Use compound (kind, name) listMapKey on ReferencingWorkloads

The original review of this PR flagged that +listMapKey=name alone is
insufficient: two workloads of different kinds that share a name (an
MCPServer "foo" and a VirtualMCPServer "foo") would collide under
merge-patch semantics, with the second-applied entry silently
overwriting the first. Adding +listMapKey=kind makes the map key the
(kind, name) pair so cross-kind name reuse stays distinct.

Limited to MCPAuthzConfig here. The two sibling controllers
(MCPOIDCConfig, MCPExternalAuthConfig) share the same WorkloadReference
type and have the same listMapKey=name asymmetry — filed as a parity
follow-up rather than expanding this PR's scope.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: ChrisJBurns

cmd/thv-operator/api/v1beta1/mcpauthzconfig_types.go

@@ -64,8 +64,12 @@ type MCPAuthzConfigStatus struct {
 	ReferenceCount int32 `json:"referenceCount,omitempty"`
 
 	// ReferencingWorkloads is a list of workload resources that reference this MCPAuthzConfig.
-	// Each entry identifies the workload by kind and name.
+	// Each entry identifies the workload by kind and name. The map key is the
+	// (kind, name) pair so two workloads of different kinds that share a name
+	// (e.g., an MCPServer "foo" and a VirtualMCPServer "foo") are distinct
+	// entries rather than colliding under merge-patch semantics.
 	// +listType=map
+	// +listMapKey=kind
 	// +listMapKey=name
 	// +optional
 	ReferencingWorkloads []WorkloadReference `json:"referencingWorkloads,omitempty"`

deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_mcpauthzconfigs.yaml

@@ -163,7 +163,10 @@ spec:
               referencingWorkloads:
                 description: |-
                   ReferencingWorkloads is a list of workload resources that reference this MCPAuthzConfig.
-                  Each entry identifies the workload by kind and name.
+                  Each entry identifies the workload by kind and name. The map key is the
+                  (kind, name) pair so two workloads of different kinds that share a name
+                  (e.g., an MCPServer "foo" and a VirtualMCPServer "foo") are distinct
+                  entries rather than colliding under merge-patch semantics.
                 items:
                   description: |-
                     WorkloadReference identifies a workload that references a shared configuration resource.
@@ -186,6 +189,7 @@ spec:
                   type: object
                 type: array
                 x-kubernetes-list-map-keys:
+                - kind
                 - name
                 x-kubernetes-list-type: map
             type: object
@@ -338,7 +342,10 @@ spec:
               referencingWorkloads:
                 description: |-
                   ReferencingWorkloads is a list of workload resources that reference this MCPAuthzConfig.
-                  Each entry identifies the workload by kind and name.
+                  Each entry identifies the workload by kind and name. The map key is the
+                  (kind, name) pair so two workloads of different kinds that share a name
+                  (e.g., an MCPServer "foo" and a VirtualMCPServer "foo") are distinct
+                  entries rather than colliding under merge-patch semantics.
                 items:
                   description: |-
                     WorkloadReference identifies a workload that references a shared configuration resource.
@@ -361,6 +368,7 @@ spec:
                   type: object
                 type: array
                 x-kubernetes-list-map-keys:
+                - kind
                 - name
                 x-kubernetes-list-type: map
             type: object

deploy/charts/operator-crds/templates/toolhive.stacklok.dev_mcpauthzconfigs.yaml

@@ -166,7 +166,10 @@ spec:
               referencingWorkloads:
                 description: |-
                   ReferencingWorkloads is a list of workload resources that reference this MCPAuthzConfig.
-                  Each entry identifies the workload by kind and name.
+                  Each entry identifies the workload by kind and name. The map key is the
+                  (kind, name) pair so two workloads of different kinds that share a name
+                  (e.g., an MCPServer "foo" and a VirtualMCPServer "foo") are distinct
+                  entries rather than colliding under merge-patch semantics.
                 items:
                   description: |-
                     WorkloadReference identifies a workload that references a shared configuration resource.
@@ -189,6 +192,7 @@ spec:
                   type: object
                 type: array
                 x-kubernetes-list-map-keys:
+                - kind
                 - name
                 x-kubernetes-list-type: map
             type: object
@@ -341,7 +345,10 @@ spec:
               referencingWorkloads:
                 description: |-
                   ReferencingWorkloads is a list of workload resources that reference this MCPAuthzConfig.
-                  Each entry identifies the workload by kind and name.
+                  Each entry identifies the workload by kind and name. The map key is the
+                  (kind, name) pair so two workloads of different kinds that share a name
+                  (e.g., an MCPServer "foo" and a VirtualMCPServer "foo") are distinct
+                  entries rather than colliding under merge-patch semantics.
                 items:
                   description: |-
                     WorkloadReference identifies a workload that references a shared configuration resource.
@@ -364,6 +371,7 @@ spec:
                   type: object
                 type: array
                 x-kubernetes-list-map-keys:
+                - kind
                 - name
                 x-kubernetes-list-type: map
             type: object