the
rules array positionally and on length, so the stdio scenarios
failed on the rule having moved to the end, and the HTTP ones
would fail on it being absent.

Replace the shared file with proxyrunner-role-stdio.yaml (six
rules, pods/attach last) and proxyrunner-role-http.yaml (the
five shared rules), and point each scenario at the one matching
the transport in its mcpserver.yaml. Both files still spell out
the complete expected Role, so an over-granted rule fails the
assertion rather than slipping through.

Only the multi-tenancy run reached CI: chainsaw runs with
FailFast and both suites share one s... (continued)

6 of 6 new or added lines in 1 file covered. (100.0%)

19 existing lines in 5 files now uncovered.

87199 of 122234 relevant lines covered (71.34%)

126.43 hits per line

Relevant lines Covered
122234 RELEVANT LINES 87199 COVERED LINES
126.43 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
38864104745 main Grant pods/attach only for stdio transport (#6841) * Grant pods/attach only for stdio transport The proxy-runner Role created for every MCPServer carried pods/attach (create, get) regardless of transport. Only stdio uses it: the runner reaches a... push web-flow github
71.34
38861100729 fix/6230-scope-pods-attach-to-stdio Merge a62fa9d7f into 87ed79d94 Pull #6841 web-flow github
71.34
38857167135 fix/6230-scope-pods-attach-to-stdio Merge f032628f2 into 87ed79d94 Pull #6841 web-flow github
71.34
38820243011 claude-desktop-connectors Merge 5c6af0f99 into 87ed79d94 Pull #6840 web-flow github
71.33
38805605138 main Honor PI_CODING_AGENT_DIR for Pi MCP and skills (#6839) thv llm setup already wrote models.json under $PI_CODING_AGENT_DIR, but the Pi MCP config (mcp.json) and global skills still resolved to ~/.pi/agent. A user with the variable set ended up wi... push web-flow github
71.35
38784363398 jerm-dro/pi-agent-dir-paths Merge 265772d03 into 973200560 Pull #6839 web-flow github
71.34
38782131734 main Support Pi in LLM gateway setup (#6818) * Support Pi in LLM gateway setup * Address Pi setup review feedback * Address remaining Pi setup review feedback Keep Anthropic discovery and requests on the same gateway path, and explain Pi's environm... push web-flow github
71.37
38776970765 jerm-dro/01M4V9PD4R0QSHWWQCNZ9R21AH Merge e8136755d into 0dcd0ad36 Pull #6818 web-flow github
71.32
38771613673 keep-tools-list-members Merge 551618aaa into 0dcd0ad36 Pull #6813 web-flow github
71.31
38768460090 fix/vmcp-bound-initialize Merge 30122a4cc into 0dcd0ad36 Pull #6380 web-flow github
71.31
See All Builds (13377)