Skip to content

Commit 91ce68d

Browse files
ChrisJBurnsclaude
ChrisJBurns
and
claude
committed
Address review feedback on MCPOIDCConfig MCPRemoteProxy wiring
- Add CEL XValidation rule enforcing mutual exclusivity between oidcConfig and oidcConfigRef - Make oidcConfig optional (pointer type) with deprecation notice, matching the MCPServer pattern from PR #4481 - Reuse shared OIDC condition constants from MCPServer types instead of introducing duplicate per-type constants - Use ConditionReasonOIDCConfigRefNotValid (matching MCPServer/vMCP) instead of the divergent OIDCConfigRefNotReady - Add nil guards in validation methods for the now-optional oidcConfig - Fix all downstream value→pointer type changes in tests and helpers - Regenerate CRDs, Helm templates, DeepCopy, and API docs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent d7cced0 commit 91ce68d

13 files changed

Lines changed: 113 additions & 90 deletions

‎cmd/thv-operator/api/v1alpha1/mcpremoteproxy_types.go‎

Lines changed: 10 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,10 @@ type HeaderFromSecret struct {
3434
}
3535

3636
// MCPRemoteProxySpec defines the desired state of MCPRemoteProxy
37+
//
38+
// +kubebuilder:validation:XValidation:rule="!(has(self.oidcConfig) && has(self.oidcConfigRef))",message="oidcConfig and oidcConfigRef are mutually exclusive; use oidcConfigRef to reference a shared MCPOIDCConfig"
39+
//
40+
//nolint:lll // CEL validation rules exceed line length limit
3741
type MCPRemoteProxySpec struct {
3842
// RemoteURL is the URL of the remote MCP server to proxy
3943
// +kubebuilder:validation:Required
@@ -51,10 +55,11 @@ type MCPRemoteProxySpec struct {
5155
// +kubebuilder:default=streamable-http
5256
Transport string `json:"transport,omitempty"`
5357

54-
// OIDCConfig defines OIDC authentication configuration for the proxy
55-
// This validates incoming tokens from clients. Required for proxy mode.
56-
// +kubebuilder:validation:Required
57-
OIDCConfig OIDCConfigRef `json:"oidcConfig"`
58+
// OIDCConfig defines OIDC authentication configuration for the proxy.
59+
// Deprecated: Use OIDCConfigRef to reference a shared MCPOIDCConfig resource instead.
60+
// This field will be removed in v1beta1. OIDCConfig and OIDCConfigRef are mutually exclusive.
61+
// +optional
62+
OIDCConfig *OIDCConfigRef `json:"oidcConfig,omitempty"`
5863

5964
// OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.
6065
// The referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.
@@ -210,9 +215,6 @@ const (
210215
// ConditionTypeMCPRemoteProxyExternalAuthConfigValidated indicates whether the ExternalAuthConfigRef is valid
211216
ConditionTypeMCPRemoteProxyExternalAuthConfigValidated = "ExternalAuthConfigValidated"
212217

213-
// ConditionTypeMCPRemoteProxyOIDCConfigRefValidated indicates whether the OIDCConfigRef is valid
214-
ConditionTypeMCPRemoteProxyOIDCConfigRefValidated = "OIDCConfigRefValidated"
215-
216218
// ConditionTypeConfigurationValid indicates whether the proxy spec has passed all pre-deployment validation checks
217219
ConditionTypeConfigurationValid = "ConfigurationValid"
218220
)
@@ -271,15 +273,6 @@ const (
271273
// for MCPRemoteProxy (use VirtualMCPServer for multi-upstream).
272274
ConditionReasonMCPRemoteProxyExternalAuthConfigMultiUpstream = "MultiUpstreamNotSupported"
273275

274-
// ConditionReasonMCPRemoteProxyOIDCConfigRefValid indicates the referenced MCPOIDCConfig is valid and ready
275-
ConditionReasonMCPRemoteProxyOIDCConfigRefValid = "OIDCConfigRefValid"
276-
277-
// ConditionReasonMCPRemoteProxyOIDCConfigRefNotFound indicates the referenced MCPOIDCConfig was not found
278-
ConditionReasonMCPRemoteProxyOIDCConfigRefNotFound = "OIDCConfigRefNotFound"
279-
280-
// ConditionReasonMCPRemoteProxyOIDCConfigRefNotReady indicates the referenced MCPOIDCConfig is not ready
281-
ConditionReasonMCPRemoteProxyOIDCConfigRefNotReady = "OIDCConfigRefNotReady"
282-
283276
// ConditionReasonConfigurationValid indicates all configuration validations passed
284277
ConditionReasonConfigurationValid = "ConfigurationValid"
285278

