Skip to content

fix(operator): rename BackendAuthType enum value to camelCase #4563

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tmchow wants to merge 6 commits into
base: main
Choose a base branch
from
Open

fix(operator): rename BackendAuthType enum value to camelCase #4563

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d536257
fix(operator): rename BackendAuthType enum value to camelCase
tmchow Apr 4, 2026
4ec8b72
fix(operator): deprecate old snake_case enum value instead of breaking
tmchow Apr 6, 2026
2077ea1
chore: regenerate CRDs and docs after enum update
tmchow Apr 6, 2026
5a591d2
fix: log deprecation warning when old snake_case auth type is used
tmchow Apr 6, 2026
276a139
style: wrap deprecation log to stay within 130-char line limit
tmchow Apr 6, 2026
792009b
ci: retrigger CI (flaky E2E test timeout)
tmchow Apr 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions cmd/thv-operator/api/v1alpha1/virtualmcpserver_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,12 +162,12 @@ type OutgoingAuthConfig struct {
// BackendAuthConfig defines authentication configuration for a backend MCPServer
type BackendAuthConfig struct {
// Type defines the authentication type
// +kubebuilder:validation:Enum=discovered;external_auth_config_ref
// +kubebuilder:validation:Enum=discovered;externalAuthConfigRef;external_auth_config_ref
// +kubebuilder:validation:Required
Type string `json:"type"`

// ExternalAuthConfigRef references an MCPExternalAuthConfig resource
// Only used when Type is "external_auth_config_ref"
// Only used when Type is "externalAuthConfigRef" (or deprecated "external_auth_config_ref")
// +optional
ExternalAuthConfigRef *ExternalAuthConfigRef `json:"externalAuthConfigRef,omitempty"`
}
Expand Down Expand Up @@ -341,7 +341,11 @@ const (
BackendAuthTypeDiscovered = "discovered"

// BackendAuthTypeExternalAuthConfigRef references an MCPExternalAuthConfig resource
BackendAuthTypeExternalAuthConfigRef = "external_auth_config_ref"
BackendAuthTypeExternalAuthConfigRef = "externalAuthConfigRef"

// DeprecatedBackendAuthTypeExternalAuthConfigRef is the old snake_case value.
// Deprecated: Use BackendAuthTypeExternalAuthConfigRef ("externalAuthConfigRef") instead.
DeprecatedBackendAuthTypeExternalAuthConfigRef = "external_auth_config_ref"
)

// Workflow step types
Expand Down Expand Up @@ -495,10 +499,10 @@ func (*VirtualMCPServer) validateBackendAuth(backendName string, auth BackendAut

// Validate type-specific configurations
switch auth.Type {
case BackendAuthTypeExternalAuthConfigRef:
case BackendAuthTypeExternalAuthConfigRef, DeprecatedBackendAuthTypeExternalAuthConfigRef:
if auth.ExternalAuthConfigRef == nil {
return fmt.Errorf(
"spec.outgoingAuth.backends[%s].externalAuthConfigRef is required when type is external_auth_config_ref",
"spec.outgoingAuth.backends[%s].externalAuthConfigRef is required when type is externalAuthConfigRef",
backendName)
}
if auth.ExternalAuthConfigRef.Name == "" {
Expand All @@ -510,7 +514,7 @@ func (*VirtualMCPServer) validateBackendAuth(backendName string, auth BackendAut

default:
return fmt.Errorf(
"spec.outgoingAuth.backends[%s].type must be one of: discovered, external_auth_config_ref",
"spec.outgoingAuth.backends[%s].type must be one of: discovered, externalAuthConfigRef",
backendName)
}

Expand Down
2 changes: 1 addition & 1 deletion cmd/thv-operator/api/v1alpha1/virtualmcpserver_types_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,7 @@ func TestBackendAuthConfigTypes(t *testing.T) {
isValid: true,
},
{
name: "external_auth_config_ref_valid",
name: "externalAuthConfigRef_valid",
authConfig: BackendAuthConfig{
Type: BackendAuthTypeExternalAuthConfigRef,
ExternalAuthConfigRef: &ExternalAuthConfigRef{
Expand Down
2 changes: 1 addition & 1 deletion cmd/thv-operator/controllers/virtualmcpserver_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1788,7 +1788,7 @@ func (r *VirtualMCPServerReconciler) convertBackendAuthConfigToVMCP(
}, nil
}

