Skip to content

Commit 8e08e43

Browse files
ChrisJBurnsclaude
ChrisJBurns
and
claude
committed
Drop stale AuthzConfigRef staging note from CRD docs
The AuthzConfigRef field docs on MCPServer and MCPRemoteProxy still carried the TODO(#4778) + NOTE saying the ref is reference-tracked but does NOT apply authorization. Both controllers now resolve the ref into runtime authz, so the note states the opposite of the behavior and would mislead anyone reading the generated CRD reference. Remove it and regenerate manifests + API docs. Addresses review feedback on #5563. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent 3d34a58 commit 8e08e43

7 files changed

Lines changed: 2 additions & 84 deletions

File tree

‎cmd/thv-operator/api/v1beta1/mcpremoteproxy_types.go‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -95,15 +95,6 @@ type MCPRemoteProxySpec struct {
9595
// AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.
9696
// The referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy.
9797
// Mutually exclusive with authzConfig.
98-
//
99-
// TODO(#4778): remove the staging NOTE below once workload controllers
100-
// resolve AuthzConfigRef into a runtime authz config.
101-
//
102-
// NOTE: this field is consumed by workload controllers in a follow-up PR.
103-
// Until that lands, AuthzConfigRef is reference-tracked by the
104-
// MCPAuthzConfig controller (deletion protection, status.referenceCount)
105-
// but does NOT apply authorization to this MCPRemoteProxy. Use the
106-
// inline AuthzConfig field in the meantime.
10798
// +optional
10899
AuthzConfigRef *MCPAuthzConfigReference `json:"authzConfigRef,omitempty"`
109100

‎cmd/thv-operator/api/v1beta1/mcpserver_types.go‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -324,15 +324,6 @@ type MCPServerSpec struct {
324324
// AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.
325325
// The referenced MCPAuthzConfig must exist in the same namespace as this MCPServer.
326326
// Mutually exclusive with authzConfig.
327-
//
328-
// TODO(#4778): remove the staging NOTE below once workload controllers
329-
// resolve AuthzConfigRef into a runtime authz config.
330-
//
331-
// NOTE: this field is consumed by workload controllers in a follow-up PR.
332-
// Until that lands, AuthzConfigRef is reference-tracked by the
333-
// MCPAuthzConfig controller (deletion protection, status.referenceCount)
334-
// but does NOT apply authorization to this MCPServer. Use the inline
335-
// AuthzConfig field in the meantime.
336327
// +optional
337328
AuthzConfigRef *MCPAuthzConfigReference `json:"authzConfigRef,omitempty"`
338329

‎deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_mcpremoteproxies.yaml‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -212,14 +212,6 @@ spec:
212212
AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.
213213
The referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy.
214214
Mutually exclusive with authzConfig.
215-
216-
resolve AuthzConfigRef into a runtime authz config.
217-
218-
NOTE: this field is consumed by workload controllers in a follow-up PR.
219-
Until that lands, AuthzConfigRef is reference-tracked by the
220-
MCPAuthzConfig controller (deletion protection, status.referenceCount)
221-
but does NOT apply authorization to this MCPRemoteProxy. Use the
222-
inline AuthzConfig field in the meantime.
223215
properties:
224216
name:
225217
description: Name is the name of the MCPAuthzConfig resource in
@@ -949,14 +941,6 @@ spec:
949941
AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.
950942
The referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy.
951943
Mutually exclusive with authzConfig.
952-
953-
resolve AuthzConfigRef into a runtime authz config.
954-
955-
NOTE: this field is consumed by workload controllers in a follow-up PR.
956-
Until that lands, AuthzConfigRef is reference-tracked by the
957-
MCPAuthzConfig controller (deletion protection, status.referenceCount)
958-
but does NOT apply authorization to this MCPRemoteProxy. Use the
959-
inline AuthzConfig field in the meantime.
960944
properties:
961945
name:
962946
description: Name is the name of the MCPAuthzConfig resource in