@@ -348,7 +341,7 @@ func (m *MCPRemoteProxy) GetNamespace() string {
348341

349342
// GetOIDCConfig returns the OIDC configuration reference
350343
func (m *MCPRemoteProxy) GetOIDCConfig() *OIDCConfigRef {
351-
return &m.Spec.OIDCConfig
344+
return m.Spec.OIDCConfig
352345
}
353346

354347
// GetProxyPort returns the proxy port of the MCPRemoteProxy

‎cmd/thv-operator/api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cmd/thv-operator/controllers/mcpremoteproxy_controller.go‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -435,6 +435,9 @@ func setConfigurationInvalidCondition(proxy *mcpv1alpha1.MCPRemoteProxy, reason,
435435
// validateOIDCIssuerURL validates the OIDC issuer URL scheme.
436436
func (*MCPRemoteProxyReconciler) validateOIDCIssuerURL(proxy *mcpv1alpha1.MCPRemoteProxy) error {
437437
oidcConfig := proxy.Spec.OIDCConfig
438+
if oidcConfig == nil {
439+
return nil
440+
}
438441

439442
switch oidcConfig.Type {
440443
case mcpv1alpha1.OIDCConfigTypeInline:
@@ -453,6 +456,9 @@ func (*MCPRemoteProxyReconciler) validateOIDCIssuerURL(proxy *mcpv1alpha1.MCPRem
453456
// validateJWKSURL validates the JWKS URL scheme in the OIDC config.
454457
func (*MCPRemoteProxyReconciler) validateJWKSURL(proxy *mcpv1alpha1.MCPRemoteProxy) error {
455458
oidcConfig := proxy.Spec.OIDCConfig
459+
if oidcConfig == nil {
460+
return nil
461+
}
456462

457463
switch oidcConfig.Type {
458464
case mcpv1alpha1.OIDCConfigTypeInline:
@@ -727,9 +733,9 @@ func (r *MCPRemoteProxyReconciler) handleOIDCConfig(ctx context.Context, proxy *
727733
oidcConfig, err := ctrlutil.GetOIDCConfigForServer(ctx, r.Client, proxy.Namespace, proxy.Spec.OIDCConfigRef)
728734
if err != nil {
729735
meta.SetStatusCondition(&proxy.Status.Conditions, metav1.Condition{
730-
Type: mcpv1alpha1.ConditionTypeMCPRemoteProxyOIDCConfigRefValidated,
736+
Type: mcpv1alpha1.ConditionOIDCConfigRefValidated,
731737
Status: metav1.ConditionFalse,
732-
Reason: mcpv1alpha1.ConditionReasonMCPRemoteProxyOIDCConfigRefNotFound,
738+
Reason: mcpv1alpha1.ConditionReasonOIDCConfigRefNotFound,
733739
Message: fmt.Sprintf("MCPOIDCConfig %s not found: %v", proxy.Spec.OIDCConfigRef.Name, err),
734740
ObservedGeneration: proxy.Generation,
735741
})
@@ -741,9 +747,9 @@ func (r *MCPRemoteProxyReconciler) handleOIDCConfig(ctx context.Context, proxy *
741747