// For type="external_auth_config_ref", fetch and convert the referenced config
// For type="externalAuthConfigRef", fetch and convert the referenced config
if crdConfig.ExternalAuthConfigRef != nil {
// Fetch the MCPExternalAuthConfig and convert it
externalAuthConfig, err := ctrlutil.GetExternalAuthConfigByName(
Expand Down
6 changes: 3 additions & 3 deletions cmd/thv-operator/controllers/virtualmcpserver_externalauth_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -638,7 +638,7 @@ func TestBuildOutgoingAuthConfig(t *testing.T) {
OutgoingAuth: &mcpv1alpha1.OutgoingAuthConfig{
Source: "discovered",
Default: &mcpv1alpha1.BackendAuthConfig{
Type: "external_auth_config_ref",
Type: "externalAuthConfigRef",
ExternalAuthConfigRef: &mcpv1alpha1.ExternalAuthConfigRef{
Name: "missing-default-auth", // Auth config doesn't exist
},
Expand Down Expand Up @@ -676,7 +676,7 @@ func TestBuildOutgoingAuthConfig(t *testing.T) {
Source: "discovered",
Backends: map[string]mcpv1alpha1.BackendAuthConfig{
"api-backend": {
Type: "external_auth_config_ref",
Type: "externalAuthConfigRef",
ExternalAuthConfigRef: &mcpv1alpha1.ExternalAuthConfigRef{
Name: "missing-backend-auth",
},
Expand Down Expand Up @@ -765,7 +765,7 @@ func TestConvertBackendAuthConfigToVMCP(t *testing.T) {
validate func(*testing.T, *authtypes.BackendAuthStrategy)
}{
{
name: "external_auth_config_ref type",
name: "externalAuthConfigRef type",
crdConfig: &mcpv1alpha1.BackendAuthConfig{
Type: mcpv1alpha1.BackendAuthTypeExternalAuthConfigRef,
ExternalAuthConfigRef: &mcpv1alpha1.ExternalAuthConfigRef{
Expand Down
6 changes: 3 additions & 3 deletions cmd/thv-operator/controllers/virtualmcpserver_vmcpconfig_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,7 +196,7 @@ func TestConvertBackendAuthConfig(t *testing.T) {
Name: "auth-config",
},
},
// For external_auth_config_ref, the type comes from the referenced MCPExternalAuthConfig
// For externalAuthConfigRef, the type comes from the referenced MCPExternalAuthConfig
expectedType: "unauthenticated",
},
}
Expand All @@ -219,7 +219,7 @@ func TestConvertBackendAuthConfig(t *testing.T) {
},
}

// For external_auth_config_ref test, create the referenced MCPExternalAuthConfig
// For externalAuthConfigRef test, create the referenced MCPExternalAuthConfig
var converter *vmcpconfigconv.Converter
if tt.authConfig.Type == mcpv1alpha1.BackendAuthTypeExternalAuthConfigRef {
// Create a fake MCPExternalAuthConfig
Expand Down Expand Up @@ -259,7 +259,7 @@ func TestConvertBackendAuthConfig(t *testing.T) {

