Add MCPOIDCConfig controller for lifecycle management#4462
Open
ChrisJBurns wants to merge 8 commits intomainfrom
Open
Add MCPOIDCConfig controller for lifecycle management#4462ChrisJBurns wants to merge 8 commits intomainfrom
ChrisJBurns wants to merge 8 commits intomainfrom
Conversation
Platform engineers managing multiple MCP servers with the same identity provider currently must duplicate OIDC configuration across every MCPServer resource. This introduces the MCPOIDCConfig CRD that allows defining shared OIDC configuration once. The CRD supports three configuration variants (kubernetesServiceAccount, configMapRef, inline) validated via CEL rules with a type discriminator field following the established MCPExternalAuthConfig pattern. Audience and scopes are intentionally excluded from the shared config and will be specified per-server via MCPOIDCConfigReference when workload CRDs add reference fields (#4253). Ref #4248 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
A ConfigMap reference inside a dedicated CRD is unnecessary indirection. The purpose of MCPOIDCConfig is to be the centralized config — pointing it at a ConfigMap just adds a hop without value. The two remaining variants (kubernetesServiceAccount and inline) cover all use cases. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds the controller that reconciles MCPOIDCConfig resources. It manages the core CRD lifecycle: adds a finalizer on first reconciliation, validates the spec and sets a Valid condition, and computes a config hash for change detection stored in status. Reference tracking (referencingServers), cascade to workloads via annotation, deletion protection, and duplicate audience warnings will be wired up when workload CRDs gain OIDCConfigRef fields (#4253). Ref #4248 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
ChrisJBurns
requested review from
JAORMX,
jerm-dro,
jhrozek and
yrobla
as code owners
Unit tests (6 functions, 15 subtests): - Config hash consistency across both spec variants - Full reconciliation lifecycle for inline and kubernetesServiceAccount - Deletion handling (finalizer removal) - Config change detection and hash update - Validation failure sets Valid=False condition - Type validation defense-in-depth (valid and invalid configs) Integration tests (3 cases via envtest): - Valid condition and config hash set on creation - Config hash updates when spec changes - Deletion succeeds (finalizer removed, object deleted) Ref #4248 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4462 +/- ##
==========================================
- Coverage 69.64% 69.61% -0.04%
==========================================
Files 491 492 +1
Lines 50304 50378 +74
==========================================
+ Hits 35036 35069 +33
- Misses 12580 12618 +38
- Partials 2688 2691 +3 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
github-actions
bot
added
size/XL
![github-actions[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Large PR Detected
This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.
How to unblock this PR:
Add a section to your PR description with the following format:
## Large PR Justification
[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformationAlternative:
Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.
See our Contributing Guidelines for more details.
This review will be automatically dismissed once you add the justification section.
github-actions
bot
added
size/XL
github-actions
bot
added
size/L
github-actions
bot
dismissed
their stale review
PR size has been reduced below the XL threshold. Thank you for splitting this up!
Contributor
|
✅ PR size has been reduced below the XL threshold. The size review has been dismissed and this PR can now proceed with normal review. Thank you for splitting this up! |
github-actions
bot
added
size/L
github-actions
bot
added
size/L
Remove redundant Reconcile table-driven test (subset of ConfigChange test) and add three missing tests: - ReconcileNotFound: verifies reconciling a deleted resource returns no error and does not requeue - SteadyStateNoOp: verifies a reconcile with no spec changes makes no writes (ResourceVersion unchanged) - ValidationRecovery: verifies condition transitions from Valid=False to Valid=True when an invalid config is fixed, covering the condition-changed-without-hash-change code path Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
github-actions
bot
added
size/XL
Contributor
There was a problem hiding this comment.
Large PR Detected
This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.
How to unblock this PR:
Add a section to your PR description with the following format:
## Large PR Justification
[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformationAlternative:
Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.
See our Contributing Guidelines for more details.
This review will be automatically dismissed once you add the justification section.
Add mcpoidcconfigs to the ClusterRole assertions in both single-tenancy and multi-tenancy chainsaw test suites to match the generated role.yaml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
github-actions
bot
added
size/XL
github-actions
bot
dismissed
their stale review
Large PR justification has been provided. Thank you!
Contributor
|
✅ Large PR justification has been provided. The size review has been dismissed and this PR can now proceed with normal review. |
ChrisJBurns
changed the title
github-actions
bot
added
size/XL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validcondition, and computes a config hash for change detection stored in status.OIDCConfigReffields.Ref #4248
Type of change
Test plan
task test)task lint-fix)Unit tests (6 functions, 15 subtests) cover hash computation, reconciliation lifecycle, deletion handling, config change detection, validation failure conditions, and type validation. Integration tests (3 cases via envtest) cover creation with Valid condition and hash, hash updates on spec changes, and deletion with finalizer removal.
Changes
cmd/thv-operator/controllers/mcpoidcconfig_controller.goReconcile(finalizer, validation, hash),handleDeletion,SetupWithManagercmd/thv-operator/controllers/mcpoidcconfig_controller_test.gocmd/thv-operator/test-integration/mcp-oidc-config/suite_test.gocmd/thv-operator/test-integration/mcp-oidc-config/mcpoidcconfig_controller_integration_test.gocmd/thv-operator/main.gosetupServerControllers()deploy/charts/operator/templates/clusterrole/role.yamlLarge PR Justification
Special notes for reviewers
OIDCConfigRefto workload CRDs. Comments in the code mark where this will be extended.Generated with Claude Code