Mark AuthzConfigRef staging NOTE with TODO(#4778)

The staging note on AuthzConfigRef becomes inaccurate the moment the
workload-controller wiring lands. A grep-able TODO(#4778) marker
in the Go source ensures whoever lands #4778 finds the stale text
without manually scanning three type files. controller-gen strips
TODO lines from the rendered CRD description, so the user-facing
schema stays clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: ChrisJBurns

cmd/thv-operator/api/v1beta1/mcpremoteproxy_types.go

@@ -96,6 +96,9 @@ type MCPRemoteProxySpec struct {
 	// The referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy.
 	// Mutually exclusive with authzConfig.
 	//
+	// TODO(#4778): remove the staging NOTE below once workload controllers
+	// resolve AuthzConfigRef into a runtime authz config.
+	//
 	// NOTE: this field is consumed by workload controllers in a follow-up PR.
 	// Until that lands, AuthzConfigRef is reference-tracked by the
 	// MCPAuthzConfig controller (deletion protection, status.referenceCount)

cmd/thv-operator/api/v1beta1/mcpserver_types.go

@@ -308,6 +308,9 @@ type MCPServerSpec struct {
 	// The referenced MCPAuthzConfig must exist in the same namespace as this MCPServer.
 	// Mutually exclusive with authzConfig.
 	//
+	// TODO(#4778): remove the staging NOTE below once workload controllers
+	// resolve AuthzConfigRef into a runtime authz config.
+	//
 	// NOTE: this field is consumed by workload controllers in a follow-up PR.
 	// Until that lands, AuthzConfigRef is reference-tracked by the
 	// MCPAuthzConfig controller (deletion protection, status.referenceCount)

cmd/thv-operator/api/v1beta1/virtualmcpserver_types.go

@@ -187,6 +187,9 @@ type IncomingAuthConfig struct {
 	// The referenced MCPAuthzConfig must exist in the same namespace as this VirtualMCPServer.
 	// Mutually exclusive with authzConfig.
 	//
+	// TODO(#4778): remove the staging NOTE below once workload controllers
+	// resolve AuthzConfigRef into a runtime authz config.
+	//
 	// NOTE: this field is consumed by workload controllers in a follow-up PR.
 	// Until that lands, AuthzConfigRef is reference-tracked by the
 	// MCPAuthzConfig controller (deletion protection, status.referenceCount)

deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_mcpremoteproxies.yaml

@@ -213,6 +213,8 @@ spec:
                   The referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy.
                   Mutually exclusive with authzConfig.
 
+                  resolve AuthzConfigRef into a runtime authz config.
+
                   NOTE: this field is consumed by workload controllers in a follow-up PR.
                   Until that lands, AuthzConfigRef is reference-tracked by the
                   MCPAuthzConfig controller (deletion protection, status.referenceCount)
@@ -863,6 +865,8 @@ spec:
                   The referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy.
                   Mutually exclusive with authzConfig.
 
+                  resolve AuthzConfigRef into a runtime authz config.
+
                   NOTE: this field is consumed by workload controllers in a follow-up PR.
                   Until that lands, AuthzConfigRef is reference-tracked by the
                   MCPAuthzConfig controller (deletion protection, status.referenceCount)

deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_mcpservers.yaml

@@ -220,6 +220,8 @@ spec:
                   The referenced MCPAuthzConfig must exist in the same namespace as this MCPServer.
                   Mutually exclusive with authzConfig.
 
+                  resolve AuthzConfigRef into a runtime authz config.
+
                   NOTE: this field is consumed by workload controllers in a follow-up PR.
                   Until that lands, AuthzConfigRef is reference-tracked by the
                   MCPAuthzConfig controller (deletion protection, status.referenceCount)
@@ -1166,6 +1168,8 @@ spec:
                   The referenced MCPAuthzConfig must exist in the same namespace as this MCPServer.
                   Mutually exclusive with authzConfig.
 