// Note: HeaderInjection and TokenExchange are nil because the CRD's
// BackendAuthConfig only stores type and reference information.
// For external_auth_config_ref, the actual auth config is resolved
// For externalAuthConfigRef, the actual auth config is resolved
// at runtime from the referenced MCPExternalAuthConfig resource.
assert.Nil(t, strategy.HeaderInjection)
assert.Nil(t, strategy.TokenExchange)
Expand Down
16 changes: 8 additions & 8 deletions cmd/thv-operator/controllers/virtualmcpserver_watch_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -751,7 +751,7 @@ func TestMapExternalAuthConfigToVirtualMCPServer(t *testing.T) {
Spec: mcpv1alpha1.VirtualMCPServerSpec{
OutgoingAuth: &mcpv1alpha1.OutgoingAuthConfig{
Default: &mcpv1alpha1.BackendAuthConfig{
Type: "external_auth_config_ref",
Type: "externalAuthConfigRef",
ExternalAuthConfigRef: &mcpv1alpha1.ExternalAuthConfigRef{
Name: "test-auth",
},
Expand Down Expand Up @@ -781,7 +781,7 @@ func TestMapExternalAuthConfigToVirtualMCPServer(t *testing.T) {
OutgoingAuth: &mcpv1alpha1.OutgoingAuthConfig{
Backends: map[string]mcpv1alpha1.BackendAuthConfig{
"backend1": {
Type: "external_auth_config_ref",
Type: "externalAuthConfigRef",
ExternalAuthConfigRef: &mcpv1alpha1.ExternalAuthConfigRef{
Name: "test-auth",
},
Expand Down Expand Up @@ -831,7 +831,7 @@ func TestMapExternalAuthConfigToVirtualMCPServer(t *testing.T) {
Spec: mcpv1alpha1.VirtualMCPServerSpec{
OutgoingAuth: &mcpv1alpha1.OutgoingAuthConfig{
Default: &mcpv1alpha1.BackendAuthConfig{
Type: "external_auth_config_ref",
Type: "externalAuthConfigRef",
ExternalAuthConfigRef: &mcpv1alpha1.ExternalAuthConfigRef{
Name: "test-auth",
},
Expand Down Expand Up @@ -1406,7 +1406,7 @@ func TestVmcpReferencesExternalAuthConfig(t *testing.T) {
Spec: mcpv1alpha1.VirtualMCPServerSpec{
OutgoingAuth: &mcpv1alpha1.OutgoingAuthConfig{
Default: &mcpv1alpha1.BackendAuthConfig{
Type: "external_auth_config_ref",
Type: "externalAuthConfigRef",
ExternalAuthConfigRef: &mcpv1alpha1.ExternalAuthConfigRef{
Name: "test-auth",
},
Expand All @@ -1424,7 +1424,7 @@ func TestVmcpReferencesExternalAuthConfig(t *testing.T) {
OutgoingAuth: &mcpv1alpha1.OutgoingAuthConfig{
Backends: map[string]mcpv1alpha1.BackendAuthConfig{
"backend1": {
Type: "external_auth_config_ref",
Type: "externalAuthConfigRef",
ExternalAuthConfigRef: &mcpv1alpha1.ExternalAuthConfigRef{
Name: "test-auth",
},
Expand Down Expand Up @@ -1460,7 +1460,7 @@ func TestVmcpReferencesExternalAuthConfig(t *testing.T) {
Spec: mcpv1alpha1.VirtualMCPServerSpec{
OutgoingAuth: &mcpv1alpha1.OutgoingAuthConfig{
Default: &mcpv1alpha1.BackendAuthConfig{
Type: "external_auth_config_ref",
Type: "externalAuthConfigRef",
ExternalAuthConfigRef: &mcpv1alpha1.ExternalAuthConfigRef{
Name: "other-auth",
},
Expand All @@ -1478,13 +1478,13 @@ func TestVmcpReferencesExternalAuthConfig(t *testing.T) {
OutgoingAuth: &mcpv1alpha1.OutgoingAuthConfig{
Backends: map[string]mcpv1alpha1.BackendAuthConfig{
"backend1": {
Type: "external_auth_config_ref",
Type: "externalAuthConfigRef",
ExternalAuthConfigRef: &mcpv1alpha1.ExternalAuthConfigRef{
Name: "other-auth",
},
},
"backend2": {
Type: "external_auth_config_ref",
Type: "externalAuthConfigRef",
ExternalAuthConfigRef: &mcpv1alpha1.ExternalAuthConfigRef{
Name: "test-auth",
},
Expand Down
16 changes: 13 additions & 3 deletions cmd/thv-operator/pkg/vmcpconfig/converter.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -452,10 +452,20 @@ func (c *Converter) convertBackendAuthConfig(
}, nil
}

// If type is "external_auth_config_ref", resolve the MCPExternalAuthConfig
if crdConfig.Type == mcpv1alpha1.BackendAuthTypeExternalAuthConfigRef {
// Handle deprecated snake_case value
if crdConfig.Type == mcpv1alpha1.DeprecatedBackendAuthTypeExternalAuthConfigRef {
log.FromContext(ctx).Info(
"backend auth type \"external_auth_config_ref\" is deprecated,"+
" use \"externalAuthConfigRef\" instead",
"backend", backendName, "vmcp", vmcp.Name,
)
}

// If type is "externalAuthConfigRef" (or deprecated "external_auth_config_ref"), resolve the MCPExternalAuthConfig
if crdConfig.Type == mcpv1alpha1.BackendAuthTypeExternalAuthConfigRef ||
crdConfig.Type == mcpv1alpha1.DeprecatedBackendAuthTypeExternalAuthConfigRef {
if crdConfig.ExternalAuthConfigRef == nil {
return nil, fmt.Errorf("backend %s: external_auth_config_ref type requires externalAuthConfigRef field", backendName)
return nil, fmt.Errorf("backend %s: externalAuthConfigRef type requires externalAuthConfigRef field", backendName)
}