742748
if oidcConfig == nil {
743749
meta.SetStatusCondition(&proxy.Status.Conditions, metav1.Condition{
744-
Type: mcpv1alpha1.ConditionTypeMCPRemoteProxyOIDCConfigRefValidated,
750+
Type: mcpv1alpha1.ConditionOIDCConfigRefValidated,
745751
Status: metav1.ConditionFalse,
746-
Reason: mcpv1alpha1.ConditionReasonMCPRemoteProxyOIDCConfigRefNotFound,
752+
Reason: mcpv1alpha1.ConditionReasonOIDCConfigRefNotFound,
747753
Message: fmt.Sprintf("MCPOIDCConfig %s not found", proxy.Spec.OIDCConfigRef.Name),
748754
ObservedGeneration: proxy.Generation,
749755
})
@@ -761,9 +767,9 @@ func (r *MCPRemoteProxyReconciler) handleOIDCConfig(ctx context.Context, proxy *
761767
msg = fmt.Sprintf("MCPOIDCConfig %s is not ready: %s", proxy.Spec.OIDCConfigRef.Name, readyCondition.Message)
762768
}
763769
meta.SetStatusCondition(&proxy.Status.Conditions, metav1.Condition{
764-
Type: mcpv1alpha1.ConditionTypeMCPRemoteProxyOIDCConfigRefValidated,
770+
Type: mcpv1alpha1.ConditionOIDCConfigRefValidated,
765771
Status: metav1.ConditionFalse,
766-
Reason: mcpv1alpha1.ConditionReasonMCPRemoteProxyOIDCConfigRefNotReady,
772+
Reason: mcpv1alpha1.ConditionReasonOIDCConfigRefNotValid,
767773
Message: msg,
768774
ObservedGeneration: proxy.Generation,
769775
})
@@ -781,9 +787,9 @@ func (r *MCPRemoteProxyReconciler) handleOIDCConfig(ctx context.Context, proxy *
781787

782788
// Set valid condition
783789
meta.SetStatusCondition(&proxy.Status.Conditions, metav1.Condition{
784-
Type: mcpv1alpha1.ConditionTypeMCPRemoteProxyOIDCConfigRefValidated,
790+
Type: mcpv1alpha1.ConditionOIDCConfigRefValidated,
785791
Status: metav1.ConditionTrue,
786-
Reason: mcpv1alpha1.ConditionReasonMCPRemoteProxyOIDCConfigRefValid,
792+
Reason: mcpv1alpha1.ConditionReasonOIDCConfigRefValid,
787793
Message: fmt.Sprintf("MCPOIDCConfig %s is valid and ready", proxy.Spec.OIDCConfigRef.Name),
788794
ObservedGeneration: proxy.Generation,
789795
})

‎cmd/thv-operator/controllers/mcpremoteproxy_controller_test.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ func TestMCPRemoteProxyValidateSpec(t *testing.T) {
5757
Spec: mcpv1alpha1.MCPRemoteProxySpec{
5858
RemoteURL: "https://mcp.salesforce.com",
5959
ProxyPort: 8080,
60-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
60+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
6161
Type: mcpv1alpha1.OIDCConfigTypeInline,
6262
Inline: &mcpv1alpha1.InlineOIDCConfig{
6363
Issuer: "https://login.salesforce.com",
@@ -77,7 +77,7 @@ func TestMCPRemoteProxyValidateSpec(t *testing.T) {
7777
},
7878
Spec: mcpv1alpha1.MCPRemoteProxySpec{
7979
ProxyPort: 8080,
80-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
80+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
8181
Type: mcpv1alpha1.OIDCConfigTypeInline,
8282
Inline: &mcpv1alpha1.InlineOIDCConfig{
8383
Issuer: "https://auth.example.com",
@@ -101,7 +101,7 @@ func TestMCPRemoteProxyValidateSpec(t *testing.T) {
101101
Spec: mcpv1alpha1.MCPRemoteProxySpec{
102102
RemoteURL: "https://mcp.example.com",
103103
ProxyPort: 8080,
104-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
104+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
105105
Type: mcpv1alpha1.OIDCConfigTypeInline,
106106
Inline: &mcpv1alpha1.InlineOIDCConfig{
107107
Issuer: "https://auth.company.com",
@@ -159,7 +159,7 @@ func TestMCPRemoteProxyReconcile_CreateResources(t *testing.T) {
159159
Spec: mcpv1alpha1.MCPRemoteProxySpec{
160160
RemoteURL: "https://mcp.salesforce.com",
161161
ProxyPort: 8080,
162-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
162+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
163163
Type: mcpv1alpha1.OIDCConfigTypeInline,
164164
Inline: &mcpv1alpha1.InlineOIDCConfig{
165165
Issuer: "https://login.salesforce.com",

‎cmd/thv-operator/controllers/mcpremoteproxy_deployment.go‎

Lines changed: 23 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -189,17 +189,7 @@ func (r *MCPRemoteProxyReconciler) buildEnvVarsForProxy(
189189
}
190190