+                  resolve AuthzConfigRef into a runtime authz config.
+
                   NOTE: this field is consumed by workload controllers in a follow-up PR.
                   Until that lands, AuthzConfigRef is reference-tracked by the
                   MCPAuthzConfig controller (deletion protection, status.referenceCount)

deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_virtualmcpservers.yaml

@@ -2565,6 +2565,8 @@ spec:
                       The referenced MCPAuthzConfig must exist in the same namespace as this VirtualMCPServer.
                       Mutually exclusive with authzConfig.
 
+                      resolve AuthzConfigRef into a runtime authz config.
+
                       NOTE: this field is consumed by workload controllers in a follow-up PR.
                       Until that lands, AuthzConfigRef is reference-tracked by the
                       MCPAuthzConfig controller (deletion protection, status.referenceCount)
@@ -5543,6 +5545,8 @@ spec:
                       The referenced MCPAuthzConfig must exist in the same namespace as this VirtualMCPServer.
                       Mutually exclusive with authzConfig.
 
+                      resolve AuthzConfigRef into a runtime authz config.
+
                       NOTE: this field is consumed by workload controllers in a follow-up PR.
                       Until that lands, AuthzConfigRef is reference-tracked by the
                       MCPAuthzConfig controller (deletion protection, status.referenceCount)

deploy/charts/operator-crds/templates/toolhive.stacklok.dev_mcpremoteproxies.yaml

@@ -216,6 +216,8 @@ spec:
                   The referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy.
                   Mutually exclusive with authzConfig.
 
+                  resolve AuthzConfigRef into a runtime authz config.
+
                   NOTE: this field is consumed by workload controllers in a follow-up PR.
                   Until that lands, AuthzConfigRef is reference-tracked by the
                   MCPAuthzConfig controller (deletion protection, status.referenceCount)
@@ -866,6 +868,8 @@ spec:
                   The referenced MCPAuthzConfig must exist in the same namespace as this MCPRemoteProxy.
                   Mutually exclusive with authzConfig.
 
+                  resolve AuthzConfigRef into a runtime authz config.
+
                   NOTE: this field is consumed by workload controllers in a follow-up PR.
                   Until that lands, AuthzConfigRef is reference-tracked by the
                   MCPAuthzConfig controller (deletion protection, status.referenceCount)

deploy/charts/operator-crds/templates/toolhive.stacklok.dev_mcpservers.yaml

@@ -223,6 +223,8 @@ spec:
                   The referenced MCPAuthzConfig must exist in the same namespace as this MCPServer.
                   Mutually exclusive with authzConfig.
 
+                  resolve AuthzConfigRef into a runtime authz config.
+
                   NOTE: this field is consumed by workload controllers in a follow-up PR.
                   Until that lands, AuthzConfigRef is reference-tracked by the
                   MCPAuthzConfig controller (deletion protection, status.referenceCount)
@@ -1169,6 +1171,8 @@ spec:
                   The referenced MCPAuthzConfig must exist in the same namespace as this MCPServer.
                   Mutually exclusive with authzConfig.
 
+                  resolve AuthzConfigRef into a runtime authz config.
+
                   NOTE: this field is consumed by workload controllers in a follow-up PR.
                   Until that lands, AuthzConfigRef is reference-tracked by the
                   MCPAuthzConfig controller (deletion protection, status.referenceCount)

deploy/charts/operator-crds/templates/toolhive.stacklok.dev_virtualmcpservers.yaml

@@ -2568,6 +2568,8 @@ spec:
                       The referenced MCPAuthzConfig must exist in the same namespace as this VirtualMCPServer.
                       Mutually exclusive with authzConfig.
 
+                      resolve AuthzConfigRef into a runtime authz config.
+
                       NOTE: this field is consumed by workload controllers in a follow-up PR.
                       Until that lands, AuthzConfigRef is reference-tracked by the
                       MCPAuthzConfig controller (deletion protection, status.referenceCount)
@@ -5546,6 +5548,8 @@ spec:
                       The referenced MCPAuthzConfig must exist in the same namespace as this VirtualMCPServer.
                       Mutually exclusive with authzConfig.
 
+                      resolve AuthzConfigRef into a runtime authz config.
+
                       NOTE: this field is consumed by workload controllers in a follow-up PR.
                       Until that lands, AuthzConfigRef is reference-tracked by the
                       MCPAuthzConfig controller (deletion protection, status.referenceCount)