Skip to content

THV-0023: Remove configMapRef from MCPOIDCConfig #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ChrisJBurns merged 1 commit into from
Mar 31, 2026
+2 −6
Merged

THV-0023: Remove configMapRef from MCPOIDCConfig #64

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 2 additions & 6 deletions rfcs/THV-0023-crd-v1beta1-optimization.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,10 +195,6 @@ spec:
requiredClaims:
iss: https://kubernetes.default.svc
# OR
configMapRef:
name: oidc-config
key: oidc.json
# OR
inline:
issuer: https://keycloak.example.com/realms/prod
clientId: toolhive-client
Expand Down Expand Up @@ -226,7 +222,7 @@ status:
```

**Key design decisions:**
- CEL validation ensures exactly one of `kubernetesServiceAccount`, `configMapRef`, or `inline` is set
- CEL validation ensures exactly one of `kubernetesServiceAccount` or `inline` is set
- `audience` and `scopes` are intentionally excluded from the shared config - they are per-server fields specified in the reference

#### New CRD 2: MCPTelemetryConfig
Expand Down Expand Up @@ -503,7 +499,7 @@ CRDs use CEL (Common Expression Language) for admission-time validation:

| CRD | Rule | Validation |
|-----|------|------------|
| MCPOIDCConfig | Exactly one source | `kubernetesServiceAccount`, `configMapRef`, or `inline` - only one allowed |
| MCPOIDCConfig | Exactly one source | `kubernetesServiceAccount` or `inline` - only one allowed |
| MCPAuthzConfig | Exactly one source | `configMapRef` or `inline` - only one allowed |
| MCPServerSpec | Transport/port consistency | `mcpPort` cannot be set when transport is `stdio` |
| IncomingAuthConfig | Auth mode selection | Either `oidcConfigRef` or `anonymous` - only one allowed |
Expand Down