191191
// Add OIDC client secret environment variable if using inline config with secretRef
192-
if proxy.Spec.OIDCConfig.Type == "inline" && proxy.Spec.OIDCConfig.Inline != nil {
193-
oidcClientSecretEnvVar, err := ctrlutil.GenerateOIDCClientSecretEnvVar(
194-
ctx, r.Client, proxy.Namespace, proxy.Spec.OIDCConfig.Inline.ClientSecretRef,
195-
)
196-
if err != nil {
197-
ctxLogger := log.FromContext(ctx)
198-
ctxLogger.Error(err, "Failed to generate OIDC client secret environment variable")
199-
} else if oidcClientSecretEnvVar != nil {
200-
env = append(env, *oidcClientSecretEnvVar)
201-
}
202-
}
192+
env = append(env, r.buildOIDCClientSecretEnvVars(ctx, proxy)...)
203193

204194
// Add header forward secret environment variables
205195
if proxy.Spec.HeaderForward != nil && len(proxy.Spec.HeaderForward.AddHeadersFromSecret) > 0 {
@@ -228,6 +218,28 @@ func (r *MCPRemoteProxyReconciler) buildEnvVarsForProxy(
228218
return ctrlutil.EnsureRequiredEnvVars(ctx, env)
229219
}
230220

221+
// buildOIDCClientSecretEnvVars returns OIDC client secret env vars when inline OIDC config
222+
// with a client secret ref is used. Returns nil when OIDCConfig is nil or not inline.
223+
func (r *MCPRemoteProxyReconciler) buildOIDCClientSecretEnvVars(
224+
ctx context.Context, proxy *mcpv1alpha1.MCPRemoteProxy,
225+
) []corev1.EnvVar {
226+
if proxy.Spec.OIDCConfig == nil || proxy.Spec.OIDCConfig.Type != "inline" || proxy.Spec.OIDCConfig.Inline == nil {
227+
return nil
228+
}
229+
oidcClientSecretEnvVar, err := ctrlutil.GenerateOIDCClientSecretEnvVar(
230+
ctx, r.Client, proxy.Namespace, proxy.Spec.OIDCConfig.Inline.ClientSecretRef,
231+
)
232+
if err != nil {
233+
ctxLogger := log.FromContext(ctx)
234+
ctxLogger.Error(err, "Failed to generate OIDC client secret environment variable")
235+
return nil
236+
}
237+
if oidcClientSecretEnvVar == nil {
238+
return nil
239+
}
240+
return []corev1.EnvVar{*oidcClientSecretEnvVar}
241+
}
242+
231243
// buildHeaderForwardSecretEnvVars builds environment variables for header forward secrets.
232244
// Each secret is mounted as an env var using Kubernetes SecretKeyRef, with a name following
233245
// the TOOLHIVE_SECRET_<identifier> pattern expected by the secrets.EnvironmentProvider.

‎cmd/thv-operator/controllers/mcpremoteproxy_deployment_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -892,7 +892,7 @@ func TestBuildEnvVarsForProxy(t *testing.T) {
892892
},
893893
Spec: mcpv1alpha1.MCPRemoteProxySpec{
894894
RemoteURL: "https://mcp.example.com",
895-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
895+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
896896
Type: mcpv1alpha1.OIDCConfigTypeInline,
897897
Inline: &mcpv1alpha1.InlineOIDCConfig{
898898
Issuer: "https://auth.example.com",

