|
| 1 | +// SPDX-FileCopyrightText: Copyright 2025 Stacklok, Inc. |
| 2 | +// SPDX-License-Identifier: Apache-2.0 |
| 3 | + |
| 4 | +package v1beta1 |
| 5 | + |
| 6 | +import ( |
| 7 | + "fmt" |
| 8 | + |
| 9 | + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 10 | + runtime "k8s.io/apimachinery/pkg/runtime" |
| 11 | +) |
| 12 | + |
| 13 | +// Condition type and reasons for MCPAuthzConfig status (RFC-0023) |
| 14 | +const ( |
| 15 | + // ConditionTypeAuthzConfigValid indicates whether the MCPAuthzConfig configuration is valid |
| 16 | + ConditionTypeAuthzConfigValid = ConditionTypeValid |
| 17 | + |
| 18 | + // ConditionReasonAuthzConfigValid indicates spec validation passed |
| 19 | + ConditionReasonAuthzConfigValid = "ConfigValid" |
| 20 | + |
| 21 | + // ConditionReasonAuthzConfigInvalid indicates spec validation failed |
| 22 | + ConditionReasonAuthzConfigInvalid = "ConfigInvalid" |
| 23 | +) |
| 24 | + |
| 25 | +// MCPAuthzConfigSpec defines the desired state of MCPAuthzConfig. |
| 26 | +// MCPAuthzConfig resources are namespace-scoped and can only be referenced by |
| 27 | +// MCPServer, MCPRemoteProxy, or VirtualMCPServer resources in the same namespace. |
| 28 | +type MCPAuthzConfigSpec struct { |
| 29 | + // Type identifies the authorizer backend (e.g., "cedarv1", "httpv1"). |
| 30 | + // Must match a registered authorizer type in the factory registry. |
| 31 | + // +kubebuilder:validation:Required |
| 32 | + // +kubebuilder:validation:MinLength=1 |
| 33 | + Type string `json:"type"` |
| 34 | + |
| 35 | + // Config contains the backend-specific authorization configuration. |
| 36 | + // The structure depends on the Type field: |
| 37 | + // - cedarv1: policies ([]string), entities_json (string), primary_upstream_provider (string), group_claim_name (string) |
| 38 | + // - httpv1: http ({url, timeout, insecure_skip_verify}), context ({include_args, include_operation}), claim_mapping (string) |
| 39 | + // +kubebuilder:pruning:PreserveUnknownFields |
| 40 | + // +kubebuilder:validation:Type=object |
| 41 | + Config runtime.RawExtension `json:"config"` |
| 42 | +} |
| 43 | + |
| 44 | +// MCPAuthzConfigStatus defines the observed state of MCPAuthzConfig |
| 45 | +type MCPAuthzConfigStatus struct { |
| 46 | + // Conditions represent the latest available observations of the MCPAuthzConfig's state |
| 47 | + // +listType=map |
| 48 | + // +listMapKey=type |
| 49 | + // +optional |
| 50 | + Conditions []metav1.Condition `json:"conditions,omitempty"` |
| 51 | + |
| 52 | + // ObservedGeneration is the most recent generation observed for this MCPAuthzConfig. |
| 53 | + // +optional |
| 54 | + ObservedGeneration int64 `json:"observedGeneration,omitempty"` |
| 55 | + |
| 56 | + // ConfigHash is a hash of the current configuration for change detection |
| 57 | + // +optional |
| 58 | + ConfigHash string `json:"configHash,omitempty"` |
| 59 | + |
| 60 | + // ReferenceCount is the number of workloads referencing this config. |
| 61 | + // +optional |
| 62 | + ReferenceCount int32 `json:"referenceCount,omitempty"` |
| 63 | + |
| 64 | + // ReferencingWorkloads is a list of workload resources that reference this MCPAuthzConfig. |
| 65 | + // Each entry identifies the workload by kind and name. |
| 66 | + // +listType=map |
| 67 | + // +listMapKey=name |
| 68 | + // +optional |
| 69 | + ReferencingWorkloads []WorkloadReference `json:"referencingWorkloads,omitempty"` |