‎deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_mcpservers.yaml‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -219,14 +219,6 @@ spec:
219219
AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.
220220
The referenced MCPAuthzConfig must exist in the same namespace as this MCPServer.
221221
Mutually exclusive with authzConfig.
222-
223-
resolve AuthzConfigRef into a runtime authz config.
224-
225-
NOTE: this field is consumed by workload controllers in a follow-up PR.
226-
Until that lands, AuthzConfigRef is reference-tracked by the
227-
MCPAuthzConfig controller (deletion protection, status.referenceCount)
228-
but does NOT apply authorization to this MCPServer. Use the inline
229-
AuthzConfig field in the meantime.
230222
properties:
231223
name:
232224
description: Name is the name of the MCPAuthzConfig resource in
@@ -1171,14 +1163,6 @@ spec:
11711163
AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.
11721164
The referenced MCPAuthzConfig must exist in the same namespace as this MCPServer.
11731165
Mutually exclusive with authzConfig.
1174-
1175-
resolve AuthzConfigRef into a runtime authz config.
1176-
1177-
NOTE: this field is consumed by workload controllers in a follow-up PR.
1178-
Until that lands, AuthzConfigRef is reference-tracked by the
1179-
MCPAuthzConfig controller (deletion protection, status.referenceCount)
1180-
but does NOT apply authorization to this MCPServer. Use the inline
1181-
AuthzConfig field in the meantime.
11821166
properties:
11831167
name:
11841168
description: Name is the name of the MCPAuthzConfig resource in

‎deploy/charts/operator-crds/templates/toolhive.stacklok.dev_mcpremoteproxies.yaml‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -215,14 +215,6 @@ spec:
215215
AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.
216216
The referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy.
217217
Mutually exclusive with authzConfig.
218-
219-
resolve AuthzConfigRef into a runtime authz config.
220-
221-
NOTE: this field is consumed by workload controllers in a follow-up PR.
222-
Until that lands, AuthzConfigRef is reference-tracked by the
223-
MCPAuthzConfig controller (deletion protection, status.referenceCount)
224-
but does NOT apply authorization to this MCPRemoteProxy. Use the
225-
inline AuthzConfig field in the meantime.
226218
properties:
227219
name:
228220
description: Name is the name of the MCPAuthzConfig resource in
@@ -952,14 +944,6 @@ spec:
952944
AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.
953945
The referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy.
954946
Mutually exclusive with authzConfig.
955-
956-
resolve AuthzConfigRef into a runtime authz config.
957-
958-
NOTE: this field is consumed by workload controllers in a follow-up PR.
959-
Until that lands, AuthzConfigRef is reference-tracked by the
960-
MCPAuthzConfig controller (deletion protection, status.referenceCount)
961-
but does NOT apply authorization to this MCPRemoteProxy. Use the
962-
inline AuthzConfig field in the meantime.
963947
properties:
964948
name:
965949
description: Name is the name of the MCPAuthzConfig resource in

‎deploy/charts/operator-crds/templates/toolhive.stacklok.dev_mcpservers.yaml‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -222,14 +222,6 @@ spec:
222222
AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.
223223
The referenced MCPAuthzConfig must exist in the same namespace as this MCPServer.
224224
Mutually exclusive with authzConfig.
225-
226-
resolve AuthzConfigRef into a runtime authz config.
227-
228-
NOTE: this field is consumed by workload controllers in a follow-up PR.
229-
Until that lands, AuthzConfigRef is reference-tracked by the
230-
MCPAuthzConfig controller (deletion protection, status.referenceCount)
231-
but does NOT apply authorization to this MCPServer. Use the inline
232-
AuthzConfig field in the meantime.
233225
properties:
234226
name:
235227
description: Name is the name of the MCPAuthzConfig resource in
@@ -1174,14 +1166,6 @@ spec:
11741166
AuthzConfigRef references a shared MCPAuthzConfig resource for authorization.
11751167
The referenced MCPAuthzConfig must exist in the same namespace as this MCPServer.
11761168
Mutually exclusive with authzConfig.
1177-
1178-
resolve AuthzConfigRef into a runtime authz config.
1179-
1180-
NOTE: this field is consumed by workload controllers in a follow-up PR.
1181-
Until that lands, AuthzConfigRef is reference-tracked by the
1182-
MCPAuthzConfig controller (deletion protection, status.referenceCount)
1183-
but does NOT apply authorization to this MCPServer. Use the inline
1184-
AuthzConfig field in the meantime.
11851169
properties:
11861170
name:
11871171
description: Name is the name of the MCPAuthzConfig resource in

‎docs/operator/crd-api.md‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)