‎cmd/thv-operator/controllers/mcpremoteproxy_reconciler_test.go‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ func TestMCPRemoteProxyFullReconciliation(t *testing.T) {
6161
RemoteURL: "https://mcp.salesforce.com",
6262
ProxyPort: 8080,
6363
Transport: "streamable-http",
64-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
64+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
6565
Type: mcpv1alpha1.OIDCConfigTypeInline,
6666
Inline: &mcpv1alpha1.InlineOIDCConfig{
6767
Issuer: "https://login.salesforce.com",
@@ -134,7 +134,7 @@ func TestMCPRemoteProxyFullReconciliation(t *testing.T) {
134134
RemoteURL: "https://mcp.example.com",
135135
ProxyPort: 9090,
136136
Transport: "sse",
137-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
137+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
138138
Type: mcpv1alpha1.OIDCConfigTypeInline,
139139
Inline: &mcpv1alpha1.InlineOIDCConfig{
140140
Issuer: "https://auth.company.com",
@@ -248,7 +248,7 @@ func TestMCPRemoteProxyFullReconciliation(t *testing.T) {
248248
Spec: mcpv1alpha1.MCPRemoteProxySpec{
249249
RemoteURL: "https://mcp.example.com",
250250
ProxyPort: 8080,
251-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
251+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
252252
Type: mcpv1alpha1.OIDCConfigTypeInline,
253253
Inline: &mcpv1alpha1.InlineOIDCConfig{
254254
Issuer: "https://auth.example.com",
@@ -363,7 +363,7 @@ func TestMCPRemoteProxyConfigChangePropagation(t *testing.T) {
363363
Spec: mcpv1alpha1.MCPRemoteProxySpec{
364364
RemoteURL: "https://mcp.example.com",
365365
ProxyPort: 8080,
366-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
366+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
367367
Type: mcpv1alpha1.OIDCConfigTypeInline,
368368
Inline: &mcpv1alpha1.InlineOIDCConfig{
369369
Issuer: "https://auth.example.com",
@@ -444,7 +444,7 @@ func TestMCPRemoteProxyStatusProgression(t *testing.T) {
444444
Spec: mcpv1alpha1.MCPRemoteProxySpec{
445445
RemoteURL: "https://mcp.example.com",
446446
ProxyPort: 8080,
447-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
447+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
448448
Type: mcpv1alpha1.OIDCConfigTypeInline,
449449
Inline: &mcpv1alpha1.InlineOIDCConfig{
450450
Issuer: "https://auth.example.com",
@@ -617,7 +617,7 @@ func TestEnsureAuthzConfigMapShared(t *testing.T) {
617617
},
618618
Spec: mcpv1alpha1.MCPRemoteProxySpec{
619619
RemoteURL: "https://mcp.example.com",
620-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
620+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
621621
Type: mcpv1alpha1.OIDCConfigTypeInline,
622622
Inline: &mcpv1alpha1.InlineOIDCConfig{
623623
Issuer: "https://auth.example.com",
@@ -681,7 +681,7 @@ func TestRBACClientIntegration(t *testing.T) {
681681
},
682682
Spec: mcpv1alpha1.MCPRemoteProxySpec{
683683
RemoteURL: "https://mcp.example.com",
684-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
684+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
685685
Type: mcpv1alpha1.OIDCConfigTypeInline,
686686
Inline: &mcpv1alpha1.InlineOIDCConfig{
687687
Issuer: "https://auth.example.com",
@@ -813,7 +813,7 @@ func TestValidateSpecConfigurationConditions(t *testing.T) {
813813
ObjectMeta: metav1.ObjectMeta{Name: "http-oidc-proxy", Namespace: "default"},
814814
Spec: mcpv1alpha1.MCPRemoteProxySpec{
815815
RemoteURL: "https://mcp.example.com",
816-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
816+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
817817
Type: mcpv1alpha1.OIDCConfigTypeInline,
818818
Inline: &mcpv1alpha1.InlineOIDCConfig{
819819
Issuer: "http://insecure-idp.example.com",
@@ -833,7 +833,7 @@ func TestValidateSpecConfigurationConditions(t *testing.T) {
833833
ObjectMeta: metav1.ObjectMeta{Name: "http-insecure-proxy", Namespace: "default"},
834834
Spec: mcpv1alpha1.MCPRemoteProxySpec{
835835
RemoteURL: "https://mcp.example.com",
836-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
836+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
837837
Type: mcpv1alpha1.OIDCConfigTypeInline,
838838
