Reframe AuthzConfigRef as part 1 of 2 in godocs

The new AuthzConfigRef field on MCPServer, MCPRemoteProxy, and
VirtualMCPServer.IncomingAuth is wired into the MCPAuthzConfig
controller's reference tracking (status.referenceCount, deletion
protection) but no workload controller actually resolves the ref into a
runtime authz config in this PR. That wiring lands in a follow-up.

The previous godocs marked the inline AuthzConfig field "Deprecated:
Use AuthzConfigRef" — which pointed users at a non-functional field
and risked workloads running with no authorization enforced. Drop the
premature Deprecated annotation and add an explicit NOTE on
AuthzConfigRef so adopters know to stick with the inline form until
the consumer-side wiring lands.

The CEL mutex rule and the controller's reference tracking are
unchanged; only the descriptive godocs move.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: ChrisJBurns

cmd/thv-operator/api/v1beta1/mcpremoteproxy_types.go

@@ -82,14 +82,19 @@ type MCPRemoteProxySpec struct {
 	HeaderForward *HeaderForwardConfig `json:"headerForward,omitempty"`
 
 	// AuthzConfig defines authorization policy configuration for the proxy.
-	// Deprecated: Use AuthzConfigRef to reference a shared MCPAuthzConfig resource instead.
 	// AuthzConfig and AuthzConfigRef are mutually exclusive.
 	// +optional
 	AuthzConfig *AuthzConfigRef `json:"authzConfig,omitempty"`
 
 	// AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.
 	// The referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy.
 	// Mutually exclusive with authzConfig.
+	//
+	// NOTE: this field is consumed by workload controllers in a follow-up PR.
+	// Until that lands, AuthzConfigRef is reference-tracked by the
+	// MCPAuthzConfig controller (deletion protection, status.referenceCount)
+	// but does NOT apply authorization to this MCPRemoteProxy. Use the
+	// inline AuthzConfig field in the meantime.
 	// +optional
 	AuthzConfigRef *MCPAuthzConfigReference `json:"authzConfigRef,omitempty"`
 

cmd/thv-operator/api/v1beta1/mcpserver_types.go

@@ -295,14 +295,19 @@ type MCPServerSpec struct {
 	OIDCConfigRef *MCPOIDCConfigReference `json:"oidcConfigRef,omitempty"`
 
 	// AuthzConfig defines authorization policy configuration for the MCP server.
-	// Deprecated: Use AuthzConfigRef to reference a shared MCPAuthzConfig resource instead.
 	// AuthzConfig and AuthzConfigRef are mutually exclusive.
 	// +optional
 	AuthzConfig *AuthzConfigRef `json:"authzConfig,omitempty"`
 
 	// AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.
 	// The referenced MCPAuthzConfig must exist in the same namespace as this MCPServer.
 	// Mutually exclusive with authzConfig.
+	//
+	// NOTE: this field is consumed by workload controllers in a follow-up PR.
+	// Until that lands, AuthzConfigRef is reference-tracked by the
+	// MCPAuthzConfig controller (deletion protection, status.referenceCount)
+	// but does NOT apply authorization to this MCPServer. Use the inline
+	// AuthzConfig field in the meantime.
 	// +optional
 	AuthzConfigRef *MCPAuthzConfigReference `json:"authzConfigRef,omitempty"`
 

cmd/thv-operator/api/v1beta1/virtualmcpserver_types.go

@@ -179,14 +179,19 @@ type IncomingAuthConfig struct {
 
 	// AuthzConfig defines authorization policy configuration.
 	// Reuses MCPServer authz patterns.
-	// Deprecated: Use AuthzConfigRef to reference a shared MCPAuthzConfig resource instead.
 	// AuthzConfig and AuthzConfigRef are mutually exclusive.
 	// +optional
 	AuthzConfig *AuthzConfigRef `json:"authzConfig,omitempty"`
 
 	// AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.
 	// The referenced MCPAuthzConfig must exist in the same namespace as this VirtualMCPServer.
 	// Mutually exclusive with authzConfig.
+	//
+	// NOTE: this field is consumed by workload controllers in a follow-up PR.
+	// Until that lands, AuthzConfigRef is reference-tracked by the
+	// MCPAuthzConfig controller (deletion protection, status.referenceCount)
+	// but does NOT apply authorization to this VirtualMCPServer. Use the
+	// inline AuthzConfig field in the meantime.
 	// +optional
 	AuthzConfigRef *MCPAuthzConfigReference `json:"authzConfigRef,omitempty"`
 }