// Fetch the MCPExternalAuthConfig resource
Expand Down
6 changes: 4 additions & 2 deletions deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_virtualmcpservers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2136,7 +2136,7 @@ spec:
externalAuthConfigRef:
description: |-
ExternalAuthConfigRef references an MCPExternalAuthConfig resource
Only used when Type is "external_auth_config_ref"
Only used when Type is "externalAuthConfigRef" (or deprecated "external_auth_config_ref")
properties:
name:
description: Name is the name of the MCPExternalAuthConfig
Expand All @@ -2149,6 +2149,7 @@ spec:
description: Type defines the authentication type
enum:
- discovered
- externalAuthConfigRef
- external_auth_config_ref
type: string
required:
Expand All @@ -2165,7 +2166,7 @@ spec:
externalAuthConfigRef:
description: |-
ExternalAuthConfigRef references an MCPExternalAuthConfig resource
Only used when Type is "external_auth_config_ref"
Only used when Type is "externalAuthConfigRef" (or deprecated "external_auth_config_ref")
properties:
name:
description: Name is the name of the MCPExternalAuthConfig
Expand All @@ -2178,6 +2179,7 @@ spec:
description: Type defines the authentication type
enum:
- discovered
- externalAuthConfigRef
- external_auth_config_ref
type: string
required:
Expand Down
6 changes: 4 additions & 2 deletions deploy/charts/operator-crds/templates/toolhive.stacklok.dev_virtualmcpservers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2139,7 +2139,7 @@ spec:
externalAuthConfigRef:
description: |-
ExternalAuthConfigRef references an MCPExternalAuthConfig resource
Only used when Type is "external_auth_config_ref"
Only used when Type is "externalAuthConfigRef" (or deprecated "external_auth_config_ref")
properties:
name:
description: Name is the name of the MCPExternalAuthConfig
Expand All @@ -2152,6 +2152,7 @@ spec:
description: Type defines the authentication type
enum:
- discovered
- externalAuthConfigRef
- external_auth_config_ref
type: string
required:
Expand All @@ -2168,7 +2169,7 @@ spec:
externalAuthConfigRef:
description: |-
ExternalAuthConfigRef references an MCPExternalAuthConfig resource
Only used when Type is "external_auth_config_ref"
Only used when Type is "externalAuthConfigRef" (or deprecated "external_auth_config_ref")
properties:
name:
description: Name is the name of the MCPExternalAuthConfig
Expand All @@ -2181,6 +2182,7 @@ spec:
description: Type defines the authentication type
enum:
- discovered
- externalAuthConfigRef
- external_auth_config_ref
type: string
required:
Expand Down
4 changes: 2 additions & 2 deletions docs/operator/crd-api.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 4 additions & 4 deletions test/e2e/thv-operator/virtualmcp/virtualmcp_external_auth_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -281,7 +281,7 @@ var _ = Describe("VirtualMCPServer Inline Unauthenticated Backend Auth", Ordered
// Explicitly configure unauthenticated for specific backend
Backends: map[string]mcpv1alpha1.BackendAuthConfig{
backendName: {
Type: "external_auth_config_ref",
Type: "externalAuthConfigRef",
ExternalAuthConfigRef: &mcpv1alpha1.ExternalAuthConfigRef{
Name: externalAuthConfigName,
},
Expand Down Expand Up @@ -328,7 +328,7 @@ var _ = Describe("VirtualMCPServer Inline Unauthenticated Backend Auth", Ordered
Expect(k8sClient.Get(ctx, types.NamespacedName{Name: vmcpServerName, Namespace: testNamespace}, vmcpServer)).To(Succeed())
Expect(vmcpServer.Spec.OutgoingAuth.Source).To(Equal("inline"))
Expect(vmcpServer.Spec.OutgoingAuth.Backends).To(HaveKey(backendName))
Expect(vmcpServer.Spec.OutgoingAuth.Backends[backendName].Type).To(Equal("external_auth_config_ref"))
Expect(vmcpServer.Spec.OutgoingAuth.Backends[backendName].Type).To(Equal("externalAuthConfigRef"))
Expect(vmcpServer.Spec.OutgoingAuth.Backends[backendName].ExternalAuthConfigRef.Name).To(Equal(externalAuthConfigName))

By("Creating MCP client and listing tools")
Expand Down Expand Up @@ -680,7 +680,7 @@ var _ = Describe("VirtualMCPServer Inline HeaderInjection Backend Auth", Ordered
// Explicitly configure headerInjection for specific backend
Backends: map[string]mcpv1alpha1.BackendAuthConfig{
backendName: {
Type: "external_auth_config_ref",
Type: "externalAuthConfigRef",
ExternalAuthConfigRef: &mcpv1alpha1.ExternalAuthConfigRef{
Name: externalAuthConfigName,
},
Expand Down Expand Up @@ -730,7 +730,7 @@ var _ = Describe("VirtualMCPServer Inline HeaderInjection Backend Auth", Ordered
Expect(k8sClient.Get(ctx, types.NamespacedName{Name: vmcpServerName, Namespace: testNamespace}, vmcpServer)).To(Succeed())
Expect(vmcpServer.Spec.OutgoingAuth.Source).To(Equal("inline"))
Expect(vmcpServer.Spec.OutgoingAuth.Backends).To(HaveKey(backendName))
Expect(vmcpServer.Spec.OutgoingAuth.Backends[backendName].Type).To(Equal("external_auth_config_ref"))
Expect(vmcpServer.Spec.OutgoingAuth.Backends[backendName].Type).To(Equal("externalAuthConfigRef"))
Expect(vmcpServer.Spec.OutgoingAuth.Backends[backendName].ExternalAuthConfigRef.Name).To(Equal(externalAuthConfigName))

By("Creating MCP client and listing tools")
Expand Down
Loading