Inline: &mcpv1alpha1.InlineOIDCConfig{
839839
Issuer: "http://dev-idp.example.com",
@@ -853,7 +853,7 @@ func TestValidateSpecConfigurationConditions(t *testing.T) {
853853
ObjectMeta: metav1.ObjectMeta{Name: "https-oidc-proxy", Namespace: "default"},
854854
Spec: mcpv1alpha1.MCPRemoteProxySpec{
855855
RemoteURL: "https://mcp.example.com",
856-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
856+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
857857
Type: mcpv1alpha1.OIDCConfigTypeInline,
858858
Inline: &mcpv1alpha1.InlineOIDCConfig{
859859
Issuer: "https://auth.example.com",
@@ -872,7 +872,7 @@ func TestValidateSpecConfigurationConditions(t *testing.T) {
872872
ObjectMeta: metav1.ObjectMeta{Name: "invalid-cedar-proxy", Namespace: "default"},
873873
Spec: mcpv1alpha1.MCPRemoteProxySpec{
874874
RemoteURL: "https://mcp.example.com",
875-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
875+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
876876
Type: mcpv1alpha1.OIDCConfigTypeInline,
877877
Inline: &mcpv1alpha1.InlineOIDCConfig{
878878
Issuer: "https://auth.example.com",
@@ -898,7 +898,7 @@ func TestValidateSpecConfigurationConditions(t *testing.T) {
898898
ObjectMeta: metav1.ObjectMeta{Name: "missing-configmap-proxy", Namespace: "default"},
899899
Spec: mcpv1alpha1.MCPRemoteProxySpec{
900900
RemoteURL: "https://mcp.example.com",
901-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
901+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
902902
Type: mcpv1alpha1.OIDCConfigTypeInline,
903903
Inline: &mcpv1alpha1.InlineOIDCConfig{
904904
Issuer: "https://auth.example.com",
@@ -924,7 +924,7 @@ func TestValidateSpecConfigurationConditions(t *testing.T) {
924924
ObjectMeta: metav1.ObjectMeta{Name: "missing-header-secret-proxy", Namespace: "default"},
925925
Spec: mcpv1alpha1.MCPRemoteProxySpec{
926926
RemoteURL: "https://mcp.example.com",
927-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
927+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
928928
Type: mcpv1alpha1.OIDCConfigTypeInline,
929929
Inline: &mcpv1alpha1.InlineOIDCConfig{
930930
Issuer: "https://auth.example.com",
@@ -955,7 +955,7 @@ func TestValidateSpecConfigurationConditions(t *testing.T) {
955955
ObjectMeta: metav1.ObjectMeta{Name: "bad-scheme-proxy", Namespace: "default"},
956956
Spec: mcpv1alpha1.MCPRemoteProxySpec{
957957
RemoteURL: "ftp://bad-scheme.example.com",
958-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
958+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
959959
Type: mcpv1alpha1.OIDCConfigTypeInline,
960960
Inline: &mcpv1alpha1.InlineOIDCConfig{
961961
Issuer: "https://auth.example.com",
@@ -975,7 +975,7 @@ func TestValidateSpecConfigurationConditions(t *testing.T) {
975975
ObjectMeta: metav1.ObjectMeta{Name: "http-jwks-proxy", Namespace: "default"},
976976
Spec: mcpv1alpha1.MCPRemoteProxySpec{
977977
RemoteURL: "https://mcp.example.com",
978-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
978+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
979979
Type: mcpv1alpha1.OIDCConfigTypeInline,
980980
Inline: &mcpv1alpha1.InlineOIDCConfig{
981981
Issuer: "https://auth.example.com",
@@ -1064,7 +1064,7 @@ func TestValidateAndHandleConfigs(t *testing.T) {
10641064
Spec: mcpv1alpha1.MCPRemoteProxySpec{
10651065
RemoteURL: "https://mcp.example.com",
10661066
ProxyPort: 8080,
1067-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
1067+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
10681068
Type: mcpv1alpha1.OIDCConfigTypeInline,
10691069
Inline: &mcpv1alpha1.InlineOIDCConfig{
10701070
Issuer: "https://auth.example.com",
@@ -1100,7 +1100,7 @@ func TestValidateAndHandleConfigs(t *testing.T) {
11001100
Spec: mcpv1alpha1.MCPRemoteProxySpec{
11011101
RemoteURL: "https://mcp.example.com",
11021102
ProxyPort: 8080,
1103-
OIDCConfig: mcpv1alpha1.OIDCConfigRef{
1103+
OIDCConfig: &mcpv1alpha1.OIDCConfigRef{
11041104
Type: mcpv1alpha1.OIDCConfigTypeInline,
11051105
Inline: &mcpv1alpha1.InlineOIDCConfig{
11061106
Issuer: "https://auth.example.com",

0 commit comments

Comments
 (0)