Summary

The enum value "external_auth_config_ref" is the only snake_case enum value in the entire CRD codebase. All other type discriminator enums use camelCase (tokenExchange, headerInjection, bearerToken, embeddedAuthServer, awsSts, upstreamInject, kubernetesServiceAccount, etc.). This should be standardized to "externalAuthConfigRef" before the API stabilizes.

What to change

1. Constant and enum markers (cmd/thv-operator/api/v1alpha1/virtualmcpserver_types.go)

Constant (~line 340): change the string value from "external_auth_config_ref" to "externalAuthConfigRef":

// Before
BackendAuthTypeExternalAuthConfigRef = "external_auth_config_ref"

// After
BackendAuthTypeExternalAuthConfigRef = "externalAuthConfigRef"

Kubebuilder Enum markers (~lines 165 and 170): update the validation enum values:

// Before
// +kubebuilder:validation:Enum=discovered;external_auth_config_ref

// After
// +kubebuilder:validation:Enum=discovered;externalAuthConfigRef

There are two Enum markers in this file that reference this value — update both.

CEL validation rules (~lines 494, 497, 509): search for 'external_auth_config_ref' in CEL expressions and update to 'externalAuthConfigRef'. These are in XValidation rules on the BackendAuthConfig struct.

2. Converter logic (cmd/thv-operator/pkg/vmcpconfig/converter.go)

~Lines 455-458: update any string comparisons or references to the old value. The code uses the Go constant BackendAuthTypeExternalAuthConfigRef so this should just work after step 1, but verify no hardcoded strings exist.

3. Unit tests

These files have string literals "external_auth_config_ref" in test fixtures that need updating to "externalAuthConfigRef":

• cmd/thv-operator/api/v1alpha1/virtualmcpserver_types_test.go (~lines 279, 281)
• cmd/thv-operator/controllers/virtualmcpserver_vmcpconfig_test.go (~lines 193, 198, 221, 223, 261)
• cmd/thv-operator/controllers/virtualmcpserver_externalauth_test.go (~lines 309, 419, 482, 525, 640, 678, 767, 769, 802)
• cmd/thv-operator/controllers/virtualmcpserver_watch_test.go (~lines 754, 784, 834, 1409, 1427, 1463, 1481, 1487)

4. E2E tests

• test/e2e/thv-operator/virtualmcp/virtualmcp_external_auth_test.go (~lines 284, 331, 683, 733)

5. Regenerate

After all source changes:

task gen          # Regenerates CRD manifests (YAML files update automatically)
task crdref-gen   # Regenerates CRD API docs
task lint-fix     # Fix any lint issues
task lint         # Verify clean
task test         # Unit tests pass

The CRD YAML manifests in deploy/charts/operator-crds/ and docs in docs/operator/ are auto-generated — do not edit them manually.

Notes

• The Go constant name BackendAuthTypeExternalAuthConfigRef stays the same — only its string value changes.
• Existing VirtualMCPServer resources with type: external_auth_config_ref will be rejected after the CRD update. This is acceptable for a v1alpha1 API.
• The "discovered" value is lowercase (not camelCase) but that's fine — it's a single word, consistent with other single-word values like "inline" and "anonymous".

Generated with Claude Code