| 70 | +} |
| 71 | + |
| 72 | +// +kubebuilder:object:root=true |
| 73 | +// +kubebuilder:storageversion |
| 74 | +// +kubebuilder:subresource:status |
| 75 | +// +kubebuilder:metadata:labels=toolhive.stacklok.dev/auto-migrate-storage-version=true |
| 76 | +// +kubebuilder:resource:shortName=authzcfg,categories=toolhive |
| 77 | +// +kubebuilder:printcolumn:name="Type",type=string,JSONPath=`.spec.type` |
| 78 | +// +kubebuilder:printcolumn:name="Valid",type=string,JSONPath=`.status.conditions[?(@.type=='Valid')].status` |
| 79 | +// +kubebuilder:printcolumn:name="References",type=integer,JSONPath=`.status.referenceCount` |
| 80 | +// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` |
| 81 | + |
| 82 | +// MCPAuthzConfig is the Schema for the mcpauthzconfigs API. |
| 83 | +// MCPAuthzConfig resources are namespace-scoped and can only be referenced by |
| 84 | +// MCPServer, MCPRemoteProxy, or VirtualMCPServer resources within the same namespace. |
| 85 | +// Cross-namespace references are not supported for security and isolation reasons. |
| 86 | +type MCPAuthzConfig struct { |
| 87 | + metav1.TypeMeta `json:",inline"` // nolint:revive |
| 88 | + metav1.ObjectMeta `json:"metadata,omitempty"` |
| 89 | + |
| 90 | + Spec MCPAuthzConfigSpec `json:"spec,omitempty"` |
| 91 | + Status MCPAuthzConfigStatus `json:"status,omitempty"` |
| 92 | +} |
| 93 | + |
| 94 | +// +kubebuilder:object:root=true |
| 95 | + |
| 96 | +// MCPAuthzConfigList contains a list of MCPAuthzConfig |
| 97 | +type MCPAuthzConfigList struct { |
| 98 | + metav1.TypeMeta `json:",inline"` // nolint:revive |
| 99 | + metav1.ListMeta `json:"metadata,omitempty"` |
| 100 | + Items []MCPAuthzConfig `json:"items"` |
| 101 | +} |
| 102 | + |
| 103 | +// MCPAuthzConfigReference references a shared MCPAuthzConfig resource. |
| 104 | +// The referenced MCPAuthzConfig must be in the same namespace as the referencing workload. |
| 105 | +type MCPAuthzConfigReference struct { |
| 106 | + // Name is the name of the MCPAuthzConfig resource in the same namespace. |
| 107 | + // +kubebuilder:validation:Required |
| 108 | + // +kubebuilder:validation:MinLength=1 |
| 109 | + Name string `json:"name"` |
| 110 | +} |
| 111 | + |
| 112 | +// Validate performs structural validation on the MCPAuthzConfig spec. |
| 113 | +// This method is called by the controller during reconciliation. |
| 114 | +// |
| 115 | +// Note: This provides defense-in-depth alongside CEL validation rules. CEL catches |
| 116 | +// issues at API admission time, but this method also validates stored objects to |
| 117 | +// catch any that bypassed CEL or were stored before CEL rules were added. |
| 118 | +// |
| 119 | +// Backend-specific validation (delegating to the authorizer factory registry) lives |
| 120 | +// in the controller rather than here, because the API types package must not import |
| 121 | +// the authorizer backends. |
| 122 | +func (r *MCPAuthzConfig) Validate() error { |
| 123 | + if r.Spec.Type == "" { |
| 124 | + return fmt.Errorf("type must not be empty") |
| 125 | + } |
| 126 | + if len(r.Spec.Config.Raw) == 0 { |
| 127 | + return fmt.Errorf("config must not be empty") |
| 128 | + } |
| 129 | + return nil |
| 130 | +} |
| 131 | + |
| 132 | +func init() { |
| 133 | + SchemeBuilder.Register(&MCPAuthzConfig{}, &MCPAuthzConfigList{}) |
| 134 | +} |
0